DELLEMC-OS10-PORT-SECURITY-MIB

All MIBs › DELLEMC-OS10-PORT-SECURITY-MIB

Organization: Dell Inc

Last Updated: 2019-07-22

Category: VPN and Security, Vendor: Dell

Description: Manages port security MAC address lockdown and violation policies for Dell EMC OS10 switches.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is DELLEMC-OS10-PORT-SECURITY-MIB?

DELLEMC-OS10-PORT-SECURITY-MIB is a Dell EMC vendor MIB for OS10-based switches that manages the Layer 2 port security feature, which restricts and tracks which MAC addresses are allowed to communicate on a given switchport. It belongs to the Dell EMC OS10 networking software family and exposes both global switch-wide security settings and per-interface configuration and violation state. For monitoring it is used almost entirely for software/feature status: whether port security is globally and per-port enabled, how many secure (static, dynamic, sticky) MAC addresses are currently learned, and whether a security violation (unauthorized MAC) has occurred on a port. It is a self-contained feature MIB that layers on top of standard IF-MIB interface indexing (via os10PortSecurityIfIndex) for per-port context. It is deployed on Dell EMC PowerSwitch OS10 switches in enterprise access-layer environments where MAC-based port lockdown is used to prevent rogue device attachment. Engineers can download the DELLEMC-OS10-PORT-SECURITY-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in DELLEMC-OS10-PORT-SECURITY-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Dell EMC PowerSwitch (OS10-based) switches

Monitoring Examples

An admin would poll os10PortSecurityGlobalTotalSecureAddresses and the per-interface os10PortSecurityIfConfigTable/os10PortSecurityIfConfigEntry to see how many secure MAC addresses are registered on each port, and check os10PortSecurityIfViolationStatus to detect if an unauthorized device attempted to connect to a locked-down port. A rising os10PortSecurityGlobalTotalSecureDynamicAddresses count combined with a violation status flag on a specific interface would indicate an unexpected new device or a possible spoofing attempt. Operators could also use os10PortSecurityGlobalResetViolation remotely to clear a violation after investigation.

What Can Be Monitored

port security enabled/disabled state
secure MAC address counts (static/dynamic/sticky)
per-port violation status
total secure addresses learned
port security violation events

Imported Objects

From DELLEMC-OS10-SMI-MIB

os10	OBJECT-IDENTITY

From IF-MIB

InterfaceIndex

From Q-BRIDGE-MIB

VlanIndex

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Integer32
MODULE-IDENTITY
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

MacAddress
TEXTUAL-CONVENTION
TruthValue

How to Use in IPNetwork Monitor

Example using os10PortSecurityGlobalTotalSecureAddresses OID:

