HP-ICF-URPF-MIB

All MIBs › HP-ICF-URPF-MIB

Organization: Hewlett Packard Enterprise

Last Updated: 2016-06-14

Category: Domain: Security, IP and Core Protocols, Technology: Routing/L3, VPN and Security, Vendor: HP/HPE

Description: An HP ICF SNMP MIB covering Unicast Reverse Path Forwarding (uRPF) configuration on HP ProCurve Layer 3 switches to guard against IP source spoofing.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is HP-ICF-URPF-MIB?

HP-ICF-URPF-MIB manages Unicast Reverse Path Forwarding (uRPF) on HP ProCurve Layer 3 switches, a security feature that verifies incoming packets arrive on the interface a return route would use, to detect and drop spoofed-source IP traffic. It is primarily a configuration-oriented MIB, exposing per-interface settings that enable, disable, or set the strict/loose mode of uRPF checking. From a monitoring standpoint it confirms that anti-spoofing protection is correctly enabled where required by security policy across a switch's routed interfaces, and would reveal configuration drift if uRPF was inadvertently disabled on an edge-facing port. It builds on the standard IP-MIB's interface and routing model, since uRPF decisions depend on the underlying unicast routing table. It's typically deployed on HP ProCurve/Aruba Layer 3 switches at network edges or in environments requiring anti-spoofing compliance, and the HP-ICF-URPF-MIB MIB is the reference administrators consult to confirm uRPF settings during compliance audits.

IPNetwork Monitor allows you to monitor SNMP objects defined in HP-ICF-URPF-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

HP ProCurve Layer 3 switch

Monitoring Examples

An admin auditing edge switches would poll the per-interface uRPF admin-status/mode objects across all routed VLAN interfaces to confirm strict mode is enabled on customer-facing ports; finding an interface reporting uRPF disabled would indicate a security-policy violation exposing the network to IP spoofing attacks.

What Can Be Monitored

uRPF enable/disable status per interface
uRPF strict vs. loose mode
anti-spoofing policy compliance

Imported Objects

From HP-ICF-OID

hpSwitch

OBJECT-IDENTITY

From IF-MIB

InterfaceIndex

From INET-ADDRESS-MIB

InetAddressType

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Counter64
Integer32
MODULE-IDENTITY
OBJECT-TYPE

From SNMPv2-TC

TruthValue

How to Use in IPNetwork Monitor

Example using hpicfUrpfStatsBlockedPackets OID:

