HP-ICF-LMA-MIB

All MIBs › HP-ICF-LMA-MIB

Organization: HP Networking

Last Updated: 2017-06-28

Category: Vendor: HP/HPE

Description: HP ICF SNMP MIB for Location Management Agent (LMA) providing device physical location tracking on HP ProCurve networks.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is HP-ICF-LMA-MIB?

HP-ICF-LMA-MIB is an HP proprietary MIB belonging to the ICF suite; despite its name suggesting location management, its actual module description indicates it manages Local MAC Authentication (LMA), a port-security feature that authenticates devices by MAC address on HP ProCurve switches. It exposes configuration objects for enabling and tuning MAC-based authentication on switch ports rather than continuous performance data. Its monitoring relevance is chiefly around access-control/security status: whether LMA is enabled per port and what authentication state a connected device is in, which is a software/feature-status check more than a hardware health check. It relies on the standard interface indexing conventions from IF-MIB to associate authentication settings with specific switch ports. It is typically deployed in secured LAN edge environments where HP ProCurve switches enforce MAC-based network access control. Engineers can download the HP-ICF-LMA-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in HP-ICF-LMA-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

HP ProCurve switch

Monitoring Examples

No sample_objects were provided for this MIB, so specific object names cannot be grounded; a plausible implementation would include a per-port LMA enable/status object and possibly a table of authenticated client MAC addresses. An administrator would poll the per-port status to confirm LMA is active on edge ports and check the authenticated-client table to see which devices have successfully authenticated.

What Can Be Monitored

per-port Local MAC Authentication enable status
authenticated client MAC entries

Imported Objects

From HP-AUTZ-MIB

HpAutzUserRoleName

From HP-ICF-OID

hpSwitch

OBJECT-IDENTITY

From HP-ICF-TC

VidList

From IF-MIB

InterfaceIndex

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Integer32
MODULE-IDENTITY
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DisplayString
MacAddress
RowStatus
TruthValue

How to Use in IPNetwork Monitor

Example using hpicfLmaSessionUsrNumberCnt OID:

Select an HP ProCurve switch (Local MAC Authentication port security) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type hpicfLmaSessionUsrNumberCnt into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. This object specifies the number of authenticated clients currently present on this port. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
hpicfLmaMIB	1.3.6.1.4.1.11.2.14.11.5.1.97			This MIB module describes objects for managing the Local MAC Authentication feature of devices in the HP Integrated Communication Facility product line.
hpicfLmaNotifications	1.3.6.1.4.1.11.2.14.11.5.1.97.0
hpicfLmaObjects	1.3.6.1.4.1.11.2.14.11.5.1.97.1
hpicfLmaConfigObjects	1.3.6.1.4.1.11.2.14.11.5.1.97.1.1
hpicfLmaScalarObjects	1.3.6.1.4.1.11.2.14.11.5.1.97.1.1.1
hpicfLmaMacGrpTable	1.3.6.1.4.1.11.2.14.11.5.1.97.1.1.2		not-accessible	This table is to create MAC group, which is a collection Of MAC address/MAC OUI/MAC mask. There can be a maximum of 256 MAC groups.
hpicfLmaMacGrpEntry	1.3.6.1.4.1.11.2.14.11.5.1.97.1.1.2.1		not-accessible	This table is to create MAC group, which is a collection Of MAC address/MAC OUI/MAC mask. There can be a maximum of 256 MAC groups.
STR hpicfLmaMacGrpName	1.3.6.1.4.1.11.2.14.11.5.1.97.1.1.2.1.1	DisplayString	not-accessible	Name of the MAC group. A name can have maximum 32 characters.
ROW hpicfLmaMacGrpRowStatus	1.3.6.1.4.1.11.2.14.11.5.1.97.1.1.2.1.2	RowStatus	read-create	Status of this row, by which new entries may be created or existing entries deleted from this table.
hpicfLmaMacTable	1.3.6.1.4.1.11.2.14.11.5.1.97.1.1.3		not-accessible	This table stores MAC address/MAC OUI/MAC mask bound to a MAC group.A MAC group can be associated to a maximum of 120 entries, Each entry is equivalent to one record in hpicfLmaMacTable and there can be a maximum of 256 records.
hpicfLmaMacEntry	1.3.6.1.4.1.11.2.14.11.5.1.97.1.1.3.1		not-accessible	This table stores MAC address/MAC OUI/MAC mask bound to a MAC group.A MAC group can be associated to a maximum of 120 entries, Each entry is equivalent to one record in hpicfLmaMacTable and there can be a maximum of 256 records.
INT hpicfLmaMacType	1.3.6.1.4.1.11.2.14.11.5.1.97.1.1.3.1.1	INTEGER	not-accessible	This object specifies whether the type of MAC Address is: macAddress(1) Fully qualified MAC address. macMask(2) MAC address prefiX. Only 32 & 40 bits are allowed. macOUI(3) 24 bit organizationally unique identifier.
OCT hpicfLmaMacValue	1.3.6.1.4.1.11.2.14.11.5.1.97.1.1.3.1.2	OCTET STRING	not-accessible	This is to specify the value for the hpicfLmaMacType, value should be in conjunction with MAC Type.
ROW hpicfLmaMacRowStatus	1.3.6.1.4.1.11.2.14.11.5.1.97.1.1.3.1.3	RowStatus	read-create	Status of this row, by which new entries may be created or existing entries deleted from this table.
hpicfLmaProfileTable	1.3.6.1.4.1.11.2.14.11.5.1.97.1.1.4		not-accessible	This is to create the profile which can be associated to a MAC group/MAC address/MAC OUI/MAC mask. A profile is a collection of attributes. Profiles are not applied when hpSwitchAutzUserRoleEnabled is true.
hpicfLmaProfileEntry	1.3.6.1.4.1.11.2.14.11.5.1.97.1.1.4.1		not-accessible	This is to create the profile which can be associated to a MAC group/MAC address/MAC OUI/MAC mask.A profile is a collection of attributes.
STR hpicfLmaProfileName	1.3.6.1.4.1.11.2.14.11.5.1.97.1.1.4.1.1	DisplayString	not-accessible	This object contains the name of Local MAC Authentication profile.
I32 hpicfLmaProfileUntaggedVid	1.3.6.1.4.1.11.2.14.11.5.1.97.1.1.4.1.2	Integer32	read-create	Untagged VLAN ID.A value of 0 implies that untagged VLAN ID is not configured for this profile.Only one untagged VLAN ID can be associated with the profile.
