PDN-SECURITY-MIB

All MIBs › PDN-SECURITY-MIB

Category: RADIUS/AAA, Security

Description:

Defines security policy configuration including access control, authentication method selection, and management-plane protection on Paradyne devices.

Imported Objects

From PDN-HEADER-MIB

pdn-security

From RFC-1212

OBJECT-TYPE

From RFC1155-SMI

IpAddress

From SNMPv2-TC

RowStatus

What Is PDN-SECURITY-MIB?

PDN-SECURITY-MIB is a Paradyne (PDN) enterprise MIB defining security policy configuration for Paradyne access/transport devices, covering access control lists, authentication method selection, and protection of the management plane. It exposes tables of authorized manager IP addresses and their access levels (devSecurityMgrTable and its newer replacement newSecurityMgrTable), along with counts of configured and maximum allowed manager entries. This is a configuration/security-status MIB rather than a hardware-health one: it lets an operator audit which management stations are permitted to reach the device and at what access level, and confirm the device isn't over its manager-entry limit. It appears self-contained with no stated dependency on external standard MIBs. It is typically used on Paradyne DSL/access multiplexer equipment to lock down which NMS hosts may manage the device. Engineers can download the PDN-SECURITY-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in PDN-SECURITY-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

What Can Be Monitored

configured manager count vs maximum
manager IP address entries
manager access level (read/write)
manager subnet mask scope
manager validation enforcement state

Supported Devices

Paradyne DSL access multiplexer
Paradyne network access device

Monitoring Examples

An administrator would poll devSecurityMgrCurrentNumber against devSecurityMgrMaxNumber to confirm the manager table isn't full, and enumerate newSecurityMgrTable entries (newSecurityMgrIpAddress, newSecurityMgrSubnetMask, newSecurityMgrAccess) to verify only expected NMS subnets have read/write access. An unexpected entry in newSecurityMgrTable with write access would indicate an unauthorized management station has been added, a security concern worth alerting on. devSecurityMgrValidation indicates whether manager-address validation enforcement is currently active.

