JUNIPER-SECURE-ACCESS-PORT-MIB

All MIBs › JUNIPER-SECURE-ACCESS-PORT-MIB

Organization: Juniper Networks, Inc.

Last Updated: 2007-05-15

Category: Domain: Security, Technology: Switching/L2, VPN and Security, Vendor: Juniper

Description: Juniper Networks MIB for managing secure access port features including MAC limiting and DHCP snooping on Juniper EX switches.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is JUNIPER-SECURE-ACCESS-PORT-MIB?

JUNIPER-SECURE-ACCESS-PORT-MIB is a Juniper Networks enterprise MIB for configuring and monitoring Layer 2 access-port security features on Juniper EX-series switches, including DHCP Snooping, Dynamic ARP Inspection (DAI), MAC address limiting, IP Source Guard, MAC Source Guard, and Storm Control. It exposes per-VLAN and per-interface tables covering trust state, rate limiting, MAC-limit thresholds and violations, and source-guard enforcement status. Its monitoring value is software/security configuration status at the port level: whether DHCP snooping and DAI are enabled per VLAN, whether an interface is trusted or untrusted, whether a port's learned MAC-address count has exceeded its configured limit, and whether IP source guard is active, all of which reveal misconfigured or attacked access ports. It is a Juniper enterprise-specific Layer 2 security MIB without an explicit dependency on external IETF MIBs, though it complements standard VLAN and bridge MIB data for full topology context. It is deployed on Juniper EX-series switches at the network access layer where DHCP-based address assignment and ARP need protection against spoofing and exhaustion attacks. Engineers can download the JUNIPER-SECURE-ACCESS-PORT-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in JUNIPER-SECURE-ACCESS-PORT-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Juniper Networks EX-series switches

Monitoring Examples

An administrator would poll jnxSecAccessPortVlanTable to check jnxSecAccessVlanDhcpSnoopStatus and jnxSecAccessVlanDAIStatus per VLAN, and jnxSecAccessPortIfTable to check jnxSecAccessIfMacLimit against jnxSecAccessIfMacLimitExceed on each access port. A port reporting jnxSecAccessIfMacLimitExceed set to true would reveal a MAC-flooding attack or an unauthorized hub/switch plugged into that port, while jnxSecAccessdsIfTrustState showing an interface as untrusted with DHCP snooping active confirms the port is properly restricted from acting as a rogue DHCP server. jnxSecAccessIfIpSrcGuardStatus further indicates whether IP Source Guard is actively filtering traffic on that interface.

What Can Be Monitored

DHCP snooping status per VLAN
dynamic ARP inspection (DAI) status
port trust state
MAC address limit and violations
IP source guard status
storm control / rate limiting

Imported Objects

From IF-MIB

ifIndex

OBJECT-TYPE

From JUNIPER-EX-SMI

jnxExSecureAccessPort

OBJECT-IDENTITY

From SNMPv2-SMI

Integer32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DisplayString
TEXTUAL-CONVENTION
TruthValue

