FOUNDRY-IP-SOURCE-GUARD-MIB

All MIBs › FOUNDRY-IP-SOURCE-GUARD-MIB

Organization: Brocade Communications Systems, Inc.

Last Updated: 2010-07-26

Category: Domain: Security, Vendor: Foundry/Brocade

Description: Brocade Foundry IP source guard MIB providing per-port DHCP snooping binding and IP source validation configuration for FastIron switches.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is FOUNDRY-IP-SOURCE-GUARD-MIB?

FOUNDRY-IP-SOURCE-GUARD-MIB is a Brocade (formerly Foundry Networks) vendor-specific MIB providing configuration and monitoring for the IP Source Guard security feature on FastIron switches, which restricts IP traffic on untrusted ports to addresses validated against the DHCP snooping binding database or manually configured bindings. It exposes per-interface enable/disable configuration, per-port-VLAN enablement, and a binding table listing the validated IP-address/VLAN pairs currently permitted on each port. Its monitoring value is primarily security/configuration status rather than hardware fault detection: fdryIpSrcGuardIfEnable and fdryIpSrcGuardPortVlanEnable reveal which ports/VLANs have source-address filtering active, while fdryIpSrcGuardBindTable shows the live set of trusted IP-to-VLAN bindings, letting an operator confirm the feature's software state matches intended policy. It depends conceptually on the DHCP snooping binding database as its data source but does not appear to import another MIB module directly. It is deployed on Brocade/Foundry FastIron switches in access-layer network security deployments to prevent IP spoofing. Engineers can download the FOUNDRY-IP-SOURCE-GUARD-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in FOUNDRY-IP-SOURCE-GUARD-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Brocade (Foundry) FastIron switches

Monitoring Examples

Polling fdryIpSrcGuardIfConfigTable/fdryIpSrcGuardIfConfigEntry by interface confirms whether fdryIpSrcGuardIfEnable is active on a given port, while fdryIpSrcGuardPortVlanConfigTable (keyed by fdryIpSrcGuardPortVlanPortId and fdryIpSrcGuardPortVlanVlanId) shows per-VLAN enforcement status via fdryIpSrcGuardPortVlanEnable. The fdryIpSrcGuardBindTable/fdryIpSrcGuardBindEntry, listing fdryIpSrcGuardBindIpAddr against fdryIpSrcGuardBindVlanId, lets an operator verify that only expected DHCP-assigned addresses are currently permitted on a protected port. An unexpected absence of an expected binding in this table combined with dropped traffic would indicate a device failed IP Source Guard validation, likely due to a stale or missing DHCP snooping entry.

What Can Be Monitored

per-interface IP source guard enable state
per-port-VLAN enforcement status
validated IP-to-VLAN binding entries
DHCP snooping-derived source bindings

