HP-ICF-SECURITY

MIB Reference — IPNetwork Monitor

All MIBsHP-ICF-SECURITY

Organization: HP Networking

Last Updated: 2008-03-05

Category: Domain: Security, Vendor: HP/HPE

Description:

HP ICF SNMP MIB for general security management including port security, access control, and management access on HP ProCurve switches.

Imported Objects

From HP-ICF-OID

hpicfObjectModulesOBJECT-IDENTITY
icfSecurityOBJECT-IDENTITY

From INET-ADDRESS-MIB

InetAddress
InetAddressType

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Integer32
IpAddress
MODULE-IDENTITY
OBJECT-TYPE
TimeTicks

From SNMPv2-TC

DisplayString
RowStatus

What Is HP-ICF-SECURITY?

HP-ICF-SECURITY is an HP proprietary MIB within the ICF suite covering general security management on ProCurve switches, including SNMPv1 authorization configuration, port security, and management access control. It exposes configuration objects that govern which SNMP communities or hosts are authorized to manage the device and related access-control settings. Its monitoring relevance is primarily around software/configuration status: verifying that security settings such as SNMP authorization are correctly and safely configured, which helps detect exposure to unauthorized management access rather than hardware faults. It builds on the standard SNMPv2-MIB/SNMP framework concepts for community and access control. It is typically deployed across HP ProCurve switch fleets where network security teams need to audit and enforce management-plane access restrictions. Engineers can download the HP-ICF-SECURITY file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in HP-ICF-SECURITY. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

What Can Be Monitored

  • SNMPv1 community authorization settings
  • authorized management host/access configuration

Supported Devices

  • HP ProCurve switch

Monitoring Examples

No sample_objects were provided, so exact object names cannot be grounded, but based on the module description this MIB would include objects controlling SNMPv1 community authorization and permitted management hosts. A security administrator would poll these settings to confirm no overly permissive community strings or unauthorized management stations are configured, revealing a security exposure if found.

