MY-ACL-MIB

All MIBs › MY-ACL-MIB

Organization: D-Link Crop.

Last Updated: 2002-03-20

Category: Security

Description: Manages D-Link switch access control list rule configuration and packet filtering.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is MY-ACL-MIB?

MY-ACL-MIB is a D-Link enterprise MIB for configuring and inspecting Access Control List (ACL) rules on D-Link switches, controlling which traffic is permitted or filtered at Layer 2/3. It exposes a table of named ACLs (myAclTable) along with their mode and entry status, plus per-rule Access Control Entries (the myAce* table) matching on VLAN ID and source IP, among other filter criteria. This is primarily a configuration-oriented MIB, but it does support monitoring the software status of the filtering feature — whether a given ACL is active (myAclEntryStatus) and which mode it's applying — useful for confirming security policy is correctly and currently enforced. It includes a MIB conformance/compliance section (myAclMIBConformance, myAclMIBCompliances) defining which objects are mandatory for compliant agent implementations. It is typically deployed in enterprise or campus network environments where D-Link switches provide port- or VLAN-based traffic filtering for security or QoS purposes. Engineers can download the MY-ACL-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in MY-ACL-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

D-Link managed switch

Monitoring Examples

An admin would poll myAclTable/myAclEntry to enumerate configured ACLs by myAclName, check myAclMode and myAclEntryStatus to confirm a given ACL is active rather than disabled or pending, then drill into the ACE-level table (myAceTable/myAceEntry, indexed by myAceAclName and myAceIndex) to verify rule details like myAceVID or myAceIfAnySourceIp match the intended filtering policy. Finding an ACL with myAclEntryStatus not active when it should be enforcing security would reveal a misconfiguration letting unintended traffic through.

What Can Be Monitored

ACL name and mode
ACL entry/active status
ACE rule VLAN ID match
ACE rule source IP match
number of configured ACLs and rules

Imported Objects

From MY-SMI

myMgmt

OBJECT-IDENTITY

From MY-TC

ConfigStatus
IfIndex

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Integer32
IpAddress
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DisplayString
MacAddress
RowStatus
TruthValue

