All MIBs › HP-ICF-SECURITY
Organization: HP Networking
Last Updated: 2008-03-05
Category: Domain: Security, Vendor: HP/HPE
Description:
HP ICF SNMP MIB for general security management including port security, access control, and management access on HP ProCurve switches.
Imported Objects
From HP-ICF-OID
| hpicfObjectModules | OBJECT-IDENTITY |
| icfSecurity | OBJECT-IDENTITY |
From INET-ADDRESS-MIB
| InetAddress | |
| InetAddressType |
From SNMPv2-CONF
| MODULE-COMPLIANCE | |
| OBJECT-GROUP |
From SNMPv2-SMI
| Integer32 | |
| IpAddress | |
| MODULE-IDENTITY | |
| OBJECT-TYPE | |
| TimeTicks |
From SNMPv2-TC
| DisplayString | |
| RowStatus |
What Is HP-ICF-SECURITY?
HP-ICF-SECURITY is an HP proprietary MIB within the ICF suite covering general security management on ProCurve switches, including SNMPv1 authorization configuration, port security, and management access control. It exposes configuration objects that govern which SNMP communities or hosts are authorized to manage the device and related access-control settings. Its monitoring relevance is primarily around software/configuration status: verifying that security settings such as SNMP authorization are correctly and safely configured, which helps detect exposure to unauthorized management access rather than hardware faults. It builds on the standard SNMPv2-MIB/SNMP framework concepts for community and access control. It is typically deployed across HP ProCurve switch fleets where network security teams need to audit and enforce management-plane access restrictions. Engineers can download the HP-ICF-SECURITY file directly to load it into their MIB browser.
IPNetwork Monitor allows you to monitor SNMP objects defined in HP-ICF-SECURITY. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.
What Can Be Monitored
- SNMPv1 community authorization settings
- authorized management host/access configuration
Supported Devices
- HP ProCurve switch
Monitoring Examples
No sample_objects were provided, so exact object names cannot be grounded, but based on the module description this MIB would include objects controlling SNMPv1 community authorization and permitted management hosts. A security administrator would poll these settings to confirm no overly permissive community strings or unauthorized management stations are configured, revealing a security exposure if found.
OIDs
| OID symbolic | OID numeric | Type | Access | Description |
|---|---|---|---|---|
| STR icfSecurPassword | 1.3.6.1.4.1.11.2.14.4.1 | DisplayString | read-write | ********* THIS OBJECT IS DEPRECATED ********* This variable contains a string which is used both as the community name for the password community, and as the login password for the console port. This community name is needed for most SET operations. In addition, the variables in the ICF security group are only visible within the password community, and must use the value of this variable as the community name for GET operations. If the value of this variable is equal to the null string, the community name 'public' or the null string will be treated the same as the password community. This object has been deprecated. Its functionality has been replaced by the icfCommunityTable. |
| INT icfSecurAuthAnyMgr | 1.3.6.1.4.1.11.2.14.4.2 | INTEGER | read-write | ********* THIS OBJECT IS DEPRECATED ********* When this variable is set to enabled, any manager with a valid community name may perform SET operations on this device. In this configuration, entries in the icfSecurAuthMgrTable are used only for trap destinations. If this variable is set to disabled, a manager must be in the icfSecurAuthMgrTable and have a valid community name in order to perform SET operations. This object has been deprecated. Its functionality has been replaced by the icfAuthMgrTable. |
| icfSecurAuthMgrTable | 1.3.6.1.4.1.11.2.14.4.3 | not-accessible | ********* THIS OBJECT IS DEPRECATED ********* This table contains a list of addresses of managers that are allowed to perform SET operations on this device, and controls the destination addresses for traps. If icfSecurAuthAnyMgr is set to disabled, a manager must be in this table and use the correct community name for the password community in order to perform a GET operation on this table. This table has been deprecated. It is replaced by the icfAuthMgrTable. The trap destination functionality has been replaced by the hpicfTrapDestTable. | |
