RADLAN-BRIDGE-SECURITY

All MIBs › RADLAN-BRIDGE-SECURITY

Last Updated: 2006-04-02

Category: Security, Vendor: RADLAN/Cisco SB

Description: Configures bridge port security including MAC address limits and violation actions.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is RADLAN-BRIDGE-SECURITY?

RADLAN-BRIDGE-SECURITY is a vendor-specific private MIB from RADLAN/Marvell implementing Layer 2 security features on managed Ethernet switches: DHCP Snooping, Dynamic ARP Inspection, and IP Source Guard. It exposes configuration for enabling/disabling these features, static DHCP snooping binding entries, DHCP Option 82 insertion behavior, and current binding table entry counts. Its monitoring role is tracking the operational status and capacity of these anti-spoofing security features — whether snooping/inspection is enabled per interface, how many dynamic bindings are currently tracked, and static override entries — rather than hardware sensor data, functioning as a software/feature-status monitoring MIB. It is a proprietary layer on top of standard bridge/VLAN concepts (IETF BRIDGE-MIB, Q-BRIDGE-MIB) rather than a standards-based module itself. It is typically deployed on RADLAN/Marvell-based access switches in networks that need protection against rogue DHCP servers and ARP spoofing/man-in-the-middle attacks. Engineers can download the RADLAN-BRIDGE-SECURITY file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in RADLAN-BRIDGE-SECURITY. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

RADLAN/Marvell-based managed Ethernet switches

Monitoring Examples

A security-conscious network administrator would poll rlIpDhcpSnoopEnable and rlIpDhcpSnoopCurrentEntiresNumber to confirm DHCP snooping is active and see how many client bindings are currently tracked, cross-referencing rlIpDhcpSnoopStaticTable/rlIpDhcpSnoopStaticEntry for manually configured trusted bindings. If rlIpDhcpSnoopVerifyMacAddress catches a MAC mismatch or the dynamic entry count spikes unexpectedly, that could indicate an attempted DHCP spoofing or ARP poisoning attack being blocked (or needing investigation) on that switch.

What Can Be Monitored

DHCP snooping enable status
DHCP snooping binding table entries
DHCP Option 82 insertion settings
static snooping/source-guard entries
MAC address verification results

Imported Objects

From IF-MIB

InterfaceIndex
ifIndex	OBJECT-TYPE

From Q-BRIDGE-MIB

VlanId

From RADLAN-MIB

rnd	OBJECT-IDENTITY

From SNMPv2-SMI

Counter32
IpAddress
MODULE-IDENTITY
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DisplayString
MacAddress
RowStatus
TEXTUAL-CONVENTION
TruthValue

OIDs

OID symbolic	OID numeric	Type	Access	Description
rlBridgeSecurity	1.3.6.1.4.1.89.112			The private MIB module definition for DHCP Snoop, ARP Inspection and Ip source Guard features.
rlIpArpInspect	1.3.6.1.4.1.89.112.3
RLI rlIpArpInspectAssignedListName	1.3.6.1.4.1.89.112.3.6.1.2	RlIpArpInspectListNameType	read-write	An Ip ARP Inspection assigned ACL name.
T/F rlIpArpInspectClearCountersAction	1.3.6.1.4.1.89.112.3.8	TruthValue	read-write	If true, clear (set to zero) on all vlans: all Arp Inspection counters: rlIpArpInspectVlanNumOfArpForwarded , rlIpArpInspectVlanNumOfArpDropped and rlIpArpInspectVlanNumOfArpMismatched
INT rlIpArpInspectEnable	1.3.6.1.4.1.89.112.3.2	INTEGER	read-write	Specifies a system ARP Inspection enable state.
rlIpArpInspectEnableVlanEntry	1.3.6.1.4.1.89.112.3.6.1		not-accessible	An Ip ARP Inspection enabled VLAN entry.
ROW rlIpArpInspectEnableVlanRowStatus	1.3.6.1.4.1.89.112.3.6.1.3	RowStatus	read-write	Entry status. A valid status is CreateandGo and Delete.
rlIpArpInspectEnableVlanTable	1.3.6.1.4.1.89.112.3.6		not-accessible	An Ip ARP Inspection enabled VLAN table.
VLA rlIpArpInspectEnableVlanTag	1.3.6.1.4.1.89.112.3.6.1.1	VlanId	not-accessible	An Ip ARP Inspection entry vlan tag.
rlIpArpInspectListEntry	1.3.6.1.4.1.89.112.3.5.1		not-accessible	The row definition for this table.
IP rlIpArpInspectListIPAddress	1.3.6.1.4.1.89.112.3.5.1.2	IpAddress	not-accessible	ARP Inspection List IP address.
MAC rlIpArpInspectListMACAddress	1.3.6.1.4.1.89.112.3.5.1.3	MacAddress	read-write	ARP Inspection List mac address
RLI rlIpArpInspectListName	1.3.6.1.4.1.89.112.3.5.1.1	RlIpArpInspectListNameType	not-accessible	The Name of the Access List.
ROW rlIpArpInspectListRowStatus	1.3.6.1.4.1.89.112.3.5.1.4	RowStatus	read-write	A status can be destroy, active or createAndGo
rlIpArpInspectListTable	1.3.6.1.4.1.89.112.3.5		not-accessible	The table specifies all ARP Inspection List entries. The entry contains a list name, list IP address, a list Mac address.
U32 rlIpArpInspectLogInterval	1.3.6.1.4.1.89.112.3.3	Unsigned32	read-write	Specify the minimal interval between successive ARP SYSLOG messages. 0 - message is