OIDs

OID symbolic	OID numeric	Type	Access	Description
STR myAceExtAclName	1.3.6.1.4.1.171.10.97.2.17.1.4.1.1	DisplayString	read-only	Access list name of this ace belong to. When this string be used as an index,Value of a sub-identifier equal ASCII value of corresponding character(first sub-identifier corresponds first character of string). The number of sub-identifiers of this string must be 32,If length of string is less than 32 the sub-identifier(0x0) will be filled in tail.
I32 myAceExtCos	1.3.6.1.4.1.171.10.97.2.17.1.4.1.33	Integer32	read-write	Cos of Ace flow definition.
IP myAceExtDestIp	1.3.6.1.4.1.171.10.97.2.17.1.4.1.12	IpAddress	read-write	Destination ip address of Ace flow definition.
OCT myAceExtDestIp6	1.3.6.1.4.1.171.10.97.2.17.1.4.1.49	OCTET STRING	read-write	Dest ipv6 address of Ace flow definition.
OCT myAceExtDestIp6WildCard	1.3.6.1.4.1.171.10.97.2.17.1.4.1.51	OCTET STRING	read-write	Dest ipv6 address wild card(in reverse ip address mask)of Ace flow definition.
IP myAceExtDestIpWildCard	1.3.6.1.4.1.171.10.97.2.17.1.4.1.14	IpAddress	read-write	Destination ip wild card(in reverse ip address mask) of Ace flow definition.
MAC myAceExtDestMacAddr	1.3.6.1.4.1.171.10.97.2.17.1.4.1.16	MacAddress	read-write	Destination Mac address of Ace flow definition.
MAC myAceExtDestMacAddrWildCard	1.3.6.1.4.1.171.10.97.2.17.1.4.1.43	MacAddress	read-write	Dest Mac address wildcard of Ace flow definition.
INT myAceExtDestPortOp	1.3.6.1.4.1.171.10.97.2.17.1.4.1.30	INTEGER	read-write	noOperator(1), which is the default value, means that no comparison is to be made with the Dest TCP/UDP port number. lt(2) means less than. gt(3) means greater than. eq(4) means equal. neq(5) means not equal.
I32 myAceExtDestProtocolPort	1.3.6.1.4.1.171.10.97.2.17.1.4.1.22	Integer32	read-write	The value of destination protocol port in IP packet of Ace flow definition. It is significative only to those protocol which support this field(tcp,udp).
I32 myAceExtDestProtocolPortRange	1.3.6.1.4.1.171.10.97.2.17.1.4.1.31	Integer32	read-write	The ending value of dest protocol port in IP packet of Ace flow definition. It is significative only to those protocol which support this field. The myAceExtSourcePortOp must set to range(6).
I32 myAceExtDscp	1.3.6.1.4.1.171.10.97.2.17.1.4.1.37	Integer32	read-write	Dscp of Ace flow definition.
myAceExtEntry	1.3.6.1.4.1.171.10.97.2.17.1.4.1		not-accessible	Entry contains ace parameters and results. A management station wishing to create an entry should first generate a pseudo-random serial number to be used as the index to a ace entry of a acl. The station should then create the associated entry. We must set all specifies valid values for the non-defaulted configuration objects, certainly, it should also modify the default values for the other configuration objects if the defaults are not appropriate. Once the appropriate instance of all the configuration objects have been created or set,the row status should be set to active to initiate the request.
ROW myAceExtEntryStauts	1.3.6.1.4.1.171.10.97.2.17.1.4.1.26	RowStatus	read-create	entry status for this list.
I32 myAceExtEtherLikeType	1.3.6.1.4.1.171.10.97.2.17.1.4.1.18	Integer32	read-write	Ether Like Type in MAC packet of Ace flow definition.
INT myAceExtFlowAction	1.3.6.1.4.1.171.10.97.2.17.1.4.1.25	INTEGER	read-write	Permit indicate that the kind of flow which entry define will be allow to access , deny indicate that the kind of flow which entry define will be refuse to access
T/F myAceExtIfAnyCos	1.3.6.1.4.1.171.10.97.2.17.1.4.1.32	TruthValue	read-write	Cos will not be checked if this value is true.
T/F myAceExtIfAnyDestIp	1.3.6.1.4.1.171.10.97.2.17.1.4.1.11	TruthValue	read-write	Destination Ip wild card of class will not be checked if this value is true.
T/F myAceExtIfAnyDestIp6	1.3.6.1.4.1.171.10.97.2.17.1.4.1.48	TruthValue	read-write	Dest Ipv6 address of class will not be checked if this value is true.
T/F myAceExtIfAnyDestIp6WildCard	1.3.6.1.4.1.171.10.97.2.17.1.4.1.50	TruthValue	read-write	Dest Ipv6 address wild card of class will not be checked if this value is true.
