HP-ICF-IPv6-DYNAMIC-LOCKDOWN-MIB

All MIBs › HP-ICF-IPv6-DYNAMIC-LOCKDOWN-MIB

Organization: HP Networking

Last Updated: 2017-11-08

Category: Domain: Security, Technology: IPv6, Vendor: HP/HPE

Description: HP ICF SNMP MIB for IPv6 dynamic lockdown binding IPv6 addresses to ports to prevent IPv6 address spoofing on HP ProCurve switches.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is HP-ICF-IPv6-DYNAMIC-LOCKDOWN-MIB?

HP-ICF-IPv6-DYNAMIC-LOCKDOWN-MIB is an HP proprietary SNMP module for HP ProCurve/Aruba switches, part of HP's Integrated Communication Facility (ICF) family of security-oriented MIBs. It exposes configuration data for DHCPv6 snooping and dynamic IPv6 lockdown, a feature that binds learned IPv6 addresses to specific switch ports to prevent address spoofing. Rather than hardware health telemetry, this MIB is primarily a security-configuration and policy-state module, letting an administrator confirm which ports have lockdown bindings active and whether the feature is enabled, which is itself a form of software/feature status monitoring. It builds on and complements the standard DHCPv6-Snooping concepts and is used alongside other HP ICF Layer 2 security MIBs. It is typically deployed in enterprise LAN environments where IPv6 is in use and administrators need to guard access-layer switch ports against address spoofing attacks. Engineers can download the HP-ICF-IPv6-DYNAMIC-LOCKDOWN-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in HP-ICF-IPv6-DYNAMIC-LOCKDOWN-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

HP ProCurve switch
HP/Aruba networking switch

Monitoring Examples

Because the retrieved module has no discrete sample objects listed, exact table names cannot be confirmed from source, but by ICF naming convention the module would expose a per-port or per-binding table (something like hpicfIpv6LockdownBindingTable) recording the learned IPv6 address, VLAN, and port for each snooped binding. An administrator would poll this table to verify that a given port's bindings match expected host addresses, and an unexpected or missing binding would indicate either a misconfigured client or a potential spoofing attempt. This MIB is a configuration/security-state module rather than a performance-counter module.

What Can Be Monitored

IPv6 dynamic lockdown enable state
per-port lockdown bindings
DHCPv6 snooping status
bound IPv6 addresses per port

Imported Objects

From HP-ICF-OID

hpSwitch

OBJECT-IDENTITY

From HPICF-SAVI-MIB

hpicfSaviObjectsFilteringEntry

OBJECT-TYPE

From IF-MIB

InterfaceIndex
ifIndex	OBJECT-TYPE

From INET-ADDRESS-MIB

InetAddress
InetAddressType

From Q-BRIDGE-MIB

VlanIndex

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Counter32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE

