FDRY-IP-SOURCE-GUARD-MIB

All MIBs › FDRY-IP-SOURCE-GUARD-MIB

Organization: Brocade Communications Systems, Inc.

Last Updated: 2010-07-26

Category: VPN and Security, Vendor: Foundry/Brocade

Description: Foundry/Brocade FastIron MIB for IP Source Guard configuration, filtering unauthorized IP traffic based on DHCP snooping bindings.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is FDRY-IP-SOURCE-GUARD-MIB?

FDRY-IP-SOURCE-GUARD-MIB is a Brocade/Foundry proprietary MIB for the FastIron switch family covering the IP Source Guard security feature, which restricts IP traffic on untrusted ports by validating it against the DHCP snooping binding database or manually configured IP source bindings. It exposes configuration data: per-interface enable state, per-port-VLAN enable state, and a binding table of learned or static IP-to-VLAN source bindings. This is primarily a security/configuration-status MIB rather than hardware health monitoring, letting an admin confirm which switch ports have source guard enabled and inspect the active enforcement bindings as a software feature/policy status check. It explicitly depends on the DHCP snooping feature and binding database (a related FastIron capability) as its source of trusted IP-MAC-VLAN bindings. It is deployed on Brocade/Foundry FastIron enterprise Ethernet switches in environments requiring protection against IP address spoofing on access ports. Network engineers evaluating or troubleshooting this functionality can download the FDRY-IP-SOURCE-GUARD-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in FDRY-IP-SOURCE-GUARD-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Brocade/Foundry FastIron Ethernet switch

Monitoring Examples

An admin would poll fdryIpSrcGuardIfConfigTable/Entry (fdryIpSrcGuardIfEnable) to confirm IP Source Guard is enabled on a given interface, then check fdryIpSrcGuardBindTable/Entry for the fdryIpSrcGuardBindIpAddr and fdryIpSrcGuardBindVlanId entries actually being enforced. Comparing fdryIpSrcGuardPortVlanConfigTable (fdryIpSrcGuardPortVlanPortId/VlanId/Enable) against expected VLANs reveals whether a specific port-VLAN combination is unexpectedly left unprotected. If a client's IP address does not appear in fdryIpSrcGuardBindTable despite the interface showing enabled, that indicates the DHCP snooping binding was never learned and legitimate traffic from that host may be dropped.

What Can Be Monitored

IP Source Guard enable state per interface
per-port-VLAN enable state
active IP-to-VLAN source bindings
bound IP address/VLAN pairs