OIDs
OID symbolicOID numericTypeAccessDescription
STR icfSecurPassword1.3.6.1.4.1.11.2.14.4.1DisplayStringread-write********* THIS OBJECT IS DEPRECATED ********* This variable contains a string which is used both as the community name for the password community, and as the login password for the console port. This community name is needed for most SET operations. In addition, the variables in the ICF security group are only visible within the password community, and must use the value of this variable as the community name for GET operations. If the value of this variable is equal to the null string, the community name 'public' or the null string will be treated the same as the password community. This object has been deprecated. Its functionality has been replaced by the icfCommunityTable.
INT icfSecurAuthAnyMgr1.3.6.1.4.1.11.2.14.4.2INTEGERread-write********* THIS OBJECT IS DEPRECATED ********* When this variable is set to enabled, any manager with a valid community name may perform SET operations on this device. In this configuration, entries in the icfSecurAuthMgrTable are used only for trap destinations. If this variable is set to disabled, a manager must be in the icfSecurAuthMgrTable and have a valid community name in order to perform SET operations. This object has been deprecated. Its functionality has been replaced by the icfAuthMgrTable.
icfSecurAuthMgrTable1.3.6.1.4.1.11.2.14.4.3not-accessible********* THIS OBJECT IS DEPRECATED ********* This table contains a list of addresses of managers that are allowed to perform SET operations on this device, and controls the destination addresses for traps. If icfSecurAuthAnyMgr is set to disabled, a manager must be in this table and use the correct community name for the password community in order to perform a GET operation on this table. This table has been deprecated. It is replaced by the icfAuthMgrTable. The trap destination functionality has been replaced by the hpicfTrapDestTable.
icfSecurAuthMgrEntry1.3.6.1.4.1.11.2.14.4.3.1not-accessible********* THIS OBJECT IS DEPRECATED ********* An entry in the icfSecurAuthMgrTable containing information about a single manager. This table has been deprecated. It is replaced by the icfAuthMgrTable. The trap destination functionality has been replaced by the hpicfTrapDestTable.
I32 icfAuthMgrIndex1.3.6.1.4.1.11.2.14.4.3.1.1Integer32read-only********* THIS OBJECT IS DEPRECATED ********* This object contains the index which uniquely identifies this entry in the icfSecurAuthMgrTable. This table has been deprecated. It is replaced by the icfAuthMgrTable. The trap destination functionality has been replaced by the hpicfTrapDestTable.
IP icfAuthMgrIpAddress1.3.6.1.4.1.11.2.14.4.3.1.2IpAddressread-write********* THIS OBJECT IS DEPRECATED ********* The IP address of a manager that is allowed to manage this device. Setting this variable to a nonzero value will clear the corresponding instance of the icfAuthMgrIpxAddress variable. This table has been deprecated. It is replaced by the icfAuthMgrTable. The trap destination functionality has been replaced by the hpicfTrapDestTable.
OCT icfAuthMgrIpxAddress1.3.6.1.4.1.11.2.14.4.3.1.3OCTET STRINGread-write********* THIS OBJECT IS DEPRECATED ********* The IPX address of a manager that is allowed to manage this device. Setting this variable to a valid IPX address will clear the corresponding instance of the icfAuthMgrIpAddress variable. This table has been deprecated. It is replaced by the icfAuthMgrTable. The trap destination functionality has been replaced by the hpicfTrapDestTable.
INT icfAuthMgrRcvTraps1.3.6.1.4.1.11.2.14.4.3.1.4INTEGERread-write********* THIS OBJECT IS DEPRECATED ********* If this variable is set to enabled, any traps generated by this device will be sent to the manager indicated by the corresponding instance of either icfAuthMgrIpAddress or icfAuthMgrIpxAddress, whichever is valid. This table has been deprecated. It is replaced by the icfAuthMgrTable. The trap destination functionality has been replaced by the hpicfTrapDestTable.
icfSecurIntruder1.3.6.1.4.1.11.2.14.4.4
INT icfSecurIntruderFlag1.3.6.1.4.1.11.2.14.4.4.1INTEGERread-writeIf this object is set to 'valid', the remainder of the intruder objects contain information about an authentication failure. The Security LED on the device will blink if this flag is set to 'valid'. The intruder objects will not be overwritten as long as this flag is set to 'valid'. Setting this flag to 'invalid' will turn off the Security LED if there are no other current violations, and will allow the intruder objects to be overwritten by subsequent authentication failures.
IP icfSecurIntruderIpAddress1.3.6.1.4.1.11.2.14.4.4.2IpAddressread-onlyThe IP address of the manager that caused the authentication failure. Only one of icfSecurIntruderIpAddress and icfSecurIntruderIPXAddress will be valid.
