HPN-ICF-FC-PSM-MIB

All MIBs › HPN-ICF-FC-PSM-MIB

Last Updated: 2013-10-17

Category: Fibre Channel and Storage, Vendor: H3C/HH3C, Vendor: HP/HPE

Description: Manages Fibre Channel port security (PSM) policies to control fabric access on HP/Comware SAN switches.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is HPN-ICF-FC-PSM-MIB?

HPN-ICF-FC-PSM-MIB manages Fibre Channel Port Security (PSM) policies on HP Networking (H3C Comware-based) SAN switches, controlling which devices are permitted to log into specific fabric ports based on WWN or other identity criteria, to prevent unauthorized devices from joining the fabric. It exposes per-VSAN port-security enable state (hpnicfFcPsmEnableTable/hpnicfFcPsmEnableState) and per-port security configuration (hpnicfFcPsmConfigTable) defining allowed login device type, device identity, and login point, plus notification controls (hpnicfFcPsmNotifyEnable). Its monitoring focus is verifying the software/security-policy status of the SAN fabric: confirming port security is actually enabled where required by policy, and reviewing configured allowed-device lists to catch drift or unauthorized entries that could let a rogue initiator or target join the fabric. It implements a vendor-specific take on the standard FC-SP fabric security concepts without a direct IETF MIB dependency. It is deployed on HP Networking Fibre Channel SAN switches in enterprise storage environments with strict access control requirements. Network engineers evaluating or troubleshooting this functionality can download the HPN-ICF-FC-PSM-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in HPN-ICF-FC-PSM-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

HP Networking Fibre Channel SAN switch

Monitoring Examples

A SAN security audit would walk hpnicfFcPsmEnableTable across all VSANs to confirm hpnicfFcPsmEnableState shows security enabled everywhere required, then check hpnicfFcPsmConfigTable's hpnicfFcPsmLoginDev/hpnicfFcPsmLoginDevType entries to verify only authorized WWNs are permitted at each hpnicfFcPsmLoginPoint; finding a VSAN with port security disabled would flag a fabric segment exposed to unauthorized device access.

What Can Be Monitored

per-VSAN port security enable state
allowed device WWN/login point configuration
port security notification status

Imported Objects

From HPN-ICF-FC-TC-MIB

HpnicfFcNameIdOrZero

From HPN-ICF-VSAN-MIB

hpnicfSan

MODULE-IDENTITY

From IF-MIB

InterfaceIndex
InterfaceIndexOrZero
ifDescr	OBJECT-TYPE

From SNMPv2-SMI

Counter32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

RowStatus
TEXTUAL-CONVENTION
TimeStamp
TruthValue

How to Use in IPNetwork Monitor

Example using hpnicfFcPsmAllowedLogins OID:

Select an HP Networking Fibre Channel SAN switch as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type hpnicfFcPsmAllowedLogins into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. The number of requests that have been allowed on the specified VSAN. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
hpnicfFcPsm	1.3.6.1.4.1.11.2.14.11.15.2.127.8			This MIB contains the objects for FC port security.
hpnicfFcPsmNotifications	1.3.6.1.4.1.11.2.14.11.15.2.127.8.0
NTF hpnicfFcPsmFPortDenyNotify	1.3.6.1.4.1.11.2.14.11.15.2.127.8.0.1			Notifies that a FLOGI is denied on an F port of the local device.
NTF hpnicfFcPsmEPortDenyNotify	1.3.6.1.4.1.11.2.14.11.15.2.127.8.0.2			Notifies that a switch is denied on an E port of the local device.
hpnicfFcPsmObjects	1.3.6.1.4.1.11.2.14.11.15.2.127.8.1
hpnicfFcPsmScalarObjects	1.3.6.1.4.1.11.2.14.11.15.2.127.8.1.1
T/F hpnicfFcPsmNotifyEnable	1.3.6.1.4.1.11.2.14.11.15.2.127.8.1.1.1	TruthValue	read-write	Whether to generate the notification or not depends on the object.
hpnicfFcPsmConfiguration	1.3.6.1.4.1.11.2.14.11.15.2.127.8.1.2
hpnicfFcPsmEnableTable	1.3.6.1.4.1.11.2.14.11.15.2.127.8.1.2.1		not-accessible	Enable or disable the port security feature on a specified VSAN.
hpnicfFcPsmEnableEntry	1.3.6.1.4.1.11.2.14.11.15.2.127.8.1.2.1.1		not-accessible	Detailed information about the port security.
U32 hpnicfFcPsmEnableVsanIndex	1.3.6.1.4.1.11.2.14.11.15.2.127.8.1.2.1.1.1	Unsigned32	not-accessible	The ID of VSAN on this entry.
INT hpnicfFcPsmEnable	1.3.6.1.4.1.11.2.14.11.15.2.127.8.1.2.1.1.2	INTEGER	read-write	When set to enable, the port security is on, the value of hpnicfFcPsmEnableState will be true. When set to enableWithAutoLearn, the port security is on with auto-learning, the value of hpnicfFcPsmEnableState will be true. When set to disable, the port security is off, the value of hpnicfFcPsmEnableState will be false. The noop means no action. The value of this object when read is always noop.
T/F hpnicfFcPsmEnableState	1.3.6.1.4.1.11.2.14.11.15.2.127.8.1.2.1.1.3	TruthValue	read-only	The state of the port security. When the value is true, it means the port security is on, while the false means the port security is off.
hpnicfFcPsmConfigTable	1.3.6.1.4.1.11.2.14.11.15.2.127.8.1.2.2		not-accessible	A table that contains the configured entries.
hpnicfFcPsmConfigEntry	1.3.6.1.4.1.11.2.14.11.15.2.127.8.1.2.2.1		not-accessible	Detailed information about each configuration.
U32 hpnicfFcPsmIndex	1.3.6.1.4.1.11.2.14.11.15.2.127.8.1.2.2.1.1	Unsigned32	not-accessible	The index of this entry.
HPN hpnicfFcPsmLoginDevType	1.3.6.1.4.1.11.2.14.11.15.2.127.8.1.2.2.1.2	HpnicfFcPsmPortBindDevType	read-create	This represents the type of the instance of hpnicfFcPsmLoginDev, which includes nWWN, pWWN, sWWN, and wildCard.
HPN hpnicfFcPsmLoginDev	1.3.6.1.4.1.11.2.14.11.15.2.127.8.1.2.2.1.3	HpnicfFcNameIdOrZero	read-create	The logging-in device name, which is decided by the hpnicfFcPsmLoginDevType object. It represents node WWN when the value of hpnicfFcPsmLoginDevType is nWWN. It represents port WWN when the value of hpnicfFcPsmLoginDevType is pWWN. It represents switch WWN when the value of hpnicfFcPsmLoginDevType is sWWN. It represents any device when the value of hpnicfFcPsmLoginDevType is wildCard, and the value of the instance of this object should be zero-length string. The value of this object should not be invalid when hpnicfFcPsmRowStatus is set to createAndGo or active.
NUM hpnicfFcPsmLoginPoint	1.3.6.1.4.1.11.2.14.11.15.2.127.8.1.2.2.1.4	InterfaceIndexOrZero	read-create	The address of the port on the local switch through which the instance of hpnicfFcPsmLoginDev can log in. It represents ifindex when the value is not zero. It represents any port when the value is zero.