OIDs

OID symbolic	OID numeric	Type	Access	Description
INT devSecurityFtpSourceValidation	1.3.6.1.4.1.1795.2.24.2.8.7	INTEGER	read-write	This object is used to either enable or disable ftp source address screening
INT devSecurityMgrAccess	1.3.6.1.4.1.1795.2.24.2.8.4.1.2	INTEGER	read-write	This field is used to specify the access allowed for an authorized NMS when Manager Validation is performed. If the IP address for the NMS sending an SNMP message is on the list of allowed managers, this option along with the Community Name access determine the type of access allowed for the that manager. When ever a new Security Manager is added or an existing Security Manager's IP Address is modified, the devSecurityMgrAccess object is set to the default value of read (1). If the index for this object is not in the existing table and if there is room in the table then the index will be used to create a new Security Manager and will be given the requested access level.
INT devSecurityMgrCurrentNumber	1.3.6.1.4.1.1795.2.24.2.8.3	INTEGER	read-only	Current number of managers in the devSecurityMgrTable.
devSecurityMgrEntry	1.3.6.1.4.1.1795.2.24.2.8.4.1		not-accessible	The SNMP IP Address configuration items.
IP devSecurityMgrIpAddress	1.3.6.1.4.1.1795.2.24.2.8.4.1.1	IpAddress	read-write	This is used to specify the IP address that identifies the SNMP manager(s) that are authorized to send SNMP messages. An existing Security Manager may be deleted by setting the devSecurityMgrIpAddress object to 0.0.0.0 or by setting the devSecurityMgrIpAddress object to a new IP Address. A new Security Manager may be added by setting the devSecurityMgrIpAddress object of 0.0.0.0 to the new address as long as there is still room for another Security Manager. When ever a new Security Manager is added or an existing Security Manager's IP Address is modified, the devSecurityMgrAccess object is set to the default value of read (1).
INT devSecurityMgrMaxNumber	1.3.6.1.4.1.1795.2.24.2.8.2	INTEGER	read-only	Maximum number of managers allowed in the devSecurityMgrTable.
devSecurityMgrTable	1.3.6.1.4.1.1795.2.24.2.8.4		not-accessible	A list of the security manager entries. In order to add a new Security Manager the devSecurityMgrIpAddress object must be created first by setting it to a valid IP Address.
INT devSecurityMgrValidation	1.3.6.1.4.1.1795.2.24.2.8.1	INTEGER	read-write	This object is used to either enable or disable SNMP IP validation. When enabled the first check on any incoming PDU is based on the IP address of the datagram. If the IP address is configured in the devSecurityMgrTable then the community name is checked. If the community name is correct then the lowest access level between the the Table and the community name is taken.
INT devSecurityTelnetSourceValidation	1.3.6.1.4.1.1795.2.24.2.8.6	INTEGER	read-write	This object is used to either enable or disable telnet source address screening
INT newSecurityMgrAccess	1.3.6.1.4.1.1795.2.24.2.8.5.1.2	INTEGER	read-write	This field is used to specify the access allowed for an authorized NMS when Manager Validation is performed. If the IP address for the NMS sending an SNMP message is on the list of allowed managers, this option along with the Community Name access determine the type of access allowed for the that manager. When ever a new Security Manager is added or an existing Security Manager's IP Address is modified, the newSecurityMgrAccess object is set to the default value of read (1). If the index for this object is not in the existing table and if there is room in the table then the index will be used to create a new Security Manager and will be given the requested access level. In addition changing an existing access permission to noAccess invalidates the corresponding row of this table. It is upto the implementation to decide whether to actually remove this entry from the table or not. read (1) ==> no telnet access and snmp read only access readWrite (2) ==> no telnet access and snmp read-write access noAccess (3) ==> no telnet access and no snmp read-write access telnetNoAccess (4) ==> telnet access and no snmp access telnetRead (5) ==> telnet access and snmp read only access telnetReadWrite (6) ==> telnet access and snmp read-write access.
newSecurityMgrEntry	1.3.6.1.4.1.1795.2.24.2.8.5.1		not-accessible	The SNMP IP Address configuration items.
IP newSecurityMgrIpAddress	1.3.6.1.4.1.1795.2.24.2.8.5.1.1	IpAddress	read-write	This is used to specify the IP address that identifies the SNMP manager(s) that are authorized to send SNMP messages. This object is the binary AND of SNMP or telnet source IP address and its subnet mask if the subnet mask is available. Subnet mask is assumed to be 255.255.255.255 when not available
IP newSecurityMgrSubnetMask	1.3.6.1.4.1.1795.2.24.2.8.5.1.3	IpAddress	read-write	This object is used to specify the subnet mask
newSecurityMgrTable	1.3.6.1.4.1.1795.2.24.2.8.5		not-accessible	A list of the security manager entries. If an entry is not found in this table, it is added to the table.
securityMgrEntry	1.3.6.1.4.1.1795.2.24.2.8.8.1		not-accessible	The device access security configuration items.
INT securityMgrFtpAccess	1.3.6.1.4.1.1795.2.24.2.8.8.1.5	INTEGER	read-write	This is used to specify the ftp access to the device.
IP securityMgrIpAddress	1.3.6.1.4.1.1795.2.24.2.8.8.1.1	IpAddress	read-write	This is used to specify the IP address that identifies the SNMP manager(s) that are authorized to send SNMP messages.
ROW securityMgrRowStatus	1.3.6.1.4.1.1795.2.24.2.8.8.1.6	RowStatus	read-write	The status of this table entry.
INT securityMgrSnmpAccess	1.3.6.1.4.1.1795.2.24.2.8.8.1.3	INTEGER	read-write	This is used to specify the snmp access to the device.
IP securityMgrSubnetMask	1.3.6.1.4.1.1795.2.24.2.8.8.1.2	IpAddress	read-write	This object is used to specify the subnet mask
securityMgrTable	1.3.6.1.4.1.1795.2.24.2.8.8		not-accessible	A list of the security manager entries. If an entry is not found in this table, it is added to the table.
INT securityMgrTelnetAccess	1.3.6.1.4.1.1795.2.24.2.8.8.1.4	INTEGER	read-write	This is used to specify the telnet access to the device.

