HP-ICF-IPV6-RA-GUARD-MIB

All MIBs › HP-ICF-IPV6-RA-GUARD-MIB

Organization: Hewlett-Packard Company HP Networking

Last Updated: 2011-03-16

Category: Domain: Security, Technology: IPv6, Vendor: HP/HPE

Description: HP ICF SNMP MIB for IPv6 Router Advertisement Guard blocking unauthorized RA messages on HP ProCurve switch ports.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is HP-ICF-IPV6-RA-GUARD-MIB?

HP-ICF-IPV6-RA-GUARD-MIB is an HP proprietary MIB for IPv6 Router Advertisement (RA) Guard on HP ICF switches (ProCurve/Aruba), a security feature that blocks unauthorized or rogue IPv6 RA messages on untrusted switch ports. It exposes a per-port table recording whether RA Guard is currently blocking on that port and a cumulative count of blocked RA messages, plus a last-error-code object for diagnosing internal feature failures. This supports monitoring the software/security enforcement status of the switch - confirming RA Guard is actively blocking rogue advertisements on a given port and detecting any internal error in the feature. It implements protection related to IPv6 Neighbor Discovery/RA as covered by the relevant IETF IPv6 RFCs, layered on top of HP's port-based security framework. It is deployed on HP ProCurve/Aruba switches in IPv6-enabled networks where administrators need to prevent rogue router advertisements from disrupting client IPv6 configuration, making HP-ICF-IPV6-RA-GUARD-MIB SNMP monitoring a routine part of IPv6 security operations.

IPNetwork Monitor allows you to monitor SNMP objects defined in HP-ICF-IPV6-RA-GUARD-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

HP ProCurve switch
HP Aruba (ICF-based) switch

Monitoring Examples

hpicfRAGuardPortTable/Entry rows, keyed by port, expose hpicfRAGuardPortBlocked (whether the port is currently enforcing RA Guard) and hpicfRAGuardPortBlockedRAs, a running count of rogue RA messages dropped on that port. An administrator watching hpicfRAGuardPortBlockedRAs sees it climb after a rogue IPv6 router or misconfigured host is connected to a guarded port, confirming the guard is working; a non-zero hpicfRAGuardLastErrorCode would instead indicate the feature itself failed to apply correctly.

What Can Be Monitored

per-port RA Guard blocked state
blocked RA message count
RA Guard last error code

Imported Objects

From HP-ICF-OID

hpSwitch

OBJECT-IDENTITY

From IF-MIB

ifIndex

OBJECT-TYPE

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Counter64
MODULE-IDENTITY
OBJECT-TYPE

From SNMPv2-TC

TruthValue

How to Use in IPNetwork Monitor

Example using hpicfRAGuardPortBlockedRAs OID:

Select an HP ProCurve/Aruba switch (IPv6 Router Advertisement Guard) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type hpicfRAGuardPortBlockedRAs into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. This number of Router Advertisements blocked for the port. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter64-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
hpicfIpv6RAGuard	1.3.6.1.4.1.11.2.14.11.5.1.87			This MIB module contains HP proprietary objects for managing RA Guard.
hpicfIpv6RAGuardObjects	1.3.6.1.4.1.11.2.14.11.5.1.87.1
hpicfIpv6RAGuardConfig	1.3.6.1.4.1.11.2.14.11.5.1.87.1.1
hpicfRAGuardPortTable	1.3.6.1.4.1.11.2.14.11.5.1.87.1.1.1		not-accessible	Per-interface configuration for RA Guard. Ra Guard is used to block IPv6 router advertisements and ICMPv6 router redirects. The log option is to enable debug logging for troubleshooting. It uses a lot of CPU and should be used only for short periods of time. To display debug logging, use debug security ra-guard command.
hpicfRAGuardPortEntry	1.3.6.1.4.1.11.2.14.11.5.1.87.1.1.1.1		not-accessible	RA Guard configuration information for a single port.
T/F hpicfRAGuardPortBlocked	1.3.6.1.4.1.11.2.14.11.5.1.87.1.1.1.1.1	TruthValue	read-write	This object indicates whether this port is blocked for Router Advertisements and Redirects.
C64 hpicfRAGuardPortBlockedRAsEx	1.3.6.1.4.1.11.2.14.11.5.1.87.1.1.1.1.2	Counter64	read-only	This number of Router Advertisements blocked for the port.
C64 hpicfRAGuardPortBlockedRedirs	1.3.6.1.4.1.11.2.14.11.5.1.87.1.1.1.1.3	Counter64	read-only	This number of Router Redirects blocked for the port.
T/F hpicfRAGuardPortLog	1.3.6.1.4.1.11.2.14.11.5.1.87.1.1.1.1.4	TruthValue	read-write	Whether to log RAs and Redirects for the port. The log option is to enable debug logging for troubleshooting. It uses a lot of CPU and should be used only for short periods of time.
INT hpicfRAGuardLastErrorCode	1.3.6.1.4.1.11.2.14.11.5.1.87.1.1.1.1.5	INTEGER	read-only	Error code of the last error that occurred. A non-zero value indicates that the last operation performed by this instance did not succeed.
hpicfIpv6RAGuardConformance	1.3.6.1.4.1.11.2.14.11.5.1.87.2
hpicfIpv6RAGuardCompliances	1.3.6.1.4.1.11.2.14.11.5.1.87.2.1
hpicfIpv6RAGuardCompliance	1.3.6.1.4.1.11.2.14.11.5.1.87.2.1.1			The compliance statement for devices support of HP-ICF-IPV6-RA-GUARD-MIB.
hpicfIpv6RAGuardGroups	1.3.6.1.4.1.11.2.14.11.5.1.87.2.2
hpicfIpv6RAGuardGroup	1.3.6.1.4.1.11.2.14.11.5.1.87.2.2.1			A collection of objects providing configuration for Ipv6 RA Guard.

RFC description

HP IPv6 RA Guard security feature for blocking unauthorized router advertisements.

Start monitoring HP ProCurve/Aruba switch (IPv6 Router Advertisement Guard) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download HP-ICF-IPV6-RA-GUARD-MIB