ROW hpnicfFcPsmRowStatus	1.3.6.1.4.1.11.2.14.11.15.2.127.8.1.2.2.1.5	RowStatus	read-create	Entry status. When creating a new instance of this table, the following objects should be set simultaneously: hpnicfFcPsmLoginDevType, h3cFcPsmLoginDev, hpnicfFcPsmLoginPoint, hpnicfFcPsmRowStatus. If hpnicfFcPsmLoginDevType is set to wildCard, the value of the instance of hpnicfFcPsmLoginDev should be zero-length string. The value of hpnicfFcPsmLoginDevType and hpnicfFcPsmLoginPoint cannot be set to wildCard and zero at the same time.
hpnicfFcPsmEnfTable	1.3.6.1.4.1.11.2.14.11.15.2.127.8.1.2.3		not-accessible	The FC port security enforced table. It contains not only the configured policies, but also the learning ones learnt by the switch itself.
hpnicfFcPsmEnfEntry	1.3.6.1.4.1.11.2.14.11.15.2.127.8.1.2.3.1		not-accessible	Detailed information about the FC port security enforced policy.
U32 hpnicfFcPsmEnfIndex	1.3.6.1.4.1.11.2.14.11.15.2.127.8.1.2.3.1.1	Unsigned32	not-accessible	The index of this entry.
HPN hpnicfFcPsmEnfLoginDevType	1.3.6.1.4.1.11.2.14.11.15.2.127.8.1.2.3.1.2	HpnicfFcPsmPortBindDevType	read-only	This represents the type of the instance of hpnicfFcPsmEnfLoginDev, which includes nWWN, pWWN, sWWN, and wildCard.
HPN hpnicfFcPsmEnfLoginDev	1.3.6.1.4.1.11.2.14.11.15.2.127.8.1.2.3.1.3	HpnicfFcNameIdOrZero	read-only	The logging-in device name, which is decided by the hpnicfFcPsmEnfLoginDevType object. It represents node WWN when the value of hpnicfFcPsmEnfLoginDevType is nWWN. It represents port WWN when the value of hpnicfFcPsmEnfLoginDevType is pWWN. It represents switch WWN when the value of hpnicfFcPsmEnfLoginDevType is sWWN. It represents any device when the value of hpnicfFcPsmEnfLoginDevType is wildCard, and the value of the instance of this object should be zero-length string.
NUM hpnicfFcPsmEnfLoginPoint	1.3.6.1.4.1.11.2.14.11.15.2.127.8.1.2.3.1.4	InterfaceIndexOrZero	read-only	The address of the port on the local switch through which the instance of hpnicfFcPsmEnfLoginDev can log in. It represents ifindex when the value is not zero. It represents any port when the value is zero.
INT hpnicfFcPsmEnfEntryType	1.3.6.1.4.1.11.2.14.11.15.2.127.8.1.2.3.1.5	INTEGER	read-only	When the value is learning, it represents the entry is learnt by the switch itself temporarily and will be deleted when the device log out. When the value is learnt, it represents the entry is learnt by the switch permanently. When the value is static, it represents the entry is configured.
hpnicfFcPsmCopyToConfigTable	1.3.6.1.4.1.11.2.14.11.15.2.127.8.1.2.4		not-accessible	Specifies whether to copy the entries from enforced table to the ones on configured table.
hpnicfFcPsmCopyToConfigEntry	1.3.6.1.4.1.11.2.14.11.15.2.127.8.1.2.4.1		not-accessible	Detailed information about the operation.
INT hpnicfFcPsmCopyToConfig	1.3.6.1.4.1.11.2.14.11.15.2.127.8.1.2.4.1.1	INTEGER	read-write	When the object is set to copy, the learned entries will be copied on to the configured table on this VSAN, while the noop means no operation. The value of this object when read is always noop.
hpnicfFcPsmAutoLearnTable	1.3.6.1.4.1.11.2.14.11.15.2.127.8.1.2.5		not-accessible	This table shows whether the auto-learning is enabled or not on specific VSANs.
hpnicfFcPsmAutoLearnEntry	1.3.6.1.4.1.11.2.14.11.15.2.127.8.1.2.5.1		not-accessible	Detailed information about the auto-learning.
T/F hpnicfFcPsmAutoLearnEnable	1.3.6.1.4.1.11.2.14.11.15.2.127.8.1.2.5.1.1	TruthValue	read-write	This object is set to true to enable, or false to disable auto-learning on the local switch. When set to true, the switch can learn the devices that have already logged in as learning entries on the enforced table, while the false can stop the learning operation with the learning entries transformed to learnt ones.
hpnicfFcPsmClearTable	1.3.6.1.4.1.11.2.14.11.15.2.127.8.1.2.6		not-accessible	This table is used for cleaning specific entries in enforced table.
hpnicfFcPsmClearEntry	1.3.6.1.4.1.11.2.14.11.15.2.127.8.1.2.6.1		not-accessible	Detailed information about the cleaning options.