Imported Objects

From FOUNDRY-SN-SWITCH-GROUP-MIB

snSwitch

MODULE-IDENTITY

From IF-MIB

InterfaceIndex
ifIndex	OBJECT-TYPE

From Q-BRIDGE-MIB

VlanIndex

From SNMPv2-SMI

IpAddress
MODULE-IDENTITY
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

RowStatus
TEXTUAL-CONVENTION
TruthValue

OIDs

OID symbolic	OID numeric	Type	Access	Description
fdryIpSrcGuardMIB	1.3.6.1.4.1.1991.1.1.3.37			Management Information for configuration of IP Source Guard feature. IP Source Guard is a security feature that restricts IP traffic on untrusted ports by filtering traffic based on the DHCP snooping binding database or manually configured IP source bindings. Copyright 1996-2010 Brocade Communications Systems, Inc. All rights reserved. This Brocade Communications Systems SNMP Management Information Base Specification embodies Brocade Communications Systems' confidential and proprietary intellectual property. Brocade Communications Systems retains all title and ownership in the Specification, including any revisions. This Specification is supplied AS IS, and Brocade Communications Systems makes no warranty, either express or implied, as to the use, operation, condition, or performance of the specification, and any unintended consequence it may on the user environment.
fdryIpSrcGuardInterface	1.3.6.1.4.1.1991.1.1.3.37.1
fdryIpSrcGuardIfConfigTable	1.3.6.1.4.1.1991.1.1.3.37.1.1		not-accessible	A table provides the mechanism to configure enabling or disabling IP Source Guard purpose at each physical interface.
fdryIpSrcGuardIfConfigEntry	1.3.6.1.4.1.1991.1.1.3.37.1.1.1		not-accessible	A row instance contains the configuration to enable or disable IP Source Guard at each physical interface capable of this feature.
T/F fdryIpSrcGuardIfEnable	1.3.6.1.4.1.1991.1.1.3.37.1.1.1.1	TruthValue	read-write	This object indicates whether IP Source Guard is enabled at this interface. If this object is set to 'true', IP Source Guard is enabled. Traffic coming to this interface will be forwarded. If it is from the list of IP addresses obtained from DHCP snooping. Otherwise it is denied. If this object is set to 'false', IP Source Guard is disabled.
fdryIpSrcGuardPortVlan	1.3.6.1.4.1.1991.1.1.3.37.2
fdryIpSrcGuardPortVlanConfigTable	1.3.6.1.4.1.1991.1.1.3.37.2.1		not-accessible	A table provides the mechanism to configure enabling or disabling IP Source Guard purpose per port per VLAN.
fdryIpSrcGuardPortVlanConfigEntry	1.3.6.1.4.1.1991.1.1.3.37.2.1.1		not-accessible	A row instance contains the configuration to enable or disable IP Source Guard per port per VLAN of this feature.
NUM fdryIpSrcGuardPortVlanPortId	1.3.6.1.4.1.1991.1.1.3.37.2.1.1.1	InterfaceIndex	not-accessible	The ifIndex of the port for IP Source Guard purpose per port per VLAN.
VLA fdryIpSrcGuardPortVlanVlanId	1.3.6.1.4.1.1991.1.1.3.37.2.1.1.2	VlanIndex	not-accessible	The number of VLAN for IP Source Guard purpose per port per VLAN.
T/F fdryIpSrcGuardPortVlanEnable	1.3.6.1.4.1.1991.1.1.3.37.2.1.1.3	TruthValue	read-write	This object indicates whether IP Source Guard is enabled at this interface and this VLAN number. If this object is set to 'true', IP Source Guard per-port-per-VLAN is enabled. If this object is set to 'false', IP Source Guard per-port-per-VLAN is disabled.
fdryIpSrcGuardBind	1.3.6.1.4.1.1991.1.1.3.37.3
fdryIpSrcGuardBindTable	1.3.6.1.4.1.1991.1.1.3.37.3.1		not-accessible	A table provides the information of IP addresses used IP Source Guard purpose at each physical interface with or without specific VLAN memberships
fdryIpSrcGuardBindEntry	1.3.6.1.4.1.1991.1.1.3.37.3.1.1		not-accessible	A row instance contains IP address used for IP Source Guard purpose at each physical interface with or without specific VLAN memberships .
IP fdryIpSrcGuardBindIpAddr	1.3.6.1.4.1.1991.1.1.3.37.3.1.1.1	IpAddress	not-accessible	The device IP address.
U32 fdryIpSrcGuardBindVlanId	1.3.6.1.4.1.1991.1.1.3.37.3.1.1.2	Unsigned32	read-create	This object indicates the specific VLAN memberships on this interface. The VLAN number is optional. If you configure a VLAN number, the bindings applies to that VLAN only. If you do not configure a VLAN number, the static applies to all VLANs associated with the port. In this case, the VLAN number will be displayed as 0.
ROW fdryIpSrcGuardBindRowStatus	1.3.6.1.4.1.1991.1.1.3.37.3.1.1.3	RowStatus	read-create	This variable is used to create, or delete a row in this table. When a row in this table is in active(1) state, no objects in that row can be modified except this object.
BIN fdryIpSrcGuardBindMode	1.3.6.1.4.1.1991.1.1.3.37.3.1.1.4	BindMode	read-only	The mode of the IP Source Guard entry
BIN fdryIpSrcGuardBindType	1.3.6.1.4.1.1991.1.1.3.37.3.1.1.5	BindType	read-only	The type of the IP Source Guard entry

RFC description

Foundry Networks vendor-private MIB for IP source guard security features on switches.

Start monitoring Brocade/Foundry FastIron switch (IP Source Guard) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download FOUNDRY-IP-SOURCE-GUARD-MIB

What Is FOUNDRY-IP-SOURCE-GUARD-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description