| icfSecurAuthMgrEntry | 1.3.6.1.4.1.11.2.14.4.3.1 | not-accessible | ********* THIS OBJECT IS DEPRECATED ********* An entry in the icfSecurAuthMgrTable containing information about a single manager. This table has been deprecated. It is replaced by the icfAuthMgrTable. The trap destination functionality has been replaced by the hpicfTrapDestTable. | |
| I32 icfAuthMgrIndex | 1.3.6.1.4.1.11.2.14.4.3.1.1 | Integer32 | read-only | ********* THIS OBJECT IS DEPRECATED ********* This object contains the index which uniquely identifies this entry in the icfSecurAuthMgrTable. This table has been deprecated. It is replaced by the icfAuthMgrTable. The trap destination functionality has been replaced by the hpicfTrapDestTable. |
| IP icfAuthMgrIpAddress | 1.3.6.1.4.1.11.2.14.4.3.1.2 | IpAddress | read-write | ********* THIS OBJECT IS DEPRECATED ********* The IP address of a manager that is allowed to manage this device. Setting this variable to a nonzero value will clear the corresponding instance of the icfAuthMgrIpxAddress variable. This table has been deprecated. It is replaced by the icfAuthMgrTable. The trap destination functionality has been replaced by the hpicfTrapDestTable. |
| OCT icfAuthMgrIpxAddress | 1.3.6.1.4.1.11.2.14.4.3.1.3 | OCTET STRING | read-write | ********* THIS OBJECT IS DEPRECATED ********* The IPX address of a manager that is allowed to manage this device. Setting this variable to a valid IPX address will clear the corresponding instance of the icfAuthMgrIpAddress variable. This table has been deprecated. It is replaced by the icfAuthMgrTable. The trap destination functionality has been replaced by the hpicfTrapDestTable. |
| INT icfAuthMgrRcvTraps | 1.3.6.1.4.1.11.2.14.4.3.1.4 | INTEGER | read-write | ********* THIS OBJECT IS DEPRECATED ********* If this variable is set to enabled, any traps generated by this device will be sent to the manager indicated by the corresponding instance of either icfAuthMgrIpAddress or icfAuthMgrIpxAddress, whichever is valid. This table has been deprecated. It is replaced by the icfAuthMgrTable. The trap destination functionality has been replaced by the hpicfTrapDestTable. |
| icfSecurIntruder | 1.3.6.1.4.1.11.2.14.4.4 | |||
| INT icfSecurIntruderFlag | 1.3.6.1.4.1.11.2.14.4.4.1 | INTEGER | read-write | If this object is set to 'valid', the remainder of the intruder objects contain information about an authentication failure. The Security LED on the device will blink if this flag is set to 'valid'. The intruder objects will not be overwritten as long as this flag is set to 'valid'. Setting this flag to 'invalid' will turn off the Security LED if there are no other current violations, and will allow the intruder objects to be overwritten by subsequent authentication failures. |
| IP icfSecurIntruderIpAddress | 1.3.6.1.4.1.11.2.14.4.4.2 | IpAddress | read-only | The IP address of the manager that caused the authentication failure. Only one of icfSecurIntruderIpAddress and icfSecurIntruderIPXAddress will be valid. |
| OCT icfSecurIntruderIpxAddress | 1.3.6.1.4.1.11.2.14.4.4.3 | OCTET STRING | read-only | The IPX address of the manager that caused the authentication failure. Only one of icfSecurIntruderIpAddress and icfSecurIntruderIPXAddress will be valid. |
| TIK icfSecurIntruderTime | 1.3.6.1.4.1.11.2.14.4.4.4 | TimeTicks | read-only | The value of sysUpTime when the authentication failure occurred. A value of 0 indicates that the agent has been reset since this authentication failure occurred. |
| icfCommunityTable | 1.3.6.1.4.1.11.2.14.4.5 | not-accessible | ******************DEPRECATED******************* This table contains information about community names known by this agent. | |
| icfCommunityEntry | 1.3.6.1.4.1.11.2.14.4.5.1 | not-accessible | ******************DEPRECATED******************* An entry in the table, containing information about a single community name. | |
| I32 icfCommunityIndex | 1.3.6.1.4.1.11.2.14.4.5.1.1 | Integer32 | not-accessible | ******************DEPRECATED******************* Uniquely identifies this community name entry. |
| OCT icfCommunityName | 1.3.6.1.4.1.11.2.14.4.5.1.2 | OCTET STRING | read-create | ******************DEPRECATED******************* Community name this entry is about. Not allowed to have two active rows with the same community name. |