OID symbolic	OID numeric	Type	Access	Description
INT devSecurityMgrValidation	1.3.6.1.4.1.1795.2.24.2.8.1	INTEGER	read-write	This object is used to either enable or disable SNMP IP validation. When enabled the first check on any incoming PDU is based on the IP address of the datagram. If the IP address is configured in the devSecurityMgrTable then the community name is checked. If the community name is correct then the lowest access level between the the Table and the community name is taken.
INT devSecurityMgrMaxNumber	1.3.6.1.4.1.1795.2.24.2.8.2	INTEGER	read-only	Maximum number of managers allowed in the devSecurityMgrTable.
INT devSecurityMgrCurrentNumber	1.3.6.1.4.1.1795.2.24.2.8.3	INTEGER	read-only	Current number of managers in the devSecurityMgrTable.
devSecurityMgrTable	1.3.6.1.4.1.1795.2.24.2.8.4		not-accessible	A list of the security manager entries. In order to add a new Security Manager the devSecurityMgrIpAddress object must be created first by setting it to a valid IP Address.
devSecurityMgrEntry	1.3.6.1.4.1.1795.2.24.2.8.4.1		not-accessible	The SNMP IP Address configuration items.
IP devSecurityMgrIpAddress	1.3.6.1.4.1.1795.2.24.2.8.4.1.1	IpAddress	read-write	This is used to specify the IP address that identifies the SNMP manager(s) that are authorized to send SNMP messages. An existing Security Manager may be deleted by setting the devSecurityMgrIpAddress object to 0.0.0.0 or by setting the devSecurityMgrIpAddress object to a new IP Address. A new Security Manager may be added by setting the devSecurityMgrIpAddress object of 0.0.0.0 to the new address as long as there is still room for another Security Manager. When ever a new Security Manager is added or an existing Security Manager's IP Address is modified, the devSecurityMgrAccess object is set to the default value of read (1).
INT devSecurityMgrAccess	1.3.6.1.4.1.1795.2.24.2.8.4.1.2	INTEGER	read-write	This field is used to specify the access allowed for an authorized NMS when Manager Validation is performed. If the IP address for the NMS sending an SNMP message is on the list of allowed managers, this option along with the Community Name access determine the type of access allowed for the that manager. When ever a new Security Manager is added or an existing Security Manager's IP Address is modified, the devSecurityMgrAccess object is set to the default value of read (1). If the index for this object is not in the existing table and if there is room in the table then the index will be used to create a new Security Manager and will be given the requested access level.
newSecurityMgrTable	1.3.6.1.4.1.1795.2.24.2.8.5		not-accessible	A list of the security manager entries. If an entry is not found in this table, it is added to the table.
newSecurityMgrEntry	1.3.6.1.4.1.1795.2.24.2.8.5.1		not-accessible	The SNMP IP Address configuration items.
IP newSecurityMgrIpAddress	1.3.6.1.4.1.1795.2.24.2.8.5.1.1	IpAddress	read-write	This is used to specify the IP address that identifies the SNMP manager(s) that are authorized to send SNMP messages. This object is the binary AND of SNMP or telnet source IP address and its subnet mask if the subnet mask is available. Subnet mask is assumed to be 255.255.255.255 when not available
INT newSecurityMgrAccess	1.3.6.1.4.1.1795.2.24.2.8.5.1.2	INTEGER	read-write	This field is used to specify the access allowed for an authorized NMS when Manager Validation is performed. If the IP address for the NMS sending an SNMP message is on the list of allowed managers, this option along with the Community Name access determine the type of access allowed for the that manager. When ever a new Security Manager is added or an existing Security Manager's IP Address is modified, the newSecurityMgrAccess object is set to the default value of read (1). If the index for this object is not in the existing table and if there is room in the table then the index will be used to create a new Security Manager and will be given the requested access level. In addition changing an existing access permission to noAccess invalidates the corresponding row of this table. It is upto the implementation to decide whether to actually remove this entry from the table or not. read (1) ==> no telnet access and snmp read only access readWrite (2) ==> no telnet access and snmp read-write access noAccess (3) ==> no telnet access and no snmp read-write access telnetNoAccess (4) ==> telnet access and no snmp access telnetRead (5) ==> telnet access and snmp read only access telnetReadWrite (6) ==> telnet access and snmp read-write access.
IP newSecurityMgrSubnetMask	1.3.6.1.4.1.1795.2.24.2.8.5.1.3	IpAddress	read-write	This object is used to specify the subnet mask
INT devSecurityTelnetSourceValidation	1.3.6.1.4.1.1795.2.24.2.8.6	INTEGER	read-write	This object is used to either enable or disable telnet source address screening
INT devSecurityFtpSourceValidation	1.3.6.1.4.1.1795.2.24.2.8.7	INTEGER	read-write	This object is used to either enable or disable ftp source address screening
securityMgrTable	1.3.6.1.4.1.1795.2.24.2.8.8		not-accessible	A list of the security manager entries. If an entry is not found in this table, it is added to the table.
securityMgrEntry	1.3.6.1.4.1.1795.2.24.2.8.8.1		not-accessible	The device access security configuration items.
IP securityMgrIpAddress	1.3.6.1.4.1.1795.2.24.2.8.8.1.1	IpAddress	read-write	This is used to specify the IP address that identifies the SNMP manager(s) that are authorized to send SNMP messages.
IP securityMgrSubnetMask	1.3.6.1.4.1.1795.2.24.2.8.8.1.2	IpAddress	read-write	This object is used to specify the subnet mask
INT securityMgrSnmpAccess	1.3.6.1.4.1.1795.2.24.2.8.8.1.3	INTEGER	read-write	This is used to specify the snmp access to the device.
INT securityMgrTelnetAccess	1.3.6.1.4.1.1795.2.24.2.8.8.1.4	INTEGER	read-write	This is used to specify the telnet access to the device.
INT securityMgrFtpAccess	1.3.6.1.4.1.1795.2.24.2.8.8.1.5	INTEGER	read-write	This is used to specify the ftp access to the device.
ROW securityMgrRowStatus	1.3.6.1.4.1.1795.2.24.2.8.8.1.6	RowStatus	read-write	The status of this table entry.