T/F myAceExtIfAnyDestMacAddr	1.3.6.1.4.1.171.10.97.2.17.1.4.1.15	TruthValue	read-write	Source Ip wild card of class will not be checked if this value is true.
T/F myAceExtIfAnyDestMacAddrWildCard	1.3.6.1.4.1.171.10.97.2.17.1.4.1.42	TruthValue	read-write	Dest mac address wildcard of class will not be checked if this value is true.
T/F myAceExtIfAnyDestWildCard	1.3.6.1.4.1.171.10.97.2.17.1.4.1.13	TruthValue	read-write	Source Ip wild card of class will not be checked if this value is true.
T/F myAceExtIfAnyDscp	1.3.6.1.4.1.171.10.97.2.17.1.4.1.36	TruthValue	read-write	Dscp will not be checked if this value is true.
T/F myAceExtIfAnyEtherLikeType	1.3.6.1.4.1.171.10.97.2.17.1.4.1.17	TruthValue	read-write	Ether Like Type in MAC packet will not be checked if this value is true.
T/F myAceExtIfAnyIpPrec	1.3.6.1.4.1.171.10.97.2.17.1.4.1.34	TruthValue	read-write	Ip precedence will not be checked if this value is true.
T/F myAceExtIfAnyIpProtocolField	1.3.6.1.4.1.171.10.97.2.17.1.4.1.19	TruthValue	read-write	Source Ip wild card of class will not be checked if this value is true.
T/F myAceExtIfAnyProtocolType	1.3.6.1.4.1.171.10.97.2.17.1.4.1.23	TruthValue	read-write	The value of protocol type field in IP packet will not be checked if this value is true.
T/F myAceExtIfAnySourceIp	1.3.6.1.4.1.171.10.97.2.17.1.4.1.5	TruthValue	read-write	Source Ip of class will not be checked if this value is true.
T/F myAceExtIfAnySourceIp6	1.3.6.1.4.1.171.10.97.2.17.1.4.1.44	TruthValue	read-write	Source Ipv6 address of class will not be checked if this value is true.
T/F myAceExtIfAnySourceIp6WildCard	1.3.6.1.4.1.171.10.97.2.17.1.4.1.46	TruthValue	read-write	Source Ipv6 address wild card of class will not be checked if this value is true.
T/F myAceExtIfAnySourceMacAddr	1.3.6.1.4.1.171.10.97.2.17.1.4.1.9	TruthValue	read-write	Source mac address of class will not be checked if this value is true.
T/F myAceExtIfAnySourceMacAddrWildCard	1.3.6.1.4.1.171.10.97.2.17.1.4.1.40	TruthValue	read-write	Source mac address wildcard of class will not be checked if this value is true.
T/F myAceExtIfAnySourceWildCard	1.3.6.1.4.1.171.10.97.2.17.1.4.1.7	TruthValue	read-write	Source Ip wild card of class will not be checked if this value is true.
T/F myAceExtIfAnyTcpFlag	1.3.6.1.4.1.171.10.97.2.17.1.4.1.38	TruthValue	read-write	Tcp flag will not be checked if this value is true.
T/F myAceExtIfAnyVID	1.3.6.1.4.1.171.10.97.2.17.1.4.1.3	TruthValue	read-write	VID of class will not be checked if this value is true.
I32 myAceExtIndex	1.3.6.1.4.1.171.10.97.2.17.1.4.1.2	Integer32	read-only	Object which specifies a unique entry in the myAclTable. A management station wishing to initiate a acl operation should use a pseudo-random value for this object when creating or modifying an instance of a myAclEntry. The RowStatus semantics of the myAclEntryStatus object will prevent access conflicts.
I32 myAceExtIpPrec	1.3.6.1.4.1.171.10.97.2.17.1.4.1.35	Integer32	read-write	Ip precedence of Ace flow definition.
I32 myAceExtIpProtocolField	1.3.6.1.4.1.171.10.97.2.17.1.4.1.20	Integer32	read-write	The value of protocol field in IP packet of Ace flow definition.
I32 myAceExtProtocolType	1.3.6.1.4.1.171.10.97.2.17.1.4.1.24	Integer32	read-write	The value of protocol type field in IP packet of Ace flow definition. It is significative only to those protocol which support this field(icmp,igmp).
IP myAceExtSourceIp	1.3.6.1.4.1.171.10.97.2.17.1.4.1.6	IpAddress	read-write	Sourece ip address of Ace flow definition.
OCT myAceExtSourceIp6	1.3.6.1.4.1.171.10.97.2.17.1.4.1.45	OCTET STRING	read-write	Sourece ipv6 address of Ace flow definition.
OCT myAceExtSourceIp6WildCard	1.3.6.1.4.1.171.10.97.2.17.1.4.1.47	OCTET STRING	read-write	Sourece ipv6 address wild card(in reverse ip address mask)of Ace flow definition.
MAC myAceExtSourceMacAddr	1.3.6.1.4.1.171.10.97.2.17.1.4.1.10	MacAddress	read-write	Sourece Mac address of Ace flow definition.
MAC myAceExtSourceMacAddrWildCard	1.3.6.1.4.1.171.10.97.2.17.1.4.1.41	MacAddress	read-write	Sourece Mac address wildcard of Ace flow definition.
