FDRY-DAI-MIB

All MIBs › FDRY-DAI-MIB

Organization: Brocade Communications Systems, Inc.

Last Updated: 2010-07-26

Category: VPN and Security, Vendor: Foundry/Brocade

Description: Foundry/Brocade FastIron MIB for Dynamic ARP Inspection (DAI) configuration and trusted port settings for ARP security.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is FDRY-DAI-MIB?

FDRY-DAI-MIB is a Brocade (formerly Foundry Networks) proprietary MIB for FastIron switches implementing Dynamic ARP Inspection (DAI), a Layer 2 security feature that validates ARP packets against trusted IP-to-MAC bindings to prevent ARP spoofing. It exposes per-VLAN enablement of DAI, per-interface trust settings, and a table of inspected/validated ARP bindings. Its monitoring value is mostly configuration/software-security status: confirming which VLANs have DAI enabled, which interfaces are trusted, and what bindings are currently recognized, which helps an operator diagnose why legitimate ARP traffic is being dropped or why spoofed ARP wasn't caught. It is a switch security feature MIB that works alongside standard bridge/VLAN MIBs for the underlying interface and VLAN model. It is deployed on Brocade/Foundry FastIron switches in networks where ARP spoofing protection is required, such as campus access-layer deployments. Engineers can download the FDRY-DAI-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in FDRY-DAI-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Brocade/Foundry FastIron managed Ethernet switch

Monitoring Examples

An operator troubleshooting a host that suddenly lost connectivity would check fdryDaiVlanConfigTable for fdryDaiVlanDynArpInspEnable on the relevant fdryDaiVlanVLanId, then check fdryDaiIfConfigTable's fdryDaiIfTrustValue on the uplink interface to confirm it's marked trusted (untrusted uplinks would cause legitimate ARP replies to be dropped). fdryDaiArpInspectTable entries, keyed by fdryDaiArpInspectIpAddr and fdryDaiArpInspectMacAddr, show the currently validated bindings, and an unexpected fdryDaiArpInspectRowStatus or missing binding would explain a false-positive ARP inspection drop.

What Can Be Monitored

DAI enablement per VLAN
interface trust state
validated ARP IP-to-MAC bindings
ARP inspection row status