HPN hpnicfFcPsmClearType	1.3.6.1.4.1.11.2.14.11.15.2.127.8.1.2.6.1.1	HpnicfFcPsmClearEntryType	read-write	This object when set to clearStatic, results in port bind static entries being cleared on this VSAN. This object when set to clearAutoLearn, results in auto-learnt entries being cleared on this VSAN. This object when set to clearAll, results in all of the port bind entries being cleared on this VSAN. No action is taken if this object is set to noop. The value of this object when read is always noop.
NUM hpnicfFcPsmClearIntf	1.3.6.1.4.1.11.2.14.11.15.2.127.8.1.2.6.1.2	InterfaceIndexOrZero	read-write	The object specifies the interface on which the entries will be cleared. If the object is zero or not set, it means the specified entries on all interfaces will be cleared.
hpnicfFcPsmStats	1.3.6.1.4.1.11.2.14.11.15.2.127.8.1.3
hpnicfFcPsmStatsTable	1.3.6.1.4.1.11.2.14.11.15.2.127.8.1.3.1		not-accessible	This table contains statistics of devices, which had been allowed or denied to log into the switch.
hpnicfFcPsmStatsEntry	1.3.6.1.4.1.11.2.14.11.15.2.127.8.1.3.1.1		not-accessible	Detailed information about the statistics.
C32 hpnicfFcPsmAllowedLoginsEx	1.3.6.1.4.1.11.2.14.11.15.2.127.8.1.3.1.1.1	Counter32	read-only	The number of requests that have been allowed on the specified VSAN.
C32 hpnicfFcPsmDeniedLogins	1.3.6.1.4.1.11.2.14.11.15.2.127.8.1.3.1.1.2	Counter32	read-only	The number of requests that have been denied on the specified VSAN.
INT hpnicfFcPsmStatsClear	1.3.6.1.4.1.11.2.14.11.15.2.127.8.1.3.1.1.3	INTEGER	read-write	The statistics on this VSAN will be cleared if this object is set to clear. No action is taken if this object is set to noop. The value of this object when read is always noop.
hpnicfFcPsmViolationTable	1.3.6.1.4.1.11.2.14.11.15.2.127.8.1.3.2		not-accessible	This table maintains the information about the violations happened, containing at most 1024 items. When the number exceeds 1024, the earliest item will be over-written.
hpnicfFcPsmViolationEntry	1.3.6.1.4.1.11.2.14.11.15.2.127.8.1.3.2.1		not-accessible	Detailed information about the violation.
U32 hpnicfFcPsmViolationIndex	1.3.6.1.4.1.11.2.14.11.15.2.127.8.1.3.2.1.1	Unsigned32	not-accessible	The index of this entry. The entry is uniquely distinguished by WWN, WWN type and ifindex where the login was denied.
HPN hpnicfFcPsmLoginPWWN	1.3.6.1.4.1.11.2.14.11.15.2.127.8.1.3.2.1.2	HpnicfFcNameIdOrZero	read-only	The pWWN of the device whose FLOGI(Fabric Login) request had been denied. If the device is an n-node, the value of the instance of hpnicfFcPsmLoginSWWN should be zero-length string.
HPN hpnicfFcPsmLoginNWWN	1.3.6.1.4.1.11.2.14.11.15.2.127.8.1.3.2.1.3	HpnicfFcNameIdOrZero	read-only	The nWWN of the device whose FLOGI request had been denied. If the device is an n-node, the value of the instance of hpnicfFcPsmLoginSWWN should be zero-length string.
HPN hpnicfFcPsmLoginSWWN	1.3.6.1.4.1.11.2.14.11.15.2.127.8.1.3.2.1.4	HpnicfFcNameIdOrZero	read-only	The sWWN of the device whose FLOGI request had been denied. If the device is a switch, the values of the instance of hpnicfFcPsmLoginPWWN and hpnicfFcPsmLoginNWWN should be zero-length string.
NUM hpnicfFcPsmLoginIntf	1.3.6.1.4.1.11.2.14.11.15.2.127.8.1.3.2.1.5	InterfaceIndex	read-only	The ifindex of the port where the login was denied.
TIM hpnicfFcPsmLoginTime	1.3.6.1.4.1.11.2.14.11.15.2.127.8.1.3.2.1.6	TimeStamp	read-only	Specifies the value of SysUpTime when the last denied login happened.
C32 hpnicfFcPsmLoginCount	1.3.6.1.4.1.11.2.14.11.15.2.127.8.1.3.2.1.7	Counter32	read-only	The number of times for a certain nWWN/pWWN or sWWN had been denied to log into an interface of the local device.

RFC description

HP Fibre Channel Port Security Management (PSM) MIB for port binding, device authentication, and security policy enforcement.

Start monitoring HP Networking Fibre Channel SAN switches with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download HPN-ICF-FC-PSM-MIB