INT myAceExtSourcePortOp	1.3.6.1.4.1.171.10.97.2.17.1.4.1.28	INTEGER	read-write	noOperator(1), which is the default value, means that no comparison is to be made with the Source TCP/UDP port number. lt(2) means less than. gt(3) means greater than. eq(4) means equal. neq(5) means not equal.
I32 myAceExtSourceProtocolPort	1.3.6.1.4.1.171.10.97.2.17.1.4.1.21	Integer32	read-write	The value of source protocol port in IP packet of Ace flow definition. It is significative only to those protocol which support this field.
I32 myAceExtSourceProtocolPortRange	1.3.6.1.4.1.171.10.97.2.17.1.4.1.29	Integer32	read-write	The ending value of source protocol port in IP packet of Ace flow definition. It is significative only to those protocol which support this field. The myAceExtSourcePortOp must set to range(6).
IP myAceExtSourceWildCard	1.3.6.1.4.1.171.10.97.2.17.1.4.1.8	IpAddress	read-write	Sourece ip wild card(in reverse ip address mask)of Ace flow definition.
myAceExtTable	1.3.6.1.4.1.171.10.97.2.17.1.4		not-accessible	A table of ACE request entries.
I32 myAceExtTcpFlag	1.3.6.1.4.1.171.10.97.2.17.1.4.1.39	Integer32	read-write	Tcp flag of Ace flow definition.
STR myAceExtTimeRangeName	1.3.6.1.4.1.171.10.97.2.17.1.4.1.27	DisplayString	read-write	Name of time-range of this ACE match. It indicate that this ACE doesn't match any time-range if this string is null
U32 myAceExtVID	1.3.6.1.4.1.171.10.97.2.17.1.4.1.4	Unsigned32	read-write	VID of Ace flow definition.
myAclEntry	1.3.6.1.4.1.171.10.97.2.17.1.1.1		not-accessible	Entry contains acl name and mode.
CON myAclEntryStatus	1.3.6.1.4.1.171.10.97.2.17.1.1.1.3	ConfigStatus	read-create	Status of this entry, set its value to invalid will delete this entry. set its value to valid has no effect.
I32 myAclIfCurruntEntryNum	1.3.6.1.4.1.171.10.97.2.17.1.3.1.3	Integer32	read-only	Currunt valid num of ACL entry(ACE) in a interface.
myAclIfEntry	1.3.6.1.4.1.171.10.97.2.17.1.3.1		not-accessible	Entry ACL interface information.
IFI myAclIfIndex	1.3.6.1.4.1.171.10.97.2.17.1.3.1.1	IfIndex	read-only
I32 myAclIfMaxEntryNum	1.3.6.1.4.1.171.10.97.2.17.1.3.1.2	Integer32	read-only	Max num of ACL entry(ACE) in a interface.
myAclIfTable	1.3.6.1.4.1.171.10.97.2.17.1.3		not-accessible	list of ACL interface objects.
myAclMIB	1.3.6.1.4.1.171.10.97.2.17			This module defines my acl mibs.
myAclMIBCompliance	1.3.6.1.4.1.171.10.97.2.17.2.1.1			The compliance statement for entities which implement the My Acl MIB
myAclMIBCompliances	1.3.6.1.4.1.171.10.97.2.17.2.1
myAclMIBConformance	1.3.6.1.4.1.171.10.97.2.17.2
myAclMIBGroup	1.3.6.1.4.1.171.10.97.2.17.2.2.1			A collection of objects providing acl (echo) ability to a My agent.
myAclMIBGroups	1.3.6.1.4.1.171.10.97.2.17.2.2
myAclMIBObjects	1.3.6.1.4.1.171.10.97.2.17.1
INT myAclMode	1.3.6.1.4.1.171.10.97.2.17.1.1.1.2	INTEGER	read-create	Config mode of this ACL
STR myAclName	1.3.6.1.4.1.171.10.97.2.17.1.1.1.1	DisplayString	read-only	Access list name of this entry.This value is unique for every entry When this string be used as an index,Value of a sub-identifier equal ASCII value of corresponding character(first sub-identifier corresponds first character of string). The number of sub-identifiers of this string must be 32,If length of string is less than 32 the sub-identifier(0x0) will be filled in tail.
myAclTable	1.3.6.1.4.1.171.10.97.2.17.1.1		not-accessible	A table of acl request entries.
STR myIfInAclName	1.3.6.1.4.1.171.10.97.2.17.1.3.1.4	DisplayString	read-write	Access list name of ACL of this interface match for input. It indicate that this interface doesn't match any ACL for input if this string is null
STR myIfOutAclName	1.3.6.1.4.1.171.10.97.2.17.1.3.1.5	DisplayString	read-write	Access list name of ACL of this interface match for output. It indicate that this interface doesn't match any ACL for output if this string is null This relation function apply only L3 interface.

RFC description

D-Link proprietary access control list (ACL) management MIB for network security policy configuration.

Start monitoring D-Link managed switch (Access Control List rules) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download MY-ACL-MIB

What Is MY-ACL-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description