Select a Dell EMC switch as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type os10PortSecurityGlobalTotalSecureAddresses into the Find box to locate it in the OID tree, then select it and click OK. The total number of MAC addresses secured in the device. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is an Integer32-type OID, Value bounds is the most useful condition here — trigger an alert if the count changes from its expected baseline, since that would indicate the underlying set of items changed unexpectedly. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
os10PortSecurityMib	1.3.6.1.4.1.674.11000.5000.100.5			The Mib module for managing Dell Networking L2 Port Security feature.
os10PortSecurityMibObjects	1.3.6.1.4.1.674.11000.5000.100.5.1
os10PortSecurityGlobalObjects	1.3.6.1.4.1.674.11000.5000.100.5.1.1
T/F os10PortSecurityGlobalEnable	1.3.6.1.4.1.674.11000.5000.100.5.1.1.1	TruthValue	read-write	This object is used to enable or disable port security feature globally on the device.
I32 os10PortSecurityGlobalTotalSecureAddressesEx	1.3.6.1.4.1.674.11000.5000.100.5.1.1.2	Integer32	read-only	The total number of MAC addresses secured in the device.
I32 os10PortSecurityGlobalTotalSecureDynamicAddresses	1.3.6.1.4.1.674.11000.5000.100.5.1.1.3	Integer32	read-only	The total number of secure dynamic MAC addresses in the device.
I32 os10PortSecurityGlobalTotalSecureStickyAddresses	1.3.6.1.4.1.674.11000.5000.100.5.1.1.4	Integer32	read-only	The total number of secure sticky MAC addresses in the device.
I32 os10PortSecurityGlobalTotalSecureStaticAddresses	1.3.6.1.4.1.674.11000.5000.100.5.1.1.5	Integer32	read-only	The total number of secure static MAC addresses in the device.
SEC os10PortSecurityGlobalClearSecureMacAddresses	1.3.6.1.4.1.674.11000.5000.100.5.1.1.6	SecureMacAddrType	read-write	This object is used to delete all the secure MAC addresses in the device based on the specified type.
SEC os10PortSecurityGlobalResetViolation	1.3.6.1.4.1.674.11000.5000.100.5.1.1.7	SecureMacViolationType	read-write	This object is used to reset the selected violation type on all port security interfaces in the device. Get request of this object always returns zero as value set through this object will not be stored in database
os10PortSecurityInterfaceObjects	1.3.6.1.4.1.674.11000.5000.100.5.1.2
os10PortSecurityIfConfigTable	1.3.6.1.4.1.674.11000.5000.100.5.1.2.1		not-accessible	A table for Port Security configuration entries. The number of entries is determined by the number of interfaces in the system that can support the port security feature.
os10PortSecurityIfConfigEntry	1.3.6.1.4.1.674.11000.5000.100.5.1.2.1.1		not-accessible	Entry containing port security information for a particular interface.
NUM os10PortSecurityIfIndex	1.3.6.1.4.1.674.11000.5000.100.5.1.2.1.1.1	InterfaceIndex	not-accessible	Index to this table. The index value used to identify the port security configurations associated with this entry
T/F os10PortSecurityIfPortSecurityEnable	1.3.6.1.4.1.674.11000.5000.100.5.1.2.1.1.2	TruthValue	read-write	This Mib object specifies if the port security feature is enabled or not on an interface. The value of this object has no effect when the value of os10PortSecurityGlobalEnable is set to 'false'.
INT os10PortSecurityIfViolationStatus	1.3.6.1.4.1.674.11000.5000.100.5.1.2.1.1.3	INTEGER	read-only	This object represents the port security status of an interface. normal(1) - This indicates port is operating normally without any violation. macLearnLimitErrDisable(2) - This indicates that the port is shutdown due to mac learn limit violation when the object os10PortSecurityIfMacViolationAction is of type 'shutdown'. stationMoveErrDisable(3) - This indicates that the port is shutdown due to station move violation when the object os10PortSecurityIfStmvViolationAction is of type 'shutdownOrig' or 'shutdownOffending' or 'shutdownBoth'.
U32 os10PortSecurityIfSecureMacLearnLimit	1.3.6.1.4.1.674.11000.5000.100.5.1.2.1.1.4	Unsigned32	read-write	The maximum number of MAC addresses to be secured on the interface. User can secure a minimum of one and maximum of 3072 mac addresses on a port. i.e set operation is allowed only with in range 1-3072. If the newly configured mac learning limit value is smaller than already learnt secure MAC addresses, then all the secure MAC addresses learnt so far (secure sticky or secure dynamic) will be flushed. In case, total number of secure static mac addresses (configured) count is greater than newly specified mac learn limit, configuration will be rejected. Administrator has to delete the extra secure static addresses or mac learn limit should be modified to accomodate existing secure static mac addresses. User can remove the mac learing limit restriction by setting value 4294967295.
T/F os10PortSecurityIfStationMoveEnable	1.3.6.1.4.1.674.11000.5000.100.5.1.2.1.1.5	TruthValue	read-write	This object is used to enable or disable station movement on the dynamically secured mac addresses learnt on the interface. By default, this is set to false. It is not possible to enable the station movement on a port with sticky feature enabled