INTEGER (10)
INT devSecurityFtpSourceValidation	1.3.6.1.4.1.1795.2.24.2.8.7	INTEGER	read-write	This object is used to either enable or disable ftp source address screening
INT devSecurityMgrAccess	1.3.6.1.4.1.1795.2.24.2.8.4.1.2	INTEGER	read-write	This field is used to specify the access allowed for an authorized NMS when Manager Validation is performed. If the IP address for the NMS sending an SNMP message is on the list of allowed managers, this option along with the Community Name access determine the type of access allowed for the that manager. When ever a new Security Manager is added or an existing Security Manager's IP Address is modified, the devSecurityMgrAccess object is set to the default value of read (1). If the index for this object is not in the existing table and if there is room in the table then the index will be used to create a new Security Manager and will be given the requested access level.
INT devSecurityMgrCurrentNumber	1.3.6.1.4.1.1795.2.24.2.8.3	INTEGER	read-only	Current number of managers in the devSecurityMgrTable.
INT devSecurityMgrMaxNumber	1.3.6.1.4.1.1795.2.24.2.8.2	INTEGER	read-only	Maximum number of managers allowed in the devSecurityMgrTable.
INT devSecurityMgrValidation	1.3.6.1.4.1.1795.2.24.2.8.1	INTEGER	read-write	This object is used to either enable or disable SNMP IP validation. When enabled the first check on any incoming PDU is based on the IP address of the datagram. If the IP address is configured in the devSecurityMgrTable then the community name is checked. If the community name is correct then the lowest access level between the the Table and the community name is taken.
INT devSecurityTelnetSourceValidation	1.3.6.1.4.1.1795.2.24.2.8.6	INTEGER	read-write	This object is used to either enable or disable telnet source address screening
INT newSecurityMgrAccess	1.3.6.1.4.1.1795.2.24.2.8.5.1.2	INTEGER	read-write	This field is used to specify the access allowed for an authorized NMS when Manager Validation is performed. If the IP address for the NMS sending an SNMP message is on the list of allowed managers, this option along with the Community Name access determine the type of access allowed for the that manager. When ever a new Security Manager is added or an existing Security Manager's IP Address is modified, the newSecurityMgrAccess object is set to the default value of read (1). If the index for this object is not in the existing table and if there is room in the table then the index will be used to create a new Security Manager and will be given the requested access level. In addition changing an existing access permission to noAccess invalidates the corresponding row of this table. It is upto the implementation to decide whether to actually remove this entry from the table or not. read (1) ==> no telnet access and snmp read only access readWrite (2) ==> no telnet access and snmp read-write access noAccess (3) ==> no telnet access and no snmp read-write access telnetNoAccess (4) ==> telnet access and no snmp access telnetRead (5) ==> telnet access and snmp read only access telnetReadWrite (6) ==> telnet access and snmp read-write access.
INT securityMgrFtpAccess	1.3.6.1.4.1.1795.2.24.2.8.8.1.5	INTEGER	read-write	This is used to specify the ftp access to the device.