VID hpicfLmaProfileTaggedVids	1.3.6.1.4.1.11.2.14.11.5.1.97.1.1.4.1.3	VidList	read-create	Tagged VLANs.A maximum of 50 tagged VLANs can be can be associated with the profile.
I32 hpicfLmaProfileCoS	1.3.6.1.4.1.11.2.14.11.5.1.97.1.1.4.1.4	Integer32	read-create	CoS value to be associated with this profile.A value of -1 indicates that CoS is not configured for this profile.
T/F hpicfLmaProfileIsAssociated	1.3.6.1.4.1.11.2.14.11.5.1.97.1.1.4.1.5	TruthValue	read-only	This object is to check whether any MAC is associated to this profile.A value of TRUE indicates that it is associated to MAC entry and FALSE indicates that it is not associated to any of the MAC entry.
ROW hpicfLmaProfileRowStatus	1.3.6.1.4.1.11.2.14.11.5.1.97.1.1.4.1.6	RowStatus	read-create	Status of this row, by which new entries may be created or existing entries deleted from this table.
hpicfLmaAssociationTable	1.3.6.1.4.1.11.2.14.11.5.1.97.1.1.5		not-accessible	This is association table between profile and MAC entries. This table is not used when hpSwitchAutzUserRoleEnabled is true.
hpicfLmaAssociationEntry	1.3.6.1.4.1.11.2.14.11.5.1.97.1.1.5.1		not-accessible	This is association table between the profile and MAC entries.
INT hpicfLmaAssociationMacType	1.3.6.1.4.1.11.2.14.11.5.1.97.1.1.5.1.2	INTEGER	not-accessible	This object specifies whether the type of MAC address is: macGrp(0) MAC group which contains a group of MAC Entry. macAddress(1) Fully qualified MAC address. macMask(2) MAC address prefix. Only 32 & 40 bits are allowed. macOUI(3) 24 bit organizationally unique identifier.
OCT hpicfLmaAssociationMacValue	1.3.6.1.4.1.11.2.14.11.5.1.97.1.1.5.1.4	OCTET STRING	not-accessible	This object specifies the MAC value. This value should be in conjunction with hpicfLmaAssociationMacType.
ROW hpicfLmaAssociationRowStatus	1.3.6.1.4.1.11.2.14.11.5.1.97.1.1.5.1.5	RowStatus	read-create	Status of this row, by which new entries may be created or existing entries deleted from this table.
hpicfLmaConfigTable	1.3.6.1.4.1.11.2.14.11.5.1.97.1.1.6		not-accessible	A table that contains the configuration objects for Local MAC based Authentication associated with each port. An entry appears in this table for each port that may authenticate access to itself.
hpicfLmaConfigEntry	1.3.6.1.4.1.11.2.14.11.5.1.97.1.1.6.1		not-accessible	A table that contains the configuration objects for Local MAC based Authentication associated with each port. An entry appears in this table for each port that may authenticate access to itself.
NUM hpicfLmaPortNumber	1.3.6.1.4.1.11.2.14.11.5.1.97.1.1.6.1.1	InterfaceIndex	not-accessible	The port number associated with this switch port.
I32 hpicfLmaClientLimit	1.3.6.1.4.1.11.2.14.11.5.1.97.1.1.6.1.2	Integer32	read-write	The maximum number of authenticated clients to allow on the port.
I32 hpicfLmaQuietPeriod	1.3.6.1.4.1.11.2.14.11.5.1.97.1.1.6.1.4	Integer32	read-write	Specifies the time, in seconds, that the switch should refrain from re-attempting an authentication request for a client whose credentials were rejected.
I32 hpicfLmaLogoffPeriod	1.3.6.1.4.1.11.2.14.11.5.1.97.1.1.6.1.5	Integer32	read-write	Specifies the period, in seconds, at which an authenticated client will be considered unauthenticated due to lack of activity (i.e. traffic originating from client).
I32 hpicfLmaAuthVid	1.3.6.1.4.1.11.2.14.11.5.1.97.1.1.6.1.7	Integer32	read-write	Specifies the port VID (PVID) that should be used for an authenticated client. When hpSwitchAutzUserRoleEnabled is true, this value may be superseded by the value of hpSwitchAutzUserRoleVlanId or hpSwitchAutzUserRoleVlanName from the client's assigned role.
I32 hpicfLmaUnauthVid	1.3.6.1.4.1.11.2.14.11.5.1.97.1.1.6.1.8	Integer32	read-write	Specifies the port VID (PVID) that should be used for an unauthenticated client. When hpSwitchAutzUserRoleEnabled is true, this value may be superseded by the value of hpSwitchAutzUserRoleVlanId or hpSwitchAutzUserRoleVlanName from the role identified by hpSwitchAutzUserRoleInitialRoleName.