OCT icfSecurIntruderIpxAddress1.3.6.1.4.1.11.2.14.4.4.3OCTET STRINGread-onlyThe IPX address of the manager that caused the authentication failure. Only one of icfSecurIntruderIpAddress and icfSecurIntruderIPXAddress will be valid.
TIK icfSecurIntruderTime1.3.6.1.4.1.11.2.14.4.4.4TimeTicksread-onlyThe value of sysUpTime when the authentication failure occurred. A value of 0 indicates that the agent has been reset since this authentication failure occurred.
icfCommunityTable1.3.6.1.4.1.11.2.14.4.5not-accessible******************DEPRECATED******************* This table contains information about community names known by this agent.
icfCommunityEntry1.3.6.1.4.1.11.2.14.4.5.1not-accessible******************DEPRECATED******************* An entry in the table, containing information about a single community name.
I32 icfCommunityIndex1.3.6.1.4.1.11.2.14.4.5.1.1Integer32not-accessible******************DEPRECATED******************* Uniquely identifies this community name entry.
OCT icfCommunityName1.3.6.1.4.1.11.2.14.4.5.1.2OCTET STRINGread-create******************DEPRECATED******************* Community name this entry is about. Not allowed to have two active rows with the same community name.
INT icfCommunityReadView1.3.6.1.4.1.11.2.14.4.5.1.3INTEGERread-create******************DEPRECATED******************* The MIB view used for read requests using this community name. One of the following: 'none' is the empty MIB view. 'discovery' has access to discovery objects, which will be enough to do an address search, send announce packets, and do a link test. This view also includes objects under the samplingProbe subtree. This view is typically used as a writeView for a community used by autodiscovery and autotopology applications. 'restricted' has access to a limited subset of the MIB, which includes monitoring objects and limited set of configuration objects. 'user' has access to everything except objects under the icfSecurity subtree. 'root' has access to everything, including the icfSecurity subtree.
INT icfCommunityWriteView1.3.6.1.4.1.11.2.14.4.5.1.4INTEGERread-create******************DEPRECATED******************* The MIB view used for write requests using this community name. One of the following: 'none' is the empty MIB view. 'discovery' has access to discovery objects, which will be enough to do an address search, send announce packets, and do a link test. This view also includes objects under the samplingProbe subtree. This view is typically used as a writeView for a community used by autodiscovery and autotopology applications. 'restricted' has access to a limited subset of the MIB, which includes monitoring objects and limited set of configuration objects. 'user' has access to everything except objects under the icfSecurity subtree. 'root' has access to everything, including the icfSecurity subtree.
ROW icfCommunityStatus1.3.6.1.4.1.11.2.14.4.5.1.5RowStatusread-create******************DEPRECATED******************* Status of this entry.
icfAuthMgrTable1.3.6.1.4.1.11.2.14.4.6not-accessible******************DEPRECATED******************* This table contains a list of manager addresses. Entries in this table are grouped by using a common value for icfCommunityIndex, that identifies the community name that the group of manager addresses has access to. A community name entry which has a set of entries in this table can only be used by requests originating from one of the addresses in the set. A community name entry which has no entries in this table can be used by requests originating from any address.
icfAuthMgrEntry1.3.6.1.4.1.11.2.14.4.6.1not-accessible******************DEPRECATED******************* An entry in the table, containing a single authorized manager address.
I32 icfAuthMgrSubIndex1.3.6.1.4.1.11.2.14.4.6.1.1Integer32not-accessible******************DEPRECATED******************* An index which uniquely identifies an address within a group.
INT icfAuthMgrAddrType1.3.6.1.4.1.11.2.14.4.6.1.2INTEGERread-create******************DEPRECATED******************* The network type for this entry.
OCT icfAuthMgrAddress1.3.6.1.4.1.11.2.14.4.6.1.3OCTET STRINGread-create******************DEPRECATED******************* The manager address for this entry, formatted according to the value of icfAuthMgrAddrType. When icfAuthMgrAddrType is 'ip', this value will consist of four octets, containing the IP address of the manager in network byte order. When icfAuthMgrAddrType is 'ipx', this value will consist of ten octets. The first four octets will contain the IPX network number in network byte order, and the remaining six octets will contain the IPX node number in network byte order.
OCT icfAuthMgrMask1.3.6.1.4.1.11.2.14.4.6.1.4OCTET STRINGread-create******************DEPRECATED******************* This object is used to qualify the value of the corresponding instance of icfAuthMgrAddress. The semantics of this object depend on the corresponding value of icfAuthMgrAddrType. When icfAuthMgrType is 'ip', this object can be used to allow access by all managers on a particular IP subnet. When icfAuthMgrType is 'ipx', this object can be used to allow access by all managers with a particular IPX network number.