INT securityMgrSnmpAccess	1.3.6.1.4.1.1795.2.24.2.8.8.1.3	INTEGER	read-write	This is used to specify the snmp access to the device.
INT securityMgrTelnetAccess	1.3.6.1.4.1.1795.2.24.2.8.8.1.4	INTEGER	read-write	This is used to specify the telnet access to the device.
IpAddress (5)
IP devSecurityMgrIpAddress	1.3.6.1.4.1.1795.2.24.2.8.4.1.1	IpAddress	read-write	This is used to specify the IP address that identifies the SNMP manager(s) that are authorized to send SNMP messages. An existing Security Manager may be deleted by setting the devSecurityMgrIpAddress object to 0.0.0.0 or by setting the devSecurityMgrIpAddress object to a new IP Address. A new Security Manager may be added by setting the devSecurityMgrIpAddress object of 0.0.0.0 to the new address as long as there is still room for another Security Manager. When ever a new Security Manager is added or an existing Security Manager's IP Address is modified, the devSecurityMgrAccess object is set to the default value of read (1).
IP newSecurityMgrIpAddress	1.3.6.1.4.1.1795.2.24.2.8.5.1.1	IpAddress	read-write	This is used to specify the IP address that identifies the SNMP manager(s) that are authorized to send SNMP messages. This object is the binary AND of SNMP or telnet source IP address and its subnet mask if the subnet mask is available. Subnet mask is assumed to be 255.255.255.255 when not available
IP newSecurityMgrSubnetMask	1.3.6.1.4.1.1795.2.24.2.8.5.1.3	IpAddress	read-write	This object is used to specify the subnet mask
IP securityMgrIpAddress	1.3.6.1.4.1.1795.2.24.2.8.8.1.1	IpAddress	read-write	This is used to specify the IP address that identifies the SNMP manager(s) that are authorized to send SNMP messages.
IP securityMgrSubnetMask	1.3.6.1.4.1.1795.2.24.2.8.8.1.2	IpAddress	read-write	This object is used to specify the subnet mask
RowStatus (1)
ROW securityMgrRowStatus	1.3.6.1.4.1.1795.2.24.2.8.8.1.6	RowStatus	read-write	The status of this table entry.
No type (6)
devSecurityMgrEntry	1.3.6.1.4.1.1795.2.24.2.8.4.1		not-accessible	The SNMP IP Address configuration items.
devSecurityMgrTable	1.3.6.1.4.1.1795.2.24.2.8.4		not-accessible	A list of the security manager entries. In order to add a new Security Manager the devSecurityMgrIpAddress object must be created first by setting it to a valid IP Address.
newSecurityMgrEntry	1.3.6.1.4.1.1795.2.24.2.8.5.1		not-accessible	The SNMP IP Address configuration items.
newSecurityMgrTable	1.3.6.1.4.1.1795.2.24.2.8.5		not-accessible	A list of the security manager entries. If an entry is not found in this table, it is added to the table.
securityMgrEntry	1.3.6.1.4.1.1795.2.24.2.8.8.1		not-accessible	The device access security configuration items.
securityMgrTable	1.3.6.1.4.1.1795.2.24.2.8.8		not-accessible	A list of the security manager entries. If an entry is not found in this table, it is added to the table.

RFC description

Paradyne (PDN) MIB for managing security-related objects and functions on Paradyne network devices and access equipment.

Start monitoring Paradyne DSL access multiplexer/network access device (management-plane access control) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download PDN-SECURITY-MIB

This MIB depends on

Related MIBs

What Is PDN-SECURITY-MIB?

What Can Be Monitored

Supported Devices

Monitoring Examples

RFC description