EXTREME-ACL-MIB

All MIBs › EXTREME-ACL-MIB

Organization: Extreme Networks, Inc.

Last Updated: 2015-12-11

Category: Domain: Security, Vendor: Extreme Networks

Description: Manages Access Control List (ACL) rules, policies, and match statistics on Extreme Networks switches and routers.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is EXTREME-ACL-MIB?

EXTREME-ACL-MIB is an Extreme Networks proprietary MIB for managing Access Control List (ACL) rules and policies applied to switch and router ports, along with the statistics counters those rules generate. It exposes ACL match/hit statistics tables alongside conformance groups defining which ACL features and compliance levels are supported. Its monitoring role centers on software configuration and security enforcement status: per-ACL statistics reveal how much traffic is being permitted or denied by each rule, letting operators verify that access-control policy is being enforced as intended and spot rules that are unexpectedly matching (or not matching) traffic. It is a self-contained Extreme Networks vendor extension for its switch/router ACL feature set, not dependent on an external IETF ACL standard. It is deployed on Extreme Networks switches and routers wherever port- or VLAN-based traffic filtering and security policy enforcement is configured, making EXTREME-ACL-MIB SNMP monitoring a routine part of verifying ACL rules are actually being enforced.

IPNetwork Monitor allows you to monitor SNMP objects defined in EXTREME-ACL-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Extreme Networks switch
Extreme Networks router

Monitoring Examples

An administrator would poll extremeAclStatsTable to retrieve per-ACL-rule packet/byte hit counters, confirming that a security rule intended to block a specific source subnet is actually matching and dropping traffic rather than being bypassed by a routing or ordering error. A rule showing zero hits when traffic is known to be flowing through that path indicates a misconfigured ACL entry or incorrect rule ordering. The aclCompliances and aclGroups conformance objects are checked by management tooling to confirm which ACL statistics features are supported on a given switch model before building ACL-hit dashboards.

What Can Be Monitored

ACL rule hit/match statistics
ACL rule packet and byte counts
ACL feature conformance support

Imported Objects

From EXTREME-BASE-MIB

extremeAgent

OBJECT-IDENTITY

From EXTREME-CLEARFLOW-MIB

extremeAclDirection

OBJECT-TYPE

From IF-MIB

InterfaceIndexOrZero

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Counter64
Integer32
MODULE-IDENTITY
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DisplayString

How to Use in IPNetwork Monitor

Example using extremeAclStatsPktCount OID:

Select an Extreme Networks switch or router as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type extremeAclStatsPktCount into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. The total number of packets that matches this rule. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter64-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
extremeAcl	1.3.6.1.4.1.1916.1.48			Extreme Networks Access Control List MIB
extremeAclObjects	1.3.6.1.4.1.1916.1.48.1
extremeAclStatsTable	1.3.6.1.4.1.1916.1.48.1.1		not-accessible	This table provides ingress and egress statistics information for the access control list configured for the VLAN and Port interface in the system. Here is the usage guidelines for this MIB: 1) To retrieve the ingress/egress statistics information for a counter installed on a port specify extremeAclStatsPortIfIndex with the corresponding portIfIndex and extremeAclStatsVlanIfIndex with 0. 2) To retrieve the ingress/egress statistics information for a counter installed on a VLAN specify extremeAclStatsVlanIfIndex with the corresponding vlanIfIndex and extremeAclStatsPortIfIndex with 0. 3) To retrieve the ingress/egress statistics information for the wild card entry (the rule applied all ports), specify both extremeAclStatsPortIfIndex and extremeAclStatsVlanIfIndex with 0. 4) Right now we do not support acls to be installed in vlan and port. If we start supporting the same, specifiy extremeAclStatsVlanIfIndex with the corresponding vlanIfIndex and extremeAclStatsPortIfIndex with the corresponding portIfIndex. 5) To retrieve statistics for a counter applied in ingress direction, specify extremeAclDirection with the value 0 and for statistics for a counter applied in egress direction specify extremeAclDirection, with the value 1.
extremeAclStatsEntry	1.3.6.1.4.1.1916.1.48.1.1.1		not-accessible	An entry (conceptual row) in the extremeAclStatsTable.
NUM extremeAclStatsVlanIfIndex	1.3.6.1.4.1.1916.1.48.1.1.1.1	InterfaceIndexOrZero	not-accessible	The IfIndex of the VLAN in which this policy/rule is applied.
NUM extremeAclStatsPortIfIndex	1.3.6.1.4.1.1916.1.48.1.1.1.2	InterfaceIndexOrZero	not-accessible	The IfIndex of the the port in which this policy/rule is applied.
I32 extremeAclDirection	1.3.6.1.4.1.1916.1.48.1.1.1.3	Integer32	not-accessible	The ingress/egress direction to which this policy/rule is applied.
STR extremeAclStatsCounterName	1.3.6.1.4.1.1916.1.48.1.1.1.4	DisplayString	not-accessible	Name of the counter for which the stats is requested.
C64 extremeAclStatsPktCountEx	1.3.6.1.4.1.1916.1.48.1.1.1.5	Counter64	read-only	The total number of packets that matches this rule.
C64 extremeAclStatsByteCount	1.3.6.1.4.1.1916.1.48.1.1.1.6	Counter64	read-only	The total number of bytes that matches this rule.
aclConformance	1.3.6.1.4.1.1916.1.48.9
aclGroups	1.3.6.1.4.1.1916.1.48.9.1
aclCounterStatsGroup	1.3.6.1.4.1.1916.1.48.9.1.1			A collection of objects providing statistical information for rules applied to a port or vlan
aclCompliances	1.3.6.1.4.1.1916.1.48.9.2
aclStatistics	1.3.6.1.4.1.1916.1.48.9.2.1			The compliance statement for acl statistics

RFC description

Extreme Networks access control list MIB (OID 1.3.6.1.4.1.1916.1.48) for managing and monitoring ACL configurations on ExtremeXOS switches and network devices.

Start monitoring Extreme Networks switches and routers with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download EXTREME-ACL-MIB