ROW icfAuthMgrStatus1.3.6.1.4.1.11.2.14.4.6.1.5RowStatusread-create******************DEPRECATED******************* Status of this entry.
icfAuthIPMgrTable1.3.6.1.4.1.11.2.14.4.7not-accessibleThis table contains a list of IP manager addresses. This list is used grant or deny access to HTTP, telnet, and TFTP.
icfAuthIPMgrEntry1.3.6.1.4.1.11.2.14.4.7.1not-accessibleAn entry in the table containing a single IP authorized manager address.
I32 icfAuthIPMgrIndex1.3.6.1.4.1.11.2.14.4.7.1.1Integer32not-accessibleAn index which uniquely identifies an address within the group.
IP icfAuthIPMgrAddress1.3.6.1.4.1.11.2.14.4.7.1.2IpAddressread-create**************deprecated********************* The IP address of the authorized manager for this entry. This object is deprecated new object icfAuthIPMgr InetAddress has been defined to hold version neutral address type.
IP icfAuthIPMgrMask1.3.6.1.4.1.11.2.14.4.7.1.3IpAddressread-create**************deprecated********************** This object qualifies the value of the corresponding instance of icfAuthIPMgrAddress. This object can be used to allow access by all managers on a particular IP subnet. This object is deprecated the new objects which are defined to hold this is value are icfAuthIPMgrInetAddrMaskType and icfAuthIPMgrInetAddrMask.
INT icfAuthIPMgrAccess1.3.6.1.4.1.11.2.14.4.7.1.4INTEGERread-createThis object defines the access level for a given manager. Operator allows for read only access, and Manager allows for read/write access.
ROW icfAuthIPMgrStatus1.3.6.1.4.1.11.2.14.4.7.1.5RowStatusread-createStatus of this entry.
IPt icfAuthIPMgrInetAddrType1.3.6.1.4.1.11.2.14.4.7.1.6InetAddressTyperead-createSpecifies the type of address stored in icfAuthIPMgrInetAddress object.
IP icfAuthIPMgrInetAddress1.3.6.1.4.1.11.2.14.4.7.1.7InetAddressread-createThe IP address of the authorized manager for this entry.This object can hold the version neutral IP address.
IPt icfAuthIPMgrInetAddrMaskType1.3.6.1.4.1.11.2.14.4.7.1.8InetAddressTyperead-createSpecifies the type of IP Mask stored in icfAuthIPMgrInetAddrMask object.
IP icfAuthIPMgrInetAddrMask1.3.6.1.4.1.11.2.14.4.7.1.9InetAddressread-createThis object qualifies the value of the corresponding instance of icfAuthIPMgrInetAddress. This object can be used to allow access by all managers on a particular IP subnet.This object can hold the version neutral IP address Mask.
INT icfAuthIPMgrAccessMethod1.3.6.1.4.1.11.2.14.4.7.1.10INTEGERread-createThis object defines the access method for a given manager. The different access methods are all, ssh, telnet, web, snmp, tftp
icfSecurityMib1.3.6.1.4.1.11.2.14.10.2.1This MIB module describes objects for managing the SNMPv1 authorization configuration for devices in the HP Integrated Communication Facility product line.
icfSecurityConformance1.3.6.1.4.1.11.2.14.10.2.1.1
icfSecurityCompliances1.3.6.1.4.1.11.2.14.10.2.1.1.1
icfSecurCompliance1.3.6.1.4.1.11.2.14.10.2.1.1.1.1********* THIS COMPLIANCE IS DEPRECATED *********/ A compliance statement for agents implementing the original version of this module.
icfV1CommunityCompliance1.3.6.1.4.1.11.2.14.10.2.1.1.1.2********* THIS GROUP IS DEPRECATED ********* A compliance statement for HP ICF agents implementing SNMPv1 community name management.
icfAuthIPMgrCompliance1.3.6.1.4.1.11.2.14.10.2.1.1.1.3A compliance statement for granting or denying access to specific IP addresses for HTTP, telnet, and TFTP.
icfAuthIPMgrCompliance11.3.6.1.4.1.11.2.14.10.2.1.1.1.4A compliance statement for granting or denying access to specific IP addresses for HTTP, telnet, and TFTP.
icfSecurityGroups1.3.6.1.4.1.11.2.14.10.2.1.1.2
icfSnmpSecurityGroup1.3.6.1.4.1.11.2.14.10.2.1.1.2.1********* THIS GROUP IS DEPRECATED ********* A collection of objects for managing the SNMPv1 (non-)security configuration on HP networking devices.
icfSecIntruderGroup1.3.6.1.4.1.11.2.14.10.2.1.1.2.2A collection of objects for tracking authentication failures.
icfV1CommunityGroup1.3.6.1.4.1.11.2.14.10.2.1.1.2.13********* THIS GROUP IS DEPRECATED ********* A collection of objects for managing SNMPv1 community strings.
icfAuthIPMgrGroup1.3.6.1.4.1.11.2.14.10.2.1.1.2.14***************** deprecated ****************** A collection of objects for granting or denying access to specific IP addresses for HTTP, telnet, and TFTP. This Group object has been deprecated and a new group object has been defined with name icfAuthIPMgrInetGroup.
icfAuthIPMgrInetGroup1.3.6.1.4.1.11.2.14.10.2.1.1.2.15A collection of objects for granting or denying access to specific IP addresses for HTTP, telnet, and TFTP.

RFC description

SNMPv1 authorization and security configuration for HP Integrated Communication Facility devices.

Start monitoring HP ProCurve switch (SNMPv1 authorization/management access control) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download HP-ICF-SECURITY