INT os10PortSecurityIfMacViolationAction	1.3.6.1.4.1.674.11000.5000.100.5.1.2.1.1.6	INTEGER	read-write	Determines the action to be taken when mac limit violation occurs in the system. drop(1) - No further MAC learning is allowed on the interface. Packets received with a source MAC address which is not in the secured MAC address list will be dropped. dropAndNotify(2) - No further MAC learning is allowed on the interface and a syslog message or an event is emitted to notify about port security violation. shutdown(3) - The interface will be shut down. forward(4) - No further MAC learning is allowed on the interface. Packets received with a source MAC address which is not in the secured MAC address list will be flooded or forwarded.
INT os10PortSecurityIfStmvViolationAction	1.3.6.1.4.1.674.11000.5000.100.5.1.2.1.1.7	INTEGER	read-write	Determines the action to be taken when a secure dynamic mac address move violation occurs in the system. drop(1) - The MAC address that triggered the violation shall not be learned on the new port (offending port). The packets that triggered the violation shall be dropped. dropAndNotify(2) - Raises a syslog to notify about station movement violation. The log will contain MAC causing violation, vlanId, original interface name and offending interface name. shutdownOrigPort(3) - The original interface on which MAC is learnt will be shutdown. shutdownOffendigPort(4) - The offending interface causing station move will be shutdown. shutdowBoth(5) - Both the original and offending interfaces will be shutdown.
T/F os10PortSecurityIfStickyEnable	1.3.6.1.4.1.674.11000.5000.100.5.1.2.1.1.8	TruthValue	read-write	Set to 'true' to enable and 'false' to disable Sticky port security feature on this interface. Enabling this feature allows the device to secure learnt MAC addresses on this interface permanently. In order to remove the sticky addresses on this interface, user has to manually delete the sticky MAC address(es) or disable the sticky feature itself. Manual deletion of all addresses can be accomplished by os10PortSecurityIfClearSecureMacAddresses object. It is possible to enable sticky feature on a port only if mac learning limit restriction is enabled with os10PortSecurityIfSecureMacLearnLimit.
SEC os10PortSecurityIfClearSecureMacAddresses	1.3.6.1.4.1.674.11000.5000.100.5.1.2.1.1.9	SecureMacAddrType	read-write	This object is used to delete secure MAC addresses based on the specified type.
T/F os10PortSecurityIfSecureMacAgeEnable	1.3.6.1.4.1.674.11000.5000.100.5.1.2.1.1.10	TruthValue	read-write	This object is used to enable aging of the dynamically secured mac addresses learnt on the interface. Sticky and static macs will never age out. It is not possible to enable aging on a port on which sticky feature is enabled. By default, this is set to false.
I32 os10PortSecurityIfTotalSecureAddresses	1.3.6.1.4.1.674.11000.5000.100.5.1.2.1.1.11	Integer32	read-only	The total number of secured MAC addresses learnt (dynamic or stickt) or configured (static) on a particular interface.
I32 os10PortSecurityIfTotalSecureDynamicAddresses	1.3.6.1.4.1.674.11000.5000.100.5.1.2.1.1.12	Integer32	read-only	The total number of secure dynamic MAC addresses learnt on a particular interface.
I32 os10PortSecurityIfTotalSecureStickyAddresses	1.3.6.1.4.1.674.11000.5000.100.5.1.2.1.1.13	Integer32	read-only	The total number of secure sticky MAC addresses learnt on a particular interface.
I32 os10PortSecurityIfTotalSecureStaticAddresses	1.3.6.1.4.1.674.11000.5000.100.5.1.2.1.1.14	Integer32	read-only	The total number of secure static MAC addresses configured on a particular interface.
os10PortSecurityMacObjects	1.3.6.1.4.1.674.11000.5000.100.5.1.3
os10PortSecuritySecureMacAddrTable	1.3.6.1.4.1.674.11000.5000.100.5.1.3.1		not-accessible	A table containing the list of secure MAC addresses.
os10PortSecuritySecureMacAddrEntry	1.3.6.1.4.1.674.11000.5000.100.5.1.3.1.1		not-accessible	Entry containing secure MAC address information for a particular interface.
VLA os10PortSecuritySecureMacVlanId	1.3.6.1.4.1.674.11000.5000.100.5.1.3.1.1.1	VlanIndex	not-accessible	This is the vlan on which the os10PortSecuritySecureMacAddress is configured or learnt.
MAC os10PortSecuritySecureMacAddress	1.3.6.1.4.1.674.11000.5000.100.5.1.3.1.1.2	MacAddress	not-accessible	This is a secure MAC address configured or learnt on an interface.
NUM os10PortSecuritySecureMacIfIndex	1.3.6.1.4.1.674.11000.5000.100.5.1.3.1.1.3	InterfaceIndex	read-only	This is the interface on which the os10PortSecuritySecureMacAddress is configured or learnt.
INT os10PortSecuritySecureMacAddrType	1.3.6.1.4.1.674.11000.5000.100.5.1.3.1.1.4	INTEGER	read-only	This object indicates if the secure MAC address is a configured 'static' or learnt 'dynamic' or learnt and retained across reboots 'sticky'.
os10PortSecurityMibConformance	1.3.6.1.4.1.674.11000.5000.100.5.2
os10PortSecurityCompliances	1.3.6.1.4.1.674.11000.5000.100.5.2.1
os10PortSecurityMibConform	1.3.6.1.4.1.674.11000.5000.100.5.2.1.1			The compliance statement for the Dell Networking OS Port Security Mib.
os10PortSecurityGroups	1.3.6.1.4.1.674.11000.5000.100.5.2.2
os10PortSecurityGlobalGroup	1.3.6.1.4.1.674.11000.5000.100.5.2.2.1			A set of global objects for use with the Port Security feature.
os10PortSecurityInterfaceGroup	1.3.6.1.4.1.674.11000.5000.100.5.2.2.2			A set of interface level objects for use with the Port Security feature.
os10PortSecuritySecureMacAddrGroup	1.3.6.1.4.1.674.11000.5000.100.5.2.2.3			Static secure MAC addresss configuration parameters on an interface.

RFC description

Manages Dell Networking L2 port security features including MAC address handling and VLAN enforcement.

Start monitoring Dell EMC switches with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download DELLEMC-OS10-PORT-SECURITY-MIB