| INT icfCommunityReadView | 1.3.6.1.4.1.11.2.14.4.5.1.3 | INTEGER | read-create | ******************DEPRECATED******************* The MIB view used for read requests using this community name. One of the following: 'none' is the empty MIB view. 'discovery' has access to discovery objects, which will be enough to do an address search, send announce packets, and do a link test. This view also includes objects under the samplingProbe subtree. This view is typically used as a writeView for a community used by autodiscovery and autotopology applications. 'restricted' has access to a limited subset of the MIB, which includes monitoring objects and limited set of configuration objects. 'user' has access to everything except objects under the icfSecurity subtree. 'root' has access to everything, including the icfSecurity subtree. |
| INT icfCommunityWriteView | 1.3.6.1.4.1.11.2.14.4.5.1.4 | INTEGER | read-create | ******************DEPRECATED******************* The MIB view used for write requests using this community name. One of the following: 'none' is the empty MIB view. 'discovery' has access to discovery objects, which will be enough to do an address search, send announce packets, and do a link test. This view also includes objects under the samplingProbe subtree. This view is typically used as a writeView for a community used by autodiscovery and autotopology applications. 'restricted' has access to a limited subset of the MIB, which includes monitoring objects and limited set of configuration objects. 'user' has access to everything except objects under the icfSecurity subtree. 'root' has access to everything, including the icfSecurity subtree. |
| ROW icfCommunityStatus | 1.3.6.1.4.1.11.2.14.4.5.1.5 | RowStatus | read-create | ******************DEPRECATED******************* Status of this entry. |
| icfAuthMgrTable | 1.3.6.1.4.1.11.2.14.4.6 | not-accessible | ******************DEPRECATED******************* This table contains a list of manager addresses. Entries in this table are grouped by using a common value for icfCommunityIndex, that identifies the community name that the group of manager addresses has access to. A community name entry which has a set of entries in this table can only be used by requests originating from one of the addresses in the set. A community name entry which has no entries in this table can be used by requests originating from any address. | |
| icfAuthMgrEntry | 1.3.6.1.4.1.11.2.14.4.6.1 | not-accessible | ******************DEPRECATED******************* An entry in the table, containing a single authorized manager address. | |
| I32 icfAuthMgrSubIndex | 1.3.6.1.4.1.11.2.14.4.6.1.1 | Integer32 | not-accessible | ******************DEPRECATED******************* An index which uniquely identifies an address within a group. |
| INT icfAuthMgrAddrType | 1.3.6.1.4.1.11.2.14.4.6.1.2 | INTEGER | read-create | ******************DEPRECATED******************* The network type for this entry. |
| OCT icfAuthMgrAddress | 1.3.6.1.4.1.11.2.14.4.6.1.3 | OCTET STRING | read-create | ******************DEPRECATED******************* The manager address for this entry, formatted according to the value of icfAuthMgrAddrType. When icfAuthMgrAddrType is 'ip', this value will consist of four octets, containing the IP address of the manager in network byte order. When icfAuthMgrAddrType is 'ipx', this value will consist of ten octets. The first four octets will contain the IPX network number in network byte order, and the remaining six octets will contain the IPX node number in network byte order. |
| OCT icfAuthMgrMask | 1.3.6.1.4.1.11.2.14.4.6.1.4 | OCTET STRING | read-create | ******************DEPRECATED******************* This object is used to qualify the value of the corresponding instance of icfAuthMgrAddress. The semantics of this object depend on the corresponding value of icfAuthMgrAddrType. When icfAuthMgrType is 'ip', this object can be used to allow access by all managers on a particular IP subnet. When icfAuthMgrType is 'ipx', this object can be used to allow access by all managers with a particular IPX network number. |
| ROW icfAuthMgrStatus | 1.3.6.1.4.1.11.2.14.4.6.1.5 | RowStatus | read-create | ******************DEPRECATED******************* Status of this entry. |
| icfAuthIPMgrTable | 1.3.6.1.4.1.11.2.14.4.7 | not-accessible | This table contains a list of IP manager addresses. This list is used grant or deny access to HTTP, telnet, and TFTP. | |
| icfAuthIPMgrEntry | 1.3.6.1.4.1.11.2.14.4.7.1 | not-accessible | An entry in the table containing a single IP authorized manager address. | |
| I32 icfAuthIPMgrIndex | 1.3.6.1.4.1.11.2.14.4.7.1.1 | Integer32 | not-accessible | An index which uniquely identifies an address within the group. |