OIDs

OID symbolic	OID numeric	Type	Access	Description
jnxExSecureAccessPortMIB	1.3.6.1.4.1.2636.3.40.1.2.1			This is Juniper Networks' implementation of enterprise specific MIB for configuration of Secure Access Port feature. DHCP Snooping and Dynamic ARP Inspection are mechanisms to provide per interface security capabilities. This MIB Module is also used to control some layer 2 functions like MAC limiting. It also supports IP Source Guard, Mac Source Guard and Storm Control features.
jnxSecAccessPortMIBNotifications	1.3.6.1.4.1.2636.3.40.1.2.1.0
NTF jnxSecAccessdsRateLimitCrossed	1.3.6.1.4.1.2636.3.40.1.2.1.0.1			A jnxdsRateLimitCrossed notification is generated when the number of DHCP packets from an untrusted interface exceeds jnxSecAccessdsIfRateLimit.
NTF jnxSecAccessIfMacLimitExceeded	1.3.6.1.4.1.2636.3.40.1.2.1.0.2			Notification is sent when the number of MAC addresses learnt by the interface has crossed the limit of MAC addresses(jnxSecAccessIfMacLimit) and if MAC Limit Exceeded Action(jnxSecAccessIfMacLimitExceed) is drop or alarm or shutdown.
NTF jnxStormEventNotification	1.3.6.1.4.1.2636.3.40.1.2.1.0.3			Notification is sent when the traffic in the interface exceeds rising threshold(jnxStormCtlRisingThreshold).
jnxSecAccessPortMIBObjects	1.3.6.1.4.1.2636.3.40.1.2.1.1
jnxSecAccessPortVlanTable	1.3.6.1.4.1.2636.3.40.1.2.1.1.1		not-accessible	A table provides the mechanism to control DHCP Snooping and Dynamic ARP Inspection per VLAN. When a VLAN is created in a device supporting this table, a corresponding entry will be added to this table.
jnxSecAccessPortVlanEntry	1.3.6.1.4.1.2636.3.40.1.2.1.1.1.1		not-accessible	A row instance contains whether DHCP Snooping and Dynamic ARP Inspection at each existing VLAN is enabled or disabled.
STR jnxSecAccessVlanName	1.3.6.1.4.1.2636.3.40.1.2.1.1.1.1.1	DisplayString	not-accessible	This object indicates the VLAN name on which Dhcp Snooping feature and Dynamic ARP Inspection is enabled.
T/F jnxSecAccessVlanDhcpSnoopStatus	1.3.6.1.4.1.2636.3.40.1.2.1.1.1.1.2	TruthValue	read-only	This object indicates whether Dhcp Snooping is enabled in this VLAN. If this object is 'true', Dhcp Snooping is enabled in the specified VLAN. If this object is 'false', Dhcp Snooping is disabled in the specified VLAN.
T/F jnxSecAccessVlanDAIStatus	1.3.6.1.4.1.2636.3.40.1.2.1.1.1.1.3	TruthValue	read-only	This object indicates whether Dynamic ARP Inspection is enabled in this VLAN. If this object is 'true', Dynamic ARP Inspection is enabled. If this object is 'false', Dynamic ARP Inspection is disabled.
jnxSecAccessPortIfTable	1.3.6.1.4.1.2636.3.40.1.2.1.1.2		not-accessible	The table contains the trust state and rate limit of each interface for DHCP Snooping purpose. The table also contains information on MAC address limit feature for each interface capable of this feature. This table also specifies whether IP source guard and MAC source guard are enabled on each interface.
jnxSecAccessPortIfEntry	1.3.6.1.4.1.2636.3.40.1.2.1.1.2.1		not-accessible	A table entry contains the trust state and rate limit of an interface, MAC address limit for that Interface. It also contains the action to be undertaken if MAC address limit is exceeded. A table entry specifies whether IP source guard and MAC source guard are enabled on the specified interface.
T/F jnxSecAccessdsIfTrustState	1.3.6.1.4.1.2636.3.40.1.2.1.1.2.1.1	TruthValue	read-only	This object indicates whether the interface is trusted for DHCP Snooping purpose. If this object is 'true', the interface is trusted. DHCP packets coming to this interface will be forwarded without checking. If this object is 'false', the interface is not trusted. DHCP packets coming to this interface will be subjected to DHCP checks.
U32 jnxSecAccessdsIfRateLimit	1.3.6.1.4.1.2636.3.40.1.2.1.1.2.1.2	Unsigned32	read-only	This object indicates rate limit value for DHCP Snooping purpose. If the value of this object is 0, no rate limit is applied for DHCP traffic at this interface.
