FDRY-ACL-MIB

All MIBs › FDRY-ACL-MIB

Organization: Brocade Communications Systems, Inc.

Last Updated: 2010-06-02

Category: Vendor: Foundry/Brocade

Description: Foundry/Brocade FastIron MIB for Access Control List (ACL) configuration and packet filtering statistics on Foundry switches.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is FDRY-ACL-MIB?

FDRY-ACL-MIB is a Foundry Networks/Brocade proprietary MIB for managing IPv6 Access Control Lists on Foundry/Brocade FastIron switches and routers. It defines a table of ACL entries specifying rule name, action (permit/deny), protocol, source/destination IP and prefix length, and operator/operand fields for port matching, mirroring how ACL rules are configured on the CLI. Its monitoring value is primarily configuration/software-state visibility, confirming which ACL rules are active, their match criteria, and permit/deny actions, useful for auditing security policy and diagnosing unexpected traffic filtering such as legitimate traffic being dropped or malicious traffic passing due to a misconfigured rule. It is a Brocade proprietary extension layered on top of standard interface/QoS MIB conventions and is typically paired with Brocade's other FastIron security and interface MIBs. It is deployed on Foundry/Brocade FastIron switches in enterprise networks where IPv6 ACL-based filtering is enforced. Engineers can download the FDRY-ACL-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in FDRY-ACL-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Foundry/Brocade FastIron switches and routers

Monitoring Examples

An administrator can poll fdryIpv6AclTable/fdryIpv6AclEntry for a given fdryIpv6AclIndex to inspect fdryIpv6AclName, fdryIpv6AclAction, fdryIpv6AclProtocol, and fdryIpv6AclSourceIp/fdryIpv6AclDestinationIp along with their prefix lengths. If traffic that should be blocked is passing through, comparing the configured fdryIpv6AclAction and the fdryIpv6AclSourceOperator/fdryIpv6AclSourceOperand1 fields against intended policy quickly reveals a misconfigured or missing ACL rule.

What Can Be Monitored

ACL rule configuration
ACL permit/deny action
source/destination IP and prefix filtering
protocol/port match criteria

Imported Objects

From FOUNDRY-SN-ROOT-MIB

fdryAcl

OBJECT-IDENTITY

From IPV6-TC

Ipv6Address

From SNMPv2-SMI

MODULE-IDENTITY
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DisplayString
RowStatus
TEXTUAL-CONVENTION
TruthValue

OIDs

OID symbolic	OID numeric	Type	Access	Description
fdryAclMIB	1.3.6.1.4.1.1991.1.2.16.1			The Brocade proprietary MIB module for Ipv6 Access Control List. It has new tables for Ipv6 Access Control List. Copyright 1996-2010 Brocade Communications Systems, Inc. All rights reserved. This Brocade Communications Systems SNMP Management Information Base Specification embodies Brocade Communications Systems' confidential and proprietary intellectual property. Brocade Communications Systems retains all title and ownership in the Specification, including any revisions. This Specification is supplied AS IS, and Brocade Communications Systems makes no warranty, either express or implied, as to the use, operation, condition, or performance of the specification, and any unintended consequence it may on the user environment.
fdryIpv6Acl	1.3.6.1.4.1.1991.1.2.16.1.1
fdryIpv6AclTable	1.3.6.1.4.1.1991.1.2.16.1.1.1		not-accessible	Table of Ipv6 Access Control List
fdryIpv6AclEntry	1.3.6.1.4.1.1991.1.2.16.1.1.1.1		not-accessible	An entry in the Ipv6 Access Control List table.
U32 fdryIpv6AclIndex	1.3.6.1.4.1.1991.1.2.16.1.1.1.1.1	Unsigned32	not-accessible	The access control list item number for an entry. This is a unique number that identifies different Access list entries. This one has to be unique even though the name is not unique for a give access list with same or different source address, prefix length, destination address and destination prefix length, protocol type, action (permit/deny) type and the operator (neq, eq, gt and , lt).
STR fdryIpv6AclName	1.3.6.1.4.1.1991.1.2.16.1.1.1.1.2	DisplayString	read-create	Access Control List name for an entry.
ACT fdryIpv6AclAction	1.3.6.1.4.1.1991.1.2.16.1.1.1.1.3	Action	read-create	Action to take if the ip packet matches with this access control list.
IPP fdryIpv6AclProtocol	1.3.6.1.4.1.1991.1.2.16.1.1.1.1.4	IpProtocol	read-create	Transport protocols. 0 means any protocol.
ADR fdryIpv6AclSourceIp	1.3.6.1.4.1.1991.1.2.16.1.1.1.1.5	Ipv6Address	read-create	Source Ipv6 address.
U32 fdryIpv6AclSourcePrefixLen	1.3.6.1.4.1.1991.1.2.16.1.1.1.1.6	Unsigned32	read-create	Source IPv6 address prefix length.
OPE fdryIpv6AclSourceOperator	1.3.6.1.4.1.1991.1.2.16.1.1.1.1.7	Operator	read-create	Type of comparison to perform. for now, this only applys to tcp or udp to compare the port number
U32 fdryIpv6AclSourceOperand1	1.3.6.1.4.1.1991.1.2.16.1.1.1.1.8	Unsigned32	read-create	For now this only refers to transport protocol port number.
U32 fdryIpv6AclSourceOperand2	1.3.6.1.4.1.1991.1.2.16.1.1.1.1.9	Unsigned32	read-create	For now this only refers to transport protocol port number.
ADR fdryIpv6AclDestinationIp	1.3.6.1.4.1.1991.1.2.16.1.1.1.1.10	Ipv6Address	read-create	Destination Ipv6 address.
U32 fdryIpv6AclDestinationPrefixLen	1.3.6.1.4.1.1991.1.2.16.1.1.1.1.11	Unsigned32	read-create	Destination IPv6 address prefix length.
OPE fdryIpv6AclDestinationOperator	1.3.6.1.4.1.1991.1.2.16.1.1.1.1.12	Operator	read-create	Type of comparison to perform. for now, this only applys to tcp or udp to compare the port number
U32 fdryIpv6AclDestinationOperand1	1.3.6.1.4.1.1991.1.2.16.1.1.1.1.13	Unsigned32	read-create	For now this only refers to transport protocol port number.
U32 fdryIpv6AclDestinationOperand2	1.3.6.1.4.1.1991.1.2.16.1.1.1.1.14	Unsigned32	read-create	For now this only refers to transport protocol port number.
RTR fdryIpv6AclEstablished	1.3.6.1.4.1.1991.1.2.16.1.1.1.1.15	RtrStatus	read-create	Enable/Disable the filtering of established TCP packets of which the ACK or RESET flag is on. This additional filter only applies to TCP transport protocol.
T/F fdryIpv6AclLogOption	1.3.6.1.4.1.1991.1.2.16.1.1.1.1.16	TruthValue	read-create	Log flag, should be set to one to enable logging
STR fdryIpv6AclComments	1.3.6.1.4.1.1991.1.2.16.1.1.1.1.17	DisplayString	read-create	Remark description of individual Access Control List entry.
ROW fdryIpv6AclRowStatus	1.3.6.1.4.1.1991.1.2.16.1.1.1.1.18	RowStatus	read-create	To create or delete a access list entry.

RFC description

Manages IPv6 Access Control Lists and filtering rules on Brocade network switches.

Start monitoring Brocade/Foundry FastIron switch/router (IPv6 ACL) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download FDRY-ACL-MIB

What Is FDRY-ACL-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description