| IP icfAuthIPMgrAddress | 1.3.6.1.4.1.11.2.14.4.7.1.2 | IpAddress | read-create | **************deprecated********************* The IP address of the authorized manager for this entry. This object is deprecated new object icfAuthIPMgr InetAddress has been defined to hold version neutral address type. |
| IP icfAuthIPMgrMask | 1.3.6.1.4.1.11.2.14.4.7.1.3 | IpAddress | read-create | **************deprecated********************** This object qualifies the value of the corresponding instance of icfAuthIPMgrAddress. This object can be used to allow access by all managers on a particular IP subnet. This object is deprecated the new objects which are defined to hold this is value are icfAuthIPMgrInetAddrMaskType and icfAuthIPMgrInetAddrMask. |
| INT icfAuthIPMgrAccess | 1.3.6.1.4.1.11.2.14.4.7.1.4 | INTEGER | read-create | This object defines the access level for a given manager. Operator allows for read only access, and Manager allows for read/write access. |
| ROW icfAuthIPMgrStatus | 1.3.6.1.4.1.11.2.14.4.7.1.5 | RowStatus | read-create | Status of this entry. |
| IPt icfAuthIPMgrInetAddrType | 1.3.6.1.4.1.11.2.14.4.7.1.6 | InetAddressType | read-create | Specifies the type of address stored in icfAuthIPMgrInetAddress object. |
| IP icfAuthIPMgrInetAddress | 1.3.6.1.4.1.11.2.14.4.7.1.7 | InetAddress | read-create | The IP address of the authorized manager for this entry.This object can hold the version neutral IP address. |
| IPt icfAuthIPMgrInetAddrMaskType | 1.3.6.1.4.1.11.2.14.4.7.1.8 | InetAddressType | read-create | Specifies the type of IP Mask stored in icfAuthIPMgrInetAddrMask object. |
| IP icfAuthIPMgrInetAddrMask | 1.3.6.1.4.1.11.2.14.4.7.1.9 | InetAddress | read-create | This object qualifies the value of the corresponding instance of icfAuthIPMgrInetAddress. This object can be used to allow access by all managers on a particular IP subnet.This object can hold the version neutral IP address Mask. |
| INT icfAuthIPMgrAccessMethod | 1.3.6.1.4.1.11.2.14.4.7.1.10 | INTEGER | read-create | This object defines the access method for a given manager. The different access methods are all, ssh, telnet, web, snmp, tftp |
| icfSecurityMib | 1.3.6.1.4.1.11.2.14.10.2.1 | This MIB module describes objects for managing the SNMPv1 authorization configuration for devices in the HP Integrated Communication Facility product line. | ||
| icfSecurityConformance | 1.3.6.1.4.1.11.2.14.10.2.1.1 | |||
| icfSecurityCompliances | 1.3.6.1.4.1.11.2.14.10.2.1.1.1 | |||
| icfSecurCompliance | 1.3.6.1.4.1.11.2.14.10.2.1.1.1.1 | ********* THIS COMPLIANCE IS DEPRECATED *********/ A compliance statement for agents implementing the original version of this module. | ||
| icfV1CommunityCompliance | 1.3.6.1.4.1.11.2.14.10.2.1.1.1.2 | ********* THIS GROUP IS DEPRECATED ********* A compliance statement for HP ICF agents implementing SNMPv1 community name management. | ||
| icfAuthIPMgrCompliance | 1.3.6.1.4.1.11.2.14.10.2.1.1.1.3 | A compliance statement for granting or denying access to specific IP addresses for HTTP, telnet, and TFTP. | ||
| icfAuthIPMgrCompliance1 | 1.3.6.1.4.1.11.2.14.10.2.1.1.1.4 | A compliance statement for granting or denying access to specific IP addresses for HTTP, telnet, and TFTP. | ||
| icfSecurityGroups | 1.3.6.1.4.1.11.2.14.10.2.1.1.2 | |||
| icfSnmpSecurityGroup | 1.3.6.1.4.1.11.2.14.10.2.1.1.2.1 | ********* THIS GROUP IS DEPRECATED ********* A collection of objects for managing the SNMPv1 (non-)security configuration on HP networking devices. | ||
| icfSecIntruderGroup | 1.3.6.1.4.1.11.2.14.10.2.1.1.2.2 | A collection of objects for tracking authentication failures. | ||
| icfV1CommunityGroup | 1.3.6.1.4.1.11.2.14.10.2.1.1.2.13 | ********* THIS GROUP IS DEPRECATED ********* A collection of objects for managing SNMPv1 community strings. | ||
| icfAuthIPMgrGroup | 1.3.6.1.4.1.11.2.14.10.2.1.1.2.14 | ***************** deprecated ****************** A collection of objects for granting or denying access to specific IP addresses for HTTP, telnet, and TFTP. This Group object has been deprecated and a new group object has been defined with name icfAuthIPMgrInetGroup. | ||
| icfAuthIPMgrInetGroup | 1.3.6.1.4.1.11.2.14.10.2.1.1.2.15 | A collection of objects for granting or denying access to specific IP addresses for HTTP, telnet, and TFTP. |
RFC description
SNMPv1 authorization and security configuration for HP Integrated Communication Facility devices.
Start monitoring HP ProCurve switch (SNMPv1 authorization/management access control) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.