U32 jnxSecAccessIfMacLimit	1.3.6.1.4.1.2636.3.40.1.2.1.1.2.1.3	Unsigned32	read-only	This object specifies the threshold limit for the number of MAC address entries on this interface. When the instance value of this object is set to 0, no threshold limit will be applied for this interfacew and the corresponding instance value of jnxIfMacLimitExceedAction of the same row has no effect.
JNX jnxSecAccessIfMacLimitExceed	1.3.6.1.4.1.2636.3.40.1.2.1.1.2.1.4	JnxMacLimitExceededAction	read-only	This object specifies the action to be taken by the system for this interface while the number of MAC addresses has exceeded the value of jnxIfMacLimit. This object value is only effective when the corresponding instance value of jnxIfMacLimit is not set to 0.
T/F jnxSecAccessIfIpSrcGuardStatus	1.3.6.1.4.1.2636.3.40.1.2.1.1.2.1.5	TruthValue	read-only	This object indicates whether IP Source Guard is enabled on the specified interface. If this object is 'true', then IP Source Guard is enabled on the specified interface. If this object is 'false', then IP Source Guard is disabled on the specified interface.
T/F jnxSecAccessIfMacSrcGuardStatus	1.3.6.1.4.1.2636.3.40.1.2.1.1.2.1.6	TruthValue	read-only	This object indicates whether Mac Source Guard is enabled on the specified interface. If this object is 'true', then Mac Source Guard is enabled on the specified interface. If this object is 'false', then IP Source Guard is disabled on the specified interface.
jnxStormCtlTable	1.3.6.1.4.1.2636.3.40.1.2.1.1.3		not-accessible	Storm control monitors each type of traffic level on an interface. If traffic level exceeds the threshold value(rising threshold), switch will drop all packets of that type until traffic level drops to the threshold level (falling threshold). If traffic rate for a particular type exceeds the rising threshold, action will be taken to shutdown or add configured filter on the port. This table describes the traffic type for each interface, the rising threshold, falling threshold and the action to be taken if the traffic exceeds the rising threshold.
jnxStormCtlEntry	1.3.6.1.4.1.2636.3.40.1.2.1.1.3.1		not-accessible	An entry contains the interface index,traffic type for the interface, the rising threshold, falling threshold and the action to be taken if the traffic exceeds the rising threshold.
INT jnxStormCtlIfTrafficType	1.3.6.1.4.1.2636.3.40.1.2.1.1.3.1.1	INTEGER	not-accessible	This object specifies the traffic type on the particular interface. Value 1 specifies that it is broadcast traffic, value 2 specifies that it is multicast traffic and value 3 specifies that it is unicast traffic.
I32 jnxStormCtlRisingThreshold	1.3.6.1.4.1.2636.3.40.1.2.1.1.3.1.2	Integer32	read-only	This object specifies the rising threshold value in packets per second. The storm control action is occurs when the traffic exceeds this threshold value.
I32 jnxStormCtlFallingThreshold	1.3.6.1.4.1.2636.3.40.1.2.1.1.3.1.3	Integer32	read-only	This object specifies the falling threshold value in packets per second. The storm control action ceases when the traffic drops to this threshold value.
INT jnxStormCtlAction	1.3.6.1.4.1.2636.3.40.1.2.1.1.3.1.4	INTEGER	read-only	This object specifies the action to be taken, when traffic exceeds rising threshold value. Value 1 specifies that the action taken is to shutdown the port. Value 2 specifies that the action taken is to apply a policy filter on the interface for the given packet type. Default is to shutdown(1) the port.

RFC description

Juniper Networks MIB module for managing secure access port functionality on EX, QFX, and QFabric switches, providing control over port security features such as MAC limiting, DHCP snooping, and dynamic ARP inspection.

Start monitoring Juniper Networks EX-series switch (Secure Access Port: DHCP snooping/DAI/storm control) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download JUNIPER-SECURE-ACCESS-PORT-MIB

What Is JUNIPER-SECURE-ACCESS-PORT-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description