I32 hpicfLmaUnAuthPeriod	1.3.6.1.4.1.11.2.14.11.5.1.97.1.1.6.1.9	Integer32	read-write	Specifies the period, in seconds, at which a client will be placed into guest vlan, or assigned the role identified by hpSwitchAutzUserRoleInitialRoleName when hpSwitchAutzUserRoleEnabled is true, if it fails authentication.
T/F hpicfLmaReauthenticate	1.3.6.1.4.1.11.2.14.11.5.1.97.1.1.6.1.10	TruthValue	read-write	The reauthentication control for this port. Setting this attribute TRUE forces all authenticated clients to re-authenticate themselves. Setting this attribute FALSE has no effect. This attribute always returns FALSE when read.
T/F hpicfLmaMacPin	1.3.6.1.4.1.11.2.14.11.5.1.97.1.1.6.1.11	TruthValue	read-write	Enables MAC-Pinning on this port. Setting this attribute TRUE pins the authenticated MAC addresses to the Mac address table. Authenticated clients will not be de-authenticated even when clients are inactive throughout the logoff period.
hpicfLmaUserRoleAssociationTable	1.3.6.1.4.1.11.2.14.11.5.1.97.1.1.7		not-accessible	A table of associations between user role and MAC entries.
hpicfLmaUserRoleAssociationEntry	1.3.6.1.4.1.11.2.14.11.5.1.97.1.1.7.1		not-accessible	The association table entry.
HPA hpicfLmaUserRoleAssociationName	1.3.6.1.4.1.11.2.14.11.5.1.97.1.1.7.1.1	HpAutzUserRoleName	not-accessible	The name of this user role.
INT hpicfLmaUserRoleAssociationMacType	1.3.6.1.4.1.11.2.14.11.5.1.97.1.1.7.1.2	INTEGER	not-accessible	This object specifies whether the type of MAC address is: macGrp(0) MAC group which contains a group of MAC Entry. macAddress(1) Fully qualified MAC address. macMask(2) MAC address prefix. Only 32 & 40 bits are allowed. macOUI(3) 24 bit organizationally unique identifier.
OCT hpicfLmaUserRoleAssociationMacValue	1.3.6.1.4.1.11.2.14.11.5.1.97.1.1.7.1.3	OCTET STRING	not-accessible	This object specifies the MAC value. This value should be used in conjunction with the hpicfLmaUserRoleAssociationMacType.
ROW hpicfLmaUserRoleAssociationRowStatus	1.3.6.1.4.1.11.2.14.11.5.1.97.1.1.7.1.4	RowStatus	read-create	Status of this row, by which new entries may be created or existing entries deleted from this table.
hpicfLmaStatsObjects	1.3.6.1.4.1.11.2.14.11.5.1.97.1.2
hpicfLmaSessionStatsTable	1.3.6.1.4.1.11.2.14.11.5.1.97.1.2.1		not-accessible	A table that contains session statistic objects for each client (i.e. user) attempting to authenticate to a port with MAC authentication enabled. An entry appears in this table for each port in the switch.
hpicfLmaSessionStatsEntry	1.3.6.1.4.1.11.2.14.11.5.1.97.1.2.1.1		not-accessible	The session statistics information for a port with MAC based authentication enabled. This shows the current values being collected for active sessions.
MAC hpicfLmaSessionMacAddr	1.3.6.1.4.1.11.2.14.11.5.1.97.1.2.1.1.1	MacAddress	not-accessible	This object specifies the MAC address of the client.
INT hpicfLmaSessionState	1.3.6.1.4.1.11.2.14.11.5.1.97.1.2.1.1.2	INTEGER	read-only	Specifies the state of the client as follows: 'authenticated' - authenticated client 'unauthenticated' - unauthenticated client, waiting for credentials 'authenticating' - credentials have been sent for verification, waiting for response 'authReqRejectNoVlan' - credentials invalid; client does not have access to unauthenticated VLAN 'authReqRejectUnauthVlan' - credentials invalid; client does have access to unauthenticated VLAN 'authReqTimeoutNoVlan' - credentials could not be verified; client is still unauthenticated and does not have access to unauthenticated VLAN 'authReqTimeoutUnauthVlan' - credentials could not be verified; client is still unauthenticated, but has access to unauthenticated VLAN 'initialRole' - client is assigned the initial role 'initialRoleFailed' - initial role could not be applied; client does not have access to the network