Imported Objects

From FOUNDRY-SN-AGENT-MIB

DisplayString

From FOUNDRY-SN-SWITCH-GROUP-MIB

snSwitch

MODULE-IDENTITY

From IF-MIB

ifIndex

OBJECT-TYPE

From Q-BRIDGE-MIB

VlanIndex

From SNMPv2-SMI

IpAddress
MODULE-IDENTITY
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

MacAddress
RowStatus
TEXTUAL-CONVENTION
TruthValue

OIDs

OID symbolic	OID numeric	Type	Access	Description
fdryDaiMIB	1.3.6.1.4.1.1991.1.1.3.35			Management Information for configuration of Dynamic ARP Inspection feature. Dynamic ARP Inspection is a security mechanism which validates all ARP packets in a subnet and discard those packets with invalid IP to MAC address bindings. Copyright 1996-2010 Brocade Communications Systems, Inc. All rights reserved. This Brocade Communications Systems SNMP Management Information Base Specification embodies Brocade Communications Systems' confidential and proprietary intellectual property. Brocade Communications Systems retains all title and ownership in the Specification, including any revisions. This Specification is supplied AS IS, and Brocade Communications Systems makes no warranty, either express or implied, as to the use, operation, condition, or performance of the specification, and any unintended consequence it may on the user environment.
fdryDaiVlan	1.3.6.1.4.1.1991.1.1.3.35.1
fdryDaiVlanConfigTable	1.3.6.1.4.1.1991.1.1.3.35.1.1		not-accessible	A table provides the mechanism to control Dynamic ARP Inspection per VLAN. When a VLAN is created in a device supporting this table, a corresponding entry of this table will be added.
fdryDaiVlanConfigEntry	1.3.6.1.4.1.1991.1.1.3.35.1.1.1		not-accessible	A row instance contains the configuration to enable or disable Dynamic ARP Inspection at the existing VLAN.
VLA fdryDaiVlanVLanId	1.3.6.1.4.1.1991.1.1.3.35.1.1.1.1	VlanIndex	not-accessible	This object indicates the VLAN number on which Dynamic ARP Inspection feature is configured.
T/F fdryDaiVlanDynArpInspEnable	1.3.6.1.4.1.1991.1.1.3.35.1.1.1.2	TruthValue	read-write	This object indicates whether Dynamic ARP Inspection is enabled in this VLAN. If this object is set to 'true', Dynamic ARP Inspection is enabled. If this object is set to 'false', Dynamic ARP Inspection is disabled.
fdryDaiInterface	1.3.6.1.4.1.1991.1.1.3.35.2
fdryDaiIfConfigTable	1.3.6.1.4.1.1991.1.1.3.35.2.1		not-accessible	A table provides the mechanism to configure the trust state for Dynamic ARP Inspection purpose at each physical interface.
fdryDaiIfConfigEntry	1.3.6.1.4.1.1991.1.1.3.35.2.1.1		not-accessible	A row instance contains the configuration to enable or disable trust state for Dynamic ARP Inspection at each physical interface capable of this feature.
T/F fdryDaiIfTrustValue	1.3.6.1.4.1.1991.1.1.3.35.2.1.1.1	TruthValue	read-write	This object indicates whether the interface is trusted for Dynamic ARP Inspection. If this object is set to 'true', the interface is trusted. ARP packets coming to this interface will be forwarded without checking. If this object is set to 'false', the interface is not trusted. ARP packets received on this interface will be subjected to ARP inspection.
fdryDaiArpInspect	1.3.6.1.4.1.1991.1.1.3.35.3
fdryDaiArpInspectTable	1.3.6.1.4.1.1991.1.1.3.35.3.1		not-accessible	A table provides the mechanism to control Dynamic ARP Inspection entries. When an IP-MAC mapping entry is created in a device supporting this table, a corresponding entry of this table will be added.
fdryDaiArpInspectEntry	1.3.6.1.4.1.1991.1.1.3.35.3.1.1		not-accessible	A row instance contains the configuration to map a device IP address with its MAC address.
IP fdryDaiArpInspectIpAddr	1.3.6.1.4.1.1991.1.1.3.35.3.1.1.1	IpAddress	not-accessible	The device IP address.
MAC fdryDaiArpInspectMacAddr	1.3.6.1.4.1.1991.1.1.3.35.3.1.1.2	MacAddress	read-create	The device MAC address.
ROW fdryDaiArpInspectRowStatus	1.3.6.1.4.1.1991.1.1.3.35.3.1.1.3	RowStatus	read-create	This variable is used to create, or delete a row in this table. When a row in this table is in active(1) state, no objects in that row can be modified except this object.
ARP fdryDaiArpInspectType	1.3.6.1.4.1.1991.1.1.3.35.3.1.1.4	ArpType	read-only	The type of the ARP entry
ARP fdryDaiArpInspectState	1.3.6.1.4.1.1991.1.1.3.35.3.1.1.5	ArpState	read-only	The state of the ARP entry
U32 fdryDaiArpInspectAge	1.3.6.1.4.1.1991.1.1.3.35.3.1.1.6	Unsigned32	read-only	The timer of the ARP entry
STR fdryDaiArpInspectPort	1.3.6.1.4.1.1991.1.1.3.35.3.1.1.7	DisplayString	read-only	The port of the ARP entry

RFC description

Brocade Dynamic ARP Inspection MIB for security validation of ARP packets and IP-to-MAC address bindings.

Start monitoring Brocade/Foundry FastIron switch (Dynamic ARP Inspection) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download FDRY-DAI-MIB

What Is FDRY-DAI-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description