From SNMPv2-TC

MacAddress
TruthValue

OIDs

OID symbolic	OID numeric	Type	Access	Description
hpicfIpv6Lockdown	1.3.6.1.4.1.11.2.14.11.5.1.103			This MIB module contains HP proprietary objects for managing DHCPV6 Snooping.
hpicfDIPLDv6SourceBindingNotifications	1.3.6.1.4.1.11.2.14.11.5.1.103.0
NTF hpicfDIPDv6SourceBindingOutOfResources	1.3.6.1.4.1.11.2.14.11.5.1.103.0.1			This trap is sent when hardware runs out of resource to program Dynamic IPv6 Lockdown rule. It is controlled by the state of hpicfcfDIPLDv6SourceBindingOutOfResourcesTrapCtrl object.Implementation of this trap is optional.
hpicfDIPLDv6SourceBindingOutOfResourcesObjects	1.3.6.1.4.1.11.2.14.11.5.1.103.0.2
NUM hpicfDIPLDv6SourceBindingAddrPort	1.3.6.1.4.1.11.2.14.11.5.1.103.0.2.1	InterfaceIndex	accessible-for-notify	The Interface Index of the port for which Dynamic IPv6 Lockdown rule cannot be programmed into hardware.
MAC hpicfDIPLDv6SourceBindingAddrMacAddress	1.3.6.1.4.1.11.2.14.11.5.1.103.0.2.2	MacAddress	accessible-for-notify	The source MAC address for which Dynamic IPv6 Lockdown rule cannot be programmed into hardware.
IPt hpicfDIPLDv6SourceBindingAddrIpAddressType	1.3.6.1.4.1.11.2.14.11.5.1.103.0.2.3	InetAddressType	accessible-for-notify	The Type of the IP Address of the source for which Dynamic IPv6 lockdown rule cannot be programmed into the hardware.
IP hpicfDIPLDv6SourceBindingAddrIpAddress	1.3.6.1.4.1.11.2.14.11.5.1.103.0.2.4	InetAddress	accessible-for-notify	A source IP address for which Dynamic IPv6 Lockdown rule cannot be programmed into hardware.
VLA hpicfDIPLDv6SourceBindingAddrVlan	1.3.6.1.4.1.11.2.14.11.5.1.103.0.2.5	VlanIndex	read-only	The VLAN for which Dynamic IPv6 Lockdown rule cannot be programmed into hardware.
NTF hpicfDIPLDv6SourceBindingVoilations	1.3.6.1.4.1.11.2.14.11.5.1.103.0.3			This notification indicates a host was denied access to the switch based on Dynamic IPv6 lockdown protection rules. This trap is controlled by the state of the 'hpicfDIPLDv6SourceBindingViolationsTrapCtrl' object. Implementation of this trap is optional.
hpicfDIPLDv6SourceBindingVoilationsObjects	1.3.6.1.4.1.11.2.14.11.5.1.103.0.4
C32 hpicfDIPLDv6SourceBindingVoilationsCount	1.3.6.1.4.1.11.2.14.11.5.1.103.0.4.1	Counter32	accessible-for-notify	The number of DIPLDv6 violations sent from a DIPLDv6 entity to the SNMP entity.
NUM hpicfDIPLDv6SourceBindingVoilationsPort	1.3.6.1.4.1.11.2.14.11.5.1.103.0.4.2	InterfaceIndex	accessible-for-notify	The Interface Index of the port for which this 'hpicfDIPLDv6SourceBindingVoilations' applies.
IPt hpicfDIPLDv6SourceBindingVoilationsSrcIpType	1.3.6.1.4.1.11.2.14.11.5.1.103.0.4.3	InetAddressType	accessible-for-notify	The type of IP address contained in 'hpicfDIPLDv6SourceBindingVoilationsSrcIpAddress'. The only values expected are ipv6 or ipv6z.
IP hpicfDIPLDv6SourceBindingVoilationsSrcIpAddress	1.3.6.1.4.1.11.2.14.11.5.1.103.0.4.4	InetAddress	accessible-for-notify	The source IP address for which this 'hpicfDIPLDv6SourceBindingVoilations' applies.
IPt hpicfDIPLDv6SourceBindingVoilationsDstIpType	1.3.6.1.4.1.11.2.14.11.5.1.103.0.4.5	InetAddressType	accessible-for-notify	The type of IP address contained in 'hpicfIpLockSourceBindingVoilationsDstIpAddress'. The only values expected are ipv6 or ipv6z.
IP hpicfDIPLDv6SourceBindingVoilationsDstIpAddress	1.3.6.1.4.1.11.2.14.11.5.1.103.0.4.6	InetAddress	accessible-for-notify	The destination IP address for which this 'hpicfDIPLDv6SourceBindingVoilations' applies.
MAC hpicfDIPLDv6SourceBindingVoilationsMacAddress	1.3.6.1.4.1.11.2.14.11.5.1.103.0.4.7	MacAddress	accessible-for-notify	The source MAC address for which this 'hpicfDIPLDv6SourceBindingVoilations' applies.
C32 hpicfDIPLDv6SourceBindingVoilationsPktCount	1.3.6.1.4.1.11.2.14.11.5.1.103.0.4.8	Counter32	accessible-for-notify	This object indicates the number of packets received from this host which were dropped.