U32 hpicfLmaSessionStateTime	1.3.6.1.4.1.11.2.14.11.5.1.97.1.2.1.1.3	Unsigned32	read-only	The duration, in seconds, a client has spent in the state specified by hpicfLmaSessionState.
I32 hpicfLmaSessionAuthVid	1.3.6.1.4.1.11.2.14.11.5.1.97.1.2.1.1.4	Integer32	read-only	This object specifies the PVID that the authenticated client is utilizing. If the client is unauthenticated, this object has no meaning.
I32 hpicfLmaSessionUnauthVid	1.3.6.1.4.1.11.2.14.11.5.1.97.1.2.1.1.5	Integer32	read-only	This object specifies the PVID that the unauthenticated client is utilizing. If the client is authenticated, this object has no meaning.
C32 hpicfLmaSessionUsrNumberCntEx	1.3.6.1.4.1.11.2.14.11.5.1.97.1.2.1.1.6	Counter32	read-only	This object specifies the number of authenticated clients currently present on this port. This does not include the clients that are under the process of authentication.
HPA hpicfLmaSessionUserRole	1.3.6.1.4.1.11.2.14.11.5.1.97.1.2.1.1.7	HpAutzUserRoleName	read-only	When hpSwitchAutzUserRoleEnabled is true, specifies the user role of the client.
hpicfLmaAssocActiveTable	1.3.6.1.4.1.11.2.14.11.5.1.97.1.2.2		not-accessible	This is an association table to display all the MAC clients that are active for a given profile.
hpicfLmaAssocActiveEntry	1.3.6.1.4.1.11.2.14.11.5.1.97.1.2.2.1		not-accessible	This is an association table to display all the MAC clients that are active for a given profile.
STR hpicfLmaAssocActiveProfileName	1.3.6.1.4.1.11.2.14.11.5.1.97.1.2.2.1.1	DisplayString	not-accessible	This object contains the name of Local MAC authentication profile.
MAC hpicfLmaAssocActiveMacAddress	1.3.6.1.4.1.11.2.14.11.5.1.97.1.2.2.1.2	MacAddress	read-only	This object specifies the MAC address of the client.
hpicfLmaConformance	1.3.6.1.4.1.11.2.14.11.5.1.97.2
hpicfLmaCompliances	1.3.6.1.4.1.11.2.14.11.5.1.97.2.1
hpicfLmaCompliance1	1.3.6.1.4.1.11.2.14.11.5.1.97.2.1.1			The compliance statement
hpicfLmaCompliance2	1.3.6.1.4.1.11.2.14.11.5.1.97.2.1.2			The compliance statement
hpicfLmaCompliance3	1.3.6.1.4.1.11.2.14.11.5.1.97.2.1.3			The compliance statement
hpicfLmaGroups	1.3.6.1.4.1.11.2.14.11.5.1.97.2.2
hpicfLmaMacGroup	1.3.6.1.4.1.11.2.14.11.5.1.97.2.2.1			These objects are used for managing Local MAC Authentication configuration parameters.
hpicfLmaConfigGroup	1.3.6.1.4.1.11.2.14.11.5.1.97.2.2.2			A collection of objects providing configuration objects for Local MAC authentication associated with each port.
hpicfLmaSessionStatsGroup	1.3.6.1.4.1.11.2.14.11.5.1.97.2.2.3			A collection of objects providing statistics about current sessions for Local MAC authentication.
hpicfLmaMacGroup1	1.3.6.1.4.1.11.2.14.11.5.1.97.2.2.4			These objects are used for managing Local MAC Authentication configuration parameters.
hpicfLmaConfigGroup1	1.3.6.1.4.1.11.2.14.11.5.1.97.2.2.5			A collection of objects providing configuration objects for Local MAC authentication associated with each port.
hpicfLmaSessionStatsGroup1	1.3.6.1.4.1.11.2.14.11.5.1.97.2.2.6			A collection of objects providing statistics about current sessions for Local MAC authentication.
hpicfLmaConfigGroup2	1.3.6.1.4.1.11.2.14.11.5.1.97.2.2.7			A collection of objects providing configuration objects for Local MAC authentication associated with each port.

RFC description

HP Integrated Communication Facility Link Management Agent MIB for SNMP management of HP networking devices and communication equipment.

Start monitoring HP ProCurve switch (Local MAC Authentication port security) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download HP-ICF-LMA-MIB