HP-ICF-IP-LOCKDOWN-MIB

All MIBs › HP-ICF-IP-LOCKDOWN-MIB

Organization: HP Networking

Last Updated: 2008-03-16

Category: Domain: Security, VPN and Security, Vendor: HP/HPE

Description: HP ICF SNMP MIB for IP source lockdown binding IP addresses to switch ports to prevent IP spoofing on HP ProCurve switches.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is HP-ICF-IP-LOCKDOWN-MIB?

HP-ICF-IP-LOCKDOWN-MIB is an HP proprietary MIB managing Dynamic IP Lockdown, a security feature that binds specific IP addresses to switch ports (often in conjunction with DHCP snooping) to prevent IP address spoofing on HP ProCurve switches. It would expose configuration objects for enabling IP lockdown per port and a binding table mapping learned or statically-configured IP-to-MAC-to-port associations. Its monitoring value is security-status verification: administrators check which IP/MAC/port bindings are active to confirm the lockdown feature is correctly restricting traffic and to investigate denied traffic when a device's IP doesn't match its expected binding. It works in conjunction with DHCP snooping and source-MAC-lockdown mechanisms, though no direct IETF standard is referenced. It is deployed on HP ProCurve switches at network access-layer edges where IP spoofing prevention is a security requirement, and administrators typically reference the HP-ICF-IP-LOCKDOWN-MIB MIB when configuring or auditing these bindings.

IPNetwork Monitor allows you to monitor SNMP objects defined in HP-ICF-IP-LOCKDOWN-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

HP ProCurve network switch

Monitoring Examples

No concrete object or table names were present in the provided sample for this MIB, so a specific monitoring scenario cannot be honestly built from real identifiers. Conceptually, based on its stated purpose, an admin would expect to review a binding table associating each port with authorized IP/MAC pairs, and would investigate a port showing repeated binding-violation events as a potential spoofing attempt. Without sample objects, no invented names are used here.

Imported Objects

From HP-ICF-OID

hpSwitch

OBJECT-IDENTITY

From IF-MIB

InterfaceIndex
ifIndex	OBJECT-TYPE

From INET-ADDRESS-MIB

InetAddress
InetAddressType

From Q-BRIDGE-MIB

VlanIndex

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Counter32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE

From SNMPv2-TC

MacAddress
TruthValue

OIDs

OID symbolic	OID numeric	Type	Access	Description
hpicfIpLockdown	1.3.6.1.4.1.11.2.14.11.5.1.39			This MIB module contains HP proprietary objects for managing Dynamic IP Lockdown.
hpicfIpLockTraps	1.3.6.1.4.1.11.2.14.11.5.1.39.0
hpicfIpLockTrapsObjects	1.3.6.1.4.1.11.2.14.11.5.1.39.0.1
INT hpicfIpLockOutOfResourceSource	1.3.6.1.4.1.11.2.14.11.5.1.39.0.1.1	INTEGER	accessible-for-notify	The identifier of the reason for out of hardware resource condition
NTF hpicfIpLockOutOfResources	1.3.6.1.4.1.11.2.14.11.5.1.39.0.1.2			This trap indicates that unexpected running out of hardware resources to program a Dynamic IP Lockdown rule. This notification trap is controlled by the state of 'hpicfIpLockTrapCtrl' object. Implementation of this trap is optional.
NTF hpicfIpLockErrantNotify	1.3.6.1.4.1.11.2.14.11.5.1.39.0.1.3			This notification indicates a host was denied access to the switch based on Dynamic Lockdown Protection rules. This notification trap is controlled by the state of the 'hpicfIpLockTrapCtrl' object. Implementation of this trap is optional.
hpicfIpLockErrantNotifyObjects	1.3.6.1.4.1.11.2.14.11.5.1.39.0.1.4
C32 hpicfIpLockNotifyCount	1.3.6.1.4.1.11.2.14.11.5.1.39.0.1.4.1	Counter32	accessible-for-notify	A count of 'hpicfIpLockErrantNotify' sent from the Dynamic Ip Lockdown Protection entity to the SNMP entity since boot.
NUM hpicfIpLockNotifyPort	1.3.6.1.4.1.11.2.14.11.5.1.39.0.1.4.2	InterfaceIndex	accessible-for-notify	The port for which this 'hpicfIpLockErrantNotify' applies.
IPt hpicfIpLockNotifySrcIpType	1.3.6.1.4.1.11.2.14.11.5.1.39.0.1.4.3	InetAddressType	accessible-for-notify	The type of IP address contained in 'hpicfIpLockNotifySrcIpAddress'. The only values expected are ipv4 or ipv6.
IP hpicfIpLockNotifySrcIpAddress	1.3.6.1.4.1.11.2.14.11.5.1.39.0.1.4.4	InetAddress	accessible-for-notify	The source IP address for which this 'hpicfIpLockErrantNotify' applies.
IPt hpicfIpLockNotifyDstIpType	1.3.6.1.4.1.11.2.14.11.5.1.39.0.1.4.5	InetAddressType	accessible-for-notify	The type of IP address contained in 'hpicfIpLockNotifyDstIpAddress'. The only values expected are ipv4 or ipv6.
IP hpicfIpLockNotifyDstIpAddress	1.3.6.1.4.1.11.2.14.11.5.1.39.0.1.4.6	InetAddress	accessible-for-notify	The destination IP address for which this 'hpicfIpLockErrantNotify' applies.
MAC hpicfIpLockNotifyMacAddress	1.3.6.1.4.1.11.2.14.11.5.1.39.0.1.4.7	MacAddress	accessible-for-notify	The source MAC address for which this 'hpicfIpLockErrantNotify' applies.
C32 hpicfIpLockNotifyPktCount	1.3.6.1.4.1.11.2.14.11.5.1.39.0.1.4.8	Counter32	accessible-for-notify	This object indicates the number of packets received from this host which were dropped.
hpicfIpLockObjects	1.3.6.1.4.1.11.2.14.11.5.1.39.1
hpicfIpLockConfig	1.3.6.1.4.1.11.2.14.11.5.1.39.1.1
T/F hpicfIpLockEnable	1.3.6.1.4.1.11.2.14.11.5.1.39.1.1.1	TruthValue	read-write	The administrative status of the Dynamic IP Lockdown feature.
hpicfIpLockPortTable	1.3.6.1.4.1.11.2.14.11.5.1.39.1.1.2		not-accessible	Per-interface configuration for Dynamic IP Lockdown.
hpicfIpLockPortEntry	1.3.6.1.4.1.11.2.14.11.5.1.39.1.1.2.1		not-accessible	Dynamic IP Lockdown configuration information for a single port.
T/F hpicfIpLockPortEnable	1.3.6.1.4.1.11.2.14.11.5.1.39.1.1.2.1.1	TruthValue	read-write	This object indicates whether this port is enabled for Dynamic IP Lockdown.
BIT hpicfIpLockTrapCntl	1.3.6.1.4.1.11.2.14.11.5.1.39.1.1.3	Bits	read-write	******* THIS OBJECT IS OBSOLETED ******** This object has been obsoleted in favor of 'hpicfIpLockTrapCtrl'. Controls generation of SNMP traps for events defined in this MIB. The set bit means 'enabled'. - OutOfResource(0) The state of this bit specifies whether the notification trap is allowed to be send when one runs out of resources programming a dynamic IP Lockdown rule..
T/F hpicfIpLockTrapCtrl	1.3.6.1.4.1.11.2.14.11.5.1.39.1.1.4	TruthValue	read-write	Controls generation of SNMP notifications for traps defined in this MIB.