Select an HP ProCurve switch as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type hpicfUrpfStatsBlockedPackets into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. The number of packets blocked by URPF on this interface and address family. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter64-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
hpicfUrpfMIB	1.3.6.1.4.1.11.2.14.11.5.1.131			This MIB module describes objects for management of Unicast Reverse Path Forwarding (URPF).
hpicfUrpfConfig	1.3.6.1.4.1.11.2.14.11.5.1.131.1
T/F hpicfUrpfConfigGlobalEnable	1.3.6.1.4.1.11.2.14.11.5.1.131.1.1	TruthValue	read-write	Is the URPF feature enabled. true(1) - URPF is enabled; false(2) URPF is disabled.
I32 hpicfUrpfConfigGlobalLogTimeout	1.3.6.1.4.1.11.2.14.11.5.1.131.1.2	Integer32	read-write	The time, in seconds, between URPF logging summary messages.
hpicfUrpfConfigTable	1.3.6.1.4.1.11.2.14.11.5.1.131.1.3		not-accessible	The table contains configuration information for URPF processing.
hpicfUrpfConfigEntry	1.3.6.1.4.1.11.2.14.11.5.1.131.1.3.1		not-accessible	Each table entry contains configuration parameters for an interface and address family.
NUM hpicfUrpfIfIndex	1.3.6.1.4.1.11.2.14.11.5.1.131.1.3.1.1	InterfaceIndex	not-accessible	The interface for the table entry.
IPt hpicfUrpfAddrFamily	1.3.6.1.4.1.11.2.14.11.5.1.131.1.3.1.2	InetAddressType	not-accessible	The address family for the table entry.
INT hpicfUrpfConfigMode	1.3.6.1.4.1.11.2.14.11.5.1.131.1.3.1.3	INTEGER	read-write	The URPF match mode. URPF operates in one of two modes: strict and loose. In strict mode, a route to the source address must exist, and the ingress interface of the packet must be the same interface used to egress packets back to the source. For example, the ingress and egress routes are symmetric and must use the same interface. In loose mode, a route to the source address must exist, but the ingress interface of the packet is not checked. none(1) - URPF not applied to the interface; strict(2) - must match expected interface; loose(3) - ingress interface is not checked.
T/F hpicfUrpfConfigDefRoute	1.3.6.1.4.1.11.2.14.11.5.1.131.1.3.1.4	TruthValue	read-write	Allow use of the default route when checking the ingress port. Enabling use of the default route is only supported in strict mode. If use of the default route was enabled in loose mode, all packets would be allowed, therefore this option is not supported in loose mode. true(1) - enable use of default route in port match; false(2) - disable use of default route in port match.
T/F hpicfUrpfConfigAllowDhcp	1.3.6.1.4.1.11.2.14.11.5.1.131.1.3.1.5	TruthValue	read-write	Allow packets with SA=0.0.0.0 and DA=255.255.255.255, such as DHCP and BOOTP, to bypass the URPF checks. true(1) - packets will bypass URPF checks; false(2) packets will be dropped.
T/F hpicfUrpfConfigLogging	1.3.6.1.4.1.11.2.14.11.5.1.131.1.3.1.6	TruthValue	read-write	Is logging of dropped packets enabled. true(1) - logging enabled; false(2) - logging disabled.
T/F hpicfUrpfConfigHasWhitelistAcl	1.3.6.1.4.1.11.2.14.11.5.1.131.1.3.1.7	TruthValue	read-write	Is a whitelist ACL applied to this interface. true(1) - whitelist ACL applied; false(2) - whitelist ACL not applied.
STR hpicfUrpfConfigWhitelistAclName	1.3.6.1.4.1.11.2.14.11.5.1.131.1.3.1.8	SnmpAdminString	read-write	The URPF whitelist ACL name. The ACL must already exist at the time of application.
hpicfUrpfStats	1.3.6.1.4.1.11.2.14.11.5.1.131.2
hpicfUrpfStatsTable	1.3.6.1.4.1.11.2.14.11.5.1.131.2.1		not-accessible	The table containing statistics information for packets that are dropped by URPF processing.
hpicfUrpfStatsEntry	1.3.6.1.4.1.11.2.14.11.5.1.131.2.1.1		not-accessible	Each table entry counts packets that are dropped by URPF processing on a particular interface and IP address family.
C64 hpicfUrpfStatsBlockedPacketsEx	1.3.6.1.4.1.11.2.14.11.5.1.131.2.1.1.1	Counter64	read-only	The number of packets blocked by URPF on this interface and address family.
C64 hpicfUrpfStatsBlockedOctets	1.3.6.1.4.1.11.2.14.11.5.1.131.2.1.1.2	Counter64	read-only	The number of octets blocked by URPF on this interface and address family.
hpicfUrpfConformance	1.3.6.1.4.1.11.2.14.11.5.1.131.3
hpicfUrpfMIBGroups	1.3.6.1.4.1.11.2.14.11.5.1.131.3.1
hpicfUrpfScalarGroup	1.3.6.1.4.1.11.2.14.11.5.1.131.3.1.1			A collection of scalar objects providing global configuration information for URPF.
hpicfUrpfConfigTableGroup	1.3.6.1.4.1.11.2.14.11.5.1.131.3.1.2			A collection of objects providing configuration information for URPF.
hpicfUrpfStatsTableGroup	1.3.6.1.4.1.11.2.14.11.5.1.131.3.1.3			A collection of objects providing statistics for URPF.
hpicfUrpfMIBCompliances	1.3.6.1.4.1.11.2.14.11.5.1.131.3.2
hpicfUrpfMIBCompliance	1.3.6.1.4.1.11.2.14.11.5.1.131.3.2.1			The compliance statement for HP switches implementing the HPICF-URPF MIB.

RFC description

HP ICF SNMP MIB for Unicast Reverse Path Forwarding (uRPF) configuration to prevent IP source spoofing on HP ProCurve Layer 3 switches.

Start monitoring HP ProCurve switches with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download HP-ICF-URPF-MIB