hpicfDIPLDv6Objects	1.3.6.1.4.1.11.2.14.11.5.1.103.1
hpicfDIPLDv6Config	1.3.6.1.4.1.11.2.14.11.5.1.103.1.1
T/F hpicfDIPLDv6LockEnable	1.3.6.1.4.1.11.2.14.11.5.1.103.1.1.1	TruthValue	read-write	The administrative status of the Dynamic IPv6 Lockdown feature.
hpicfDIPLDv6PortTable	1.3.6.1.4.1.11.2.14.11.5.1.103.1.1.2		not-accessible	Per-interface configuration for Dynamic IPv6 Lockdown.
hpicfDIPLDv6PortEntry	1.3.6.1.4.1.11.2.14.11.5.1.103.1.1.2.1		not-accessible	Dynamic IPv6 Lockdown configuration information for a single port.
T/F hpicfDIPLDv6PortEnable	1.3.6.1.4.1.11.2.14.11.5.1.103.1.1.2.1.1	TruthValue	read-write	This object indicates whether this port is enabled for Dynamic IPv6 Lockdown.
BIT hpicfDIPLDv6PortOperStatus	1.3.6.1.4.1.11.2.14.11.5.1.103.1.1.2.1.2	Bits	read-only	This object indicates the various states of the current operating mode of Dynamic IPv6 Lockdown on this port. The states are: active - Dynamic IPv6 Lockdown is active on this port. noDsnoop - Dynamic IPv6 Lockdown is enabled on this port, but DHCPv6 Snooping is not globally enabled. trustedPort - Dynamic IPv6 Lockdown is enabled on this port, but is not active because the port is a DHCPv6 Snooping trusted port. noSnoopingVlan - Dynamic IPv6 Lockdown is enabled on this port, but is not active because the port is not a member of any VLAN with DHCPv6 Snooping enabled.
T/F hpicfDIPLDv6SourceBindingOutOfResourcesTrapCtrl	1.3.6.1.4.1.11.2.14.11.5.1.103.1.1.3	TruthValue	read-write	Controls generation of SNMP notifications for traps defined in this MIB.
T/F hpicfDIPLDv6SourceBindingViolationsTrapCtrl	1.3.6.1.4.1.11.2.14.11.5.1.103.1.1.4	TruthValue	read-write	Controls generation of SNMP notifications for traps defined in this MIB.
hpicfDIPLDv6Status	1.3.6.1.4.1.11.2.14.11.5.1.103.1.2
hpicfDIPLDv6AddrTable	1.3.6.1.4.1.11.2.14.11.5.1.103.1.2.1		not-accessible	Table of source address bindings on ports where Dynamic IPv6 Lockdown is active that are currently permitted.
hpicfDIPLDv6AddrEntry	1.3.6.1.4.1.11.2.14.11.5.1.103.1.2.1.1		not-accessible	Extension to the hpicfSAVI filtering table.
VLA hpicfDIPLDv6AddrVlan	1.3.6.1.4.1.11.2.14.11.5.1.103.1.2.1.1.1	VlanIndex	read-only	The VLAN on which this binding entry is permitted.
T/F hpicfDIPLDv6ResourceAvailable	1.3.6.1.4.1.11.2.14.11.5.1.103.1.2.1.1.2	TruthValue	read-only	This Object provides the availability of HW resources while adding a binding. TRUE indicates that hardware resources were available to add a binding. FALSE indicates that resources were not available.
hpicfIpv6LockConformance	1.3.6.1.4.1.11.2.14.11.5.1.103.2
hpicfIpv6LockGroups	1.3.6.1.4.1.11.2.14.11.5.1.103.2.1
hpicfIpv6LockBaseGroup	1.3.6.1.4.1.11.2.14.11.5.1.103.2.1.1			A collection of objects for configuring and monitoring the base Dynamic IPv6 Lockdown functionality.
hpicfSourceBindingTrapObjectsGroup	1.3.6.1.4.1.11.2.14.11.5.1.103.2.1.2			A collection of objects used in the Dynamic IPv6 Lockdown notification.
hpicfSourceBindingTrapsGroup	1.3.6.1.4.1.11.2.14.11.5.1.103.2.1.3			A collection of trap objects for Dynamic IP Lockdown feature.
hpicfIpv6LockCompliances	1.3.6.1.4.1.11.2.14.11.5.1.103.2.2
hpicfDIPLDv6Compliance	1.3.6.1.4.1.11.2.14.11.5.1.103.2.2.1			The compliance statement for HP switches that support Dynamic IPv6 Lockdown.
hpicfIpv6SourceBindingTrapCompliance	1.3.6.1.4.1.11.2.14.11.5.1.103.2.2.2			The compliance statement for HP switches that support Dynamic IP Lockdown Notify group .

RFC description

HP ICF (Intelligent Connectivity Framework) vendor-private MIB for IPv6 dynamic lockdown security policy management.

Start monitoring HP ProCurve/Aruba switch (DHCPv6 snooping/IPv6 dynamic lockdown) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download HP-ICF-IPv6-DYNAMIC-LOCKDOWN-MIB

What Is HP-ICF-IPv6-DYNAMIC-LOCKDOWN-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description