Imported Objects

From FOUNDRY-SN-SWITCH-GROUP-MIB

snSwitch

MODULE-IDENTITY

From IF-MIB

InterfaceIndex
ifIndex	OBJECT-TYPE

From Q-BRIDGE-MIB

VlanIndex

From SNMPv2-SMI

IpAddress
MODULE-IDENTITY
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

RowStatus
TEXTUAL-CONVENTION
TruthValue

OIDs

OID symbolic	OID numeric	Type	Access	Description
fdryIpSrcGuardMIB	1.3.6.1.4.1.1991.1.1.3.37			Management Information for configuration of IP Source Guard feature. IP Source Guard is a security feature that restricts IP traffic on untrusted ports by filtering traffic based on the DHCP snooping binding database or manually configured IP source bindings. Copyright 1996-2010 Brocade Communications Systems, Inc. All rights reserved. This Brocade Communications Systems SNMP Management Information Base Specification embodies Brocade Communications Systems' confidential and proprietary intellectual property. Brocade Communications Systems retains all title and ownership in the Specification, including any revisions. This Specification is supplied AS IS, and Brocade Communications Systems makes no warranty, either express or implied, as to the use, operation, condition, or performance of the specification, and any unintended consequence it may on the user environment.
fdryIpSrcGuardInterface	1.3.6.1.4.1.1991.1.1.3.37.1
fdryIpSrcGuardIfConfigTable	1.3.6.1.4.1.1991.1.1.3.37.1.1		not-accessible	A table provides the mechanism to configure enabling or disabling IP Source Guard purpose at each physical interface.
fdryIpSrcGuardIfConfigEntry	1.3.6.1.4.1.1991.1.1.3.37.1.1.1		not-accessible	A row instance contains the configuration to enable or disable IP Source Guard at each physical interface capable of this feature.
T/F fdryIpSrcGuardIfEnable	1.3.6.1.4.1.1991.1.1.3.37.1.1.1.1	TruthValue	read-write	This object indicates whether IP Source Guard is enabled at this interface. If this object is set to 'true', IP Source Guard is enabled. Traffic coming to this interface will be forwarded. If it is from the list of IP addresses obtained from DHCP snooping. Otherwise it is denied. If this object is set to 'false', IP Source Guard is disabled.
fdryIpSrcGuardPortVlan	1.3.6.1.4.1.1991.1.1.3.37.2
fdryIpSrcGuardPortVlanConfigTable	1.3.6.1.4.1.1991.1.1.3.37.2.1		not-accessible	A table provides the mechanism to configure enabling or disabling IP Source Guard purpose per port per VLAN.
fdryIpSrcGuardPortVlanConfigEntry	1.3.6.1.4.1.1991.1.1.3.37.2.1.1		not-accessible	A row instance contains the configuration to enable or disable IP Source Guard per port per VLAN of this feature.
NUM fdryIpSrcGuardPortVlanPortId	1.3.6.1.4.1.1991.1.1.3.37.2.1.1.1	InterfaceIndex	not-accessible	The ifIndex of the port for IP Source Guard purpose per port per VLAN.
VLA fdryIpSrcGuardPortVlanVlanId	1.3.6.1.4.1.1991.1.1.3.37.2.1.1.2	VlanIndex	not-accessible	The number of VLAN for IP Source Guard purpose per port per VLAN.
T/F fdryIpSrcGuardPortVlanEnable	1.3.6.1.4.1.1991.1.1.3.37.2.1.1.3	TruthValue	read-write	This object indicates whether IP Source Guard is enabled at this interface and this VLAN number. If this object is set to 'true', IP Source Guard per-port-per-VLAN is enabled. If this object is set to 'false', IP Source Guard per-port-per-VLAN is disabled.
fdryIpSrcGuardBind	1.3.6.1.4.1.1991.1.1.3.37.3
fdryIpSrcGuardBindTable	1.3.6.1.4.1.1991.1.1.3.37.3.1		not-accessible	A table provides the information of IP addresses used IP Source Guard purpose at each physical interface with or without specific VLAN memberships
fdryIpSrcGuardBindEntry	1.3.6.1.4.1.1991.1.1.3.37.3.1.1		not-accessible	A row instance contains IP address used for IP Source Guard purpose at each physical interface with or without specific VLAN memberships .
IP fdryIpSrcGuardBindIpAddr	1.3.6.1.4.1.1991.1.1.3.37.3.1.1.1	IpAddress	not-accessible	The device IP address.
U32 fdryIpSrcGuardBindVlanId	1.3.6.1.4.1.1991.1.1.3.37.3.1.1.2	Unsigned32	read-create	This object indicates the specific VLAN memberships on this interface. The VLAN number is optional. If you configure a VLAN number, the bindings applies to that VLAN only. If you do not configure a VLAN number, the static applies to all VLANs associated with the port. In this case, the VLAN number will be displayed as 0.
ROW fdryIpSrcGuardBindRowStatus	1.3.6.1.4.1.1991.1.1.3.37.3.1.1.3	RowStatus	read-create	This variable is used to create, or delete a row in this table. When a row in this table is in active(1) state, no objects in that row can be modified except this object.
BIN fdryIpSrcGuardBindMode	1.3.6.1.4.1.1991.1.1.3.37.3.1.1.4	BindMode	read-only	The mode of the IP Source Guard entry
BIN fdryIpSrcGuardBindType	1.3.6.1.4.1.1991.1.1.3.37.3.1.1.5	BindType	read-only	The type of the IP Source Guard entry

RFC description

IP Source Guard security feature management for Brocade switches, filtering traffic by DHCP or manual bindings.

Start monitoring Brocade/Foundry FastIron switch (IP Source Guard) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download FDRY-IP-SOURCE-GUARD-MIB

What Is FDRY-IP-SOURCE-GUARD-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description