hpicfIpLockStatus	1.3.6.1.4.1.11.2.14.11.5.1.39.1.2
hpicfIpLockPortStatusTable	1.3.6.1.4.1.11.2.14.11.5.1.39.1.2.1		not-accessible	Per-interface status for Dynamic IP Lockdown.
hpicfIpLockPortStatusEntry	1.3.6.1.4.1.11.2.14.11.5.1.39.1.2.1.1		not-accessible	Dynamic IP Lockdown status information for a single port.
BIT hpicfIpLockPortOperStatus	1.3.6.1.4.1.11.2.14.11.5.1.39.1.2.1.1.1	Bits	read-only	This object indicates the various states of the current operating mode of Dynamic IP Lockdown on this port. When no bits are set, the status of this feature shall be 'disabled'. Each status is described below: active - Dynamic IP Lockdown is active on this port. noDsnoop - Dynamic IP Lockdown is enabled on this port, but DHCP Snooping is not globally enabled. trustedPort - Dynamic IP Lockdown is enabled on this port, but is not active because the port is a DHCP Snooping trusted port. noSnoopingVlan - Dynamic IP Lockdown is enabled on this port, but is not active because the port is not a member of any VLAN with DHCP Snooping enabled.
hpicfIpLockAddrTable	1.3.6.1.4.1.11.2.14.11.5.1.39.1.2.2		not-accessible	Table of source address bindings on ports where Dynamic IP Lockdown is active that are currently permitted.
hpicfIpLockAddrEntry	1.3.6.1.4.1.11.2.14.11.5.1.39.1.2.2.1		not-accessible	An entry in the table containing a single permitted source address binding.
NUM hpicfIpLockAddrPort	1.3.6.1.4.1.11.2.14.11.5.1.39.1.2.2.1.1	InterfaceIndex	read-only	The port that this address binding is permitted on.
IPt hpicfIpLockAddrType	1.3.6.1.4.1.11.2.14.11.5.1.39.1.2.2.1.2	InetAddressType	read-only	The type of IP address contained in hpicfIpLockAddrIpAddress. The only values expected are ipv4 or ipv6.
IP hpicfIpLockAddrIpAddress	1.3.6.1.4.1.11.2.14.11.5.1.39.1.2.2.1.3	InetAddress	read-only	A source IP address permitted on this port. The type of address contained in this object is indicated by hpicfIpLockAddrType.
VLA hpicfIpLockAddrVlan	1.3.6.1.4.1.11.2.14.11.5.1.39.1.2.2.1.4	VlanIndex	read-only	The VLAN ID on which this source address is permitted on this port.
MAC hpicfIpLockAddrMacAddress	1.3.6.1.4.1.11.2.14.11.5.1.39.1.2.2.1.5	MacAddress	read-only	The source MAC address that is permitted for this source IP address on this port.
T/F hpicfIpLockResourceAvailable	1.3.6.1.4.1.11.2.14.11.5.1.39.1.2.2.1.6	TruthValue	read-only	TRUE indicates that resources were available to add binding. FALSE indicates that resources were not available
hpicfIpLockConformance	1.3.6.1.4.1.11.2.14.11.5.1.39.2
hpicfIpLockGroups	1.3.6.1.4.1.11.2.14.11.5.1.39.2.1
hpicfIpLockBaseGroup	1.3.6.1.4.1.11.2.14.11.5.1.39.2.1.1			A collection of objects for configuring and monitoring the base Dynamic IP Lockdown functionality.
hpicfIpLockTrapsGroup	1.3.6.1.4.1.11.2.14.11.5.1.39.2.1.2			A collection of trap objects for Dynamic IP Lockdown.
hpicfIpLockTrapObjectsGroup	1.3.6.1.4.1.11.2.14.11.5.1.39.2.1.3			A collection of objects for receiving notification information in regards to the Dynamic IP Lockdown functionality.
hpicfIpLockObsoleteGroup	1.3.6.1.4.1.11.2.14.11.5.1.39.2.1.4			These objects are obsolete and are no longer used.
hpicfIpLockCompliances	1.3.6.1.4.1.11.2.14.11.5.1.39.2.2
hpicfIpLockCompliance	1.3.6.1.4.1.11.2.14.11.5.1.39.2.2.1			The compliance statement for HP switches that support Dynamic IP Lockdown.
hpicfIpLockTrapCompliance	1.3.6.1.4.1.11.2.14.11.5.1.39.2.2.2			The compliance statement for HP switches that support Dynamic IP Lockdown Notify group .

RFC description

HP ProCurve dynamic IP lockdown for switch ports, preventing unauthorized IP-to-MAC bindings.

Start monitoring HP ProCurve switch (Dynamic IP Lockdown, anti-spoofing) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download HP-ICF-IP-LOCKDOWN-MIB

What Is HP-ICF-IP-LOCKDOWN-MIB?

Supported Devices

Monitoring Examples

This MIB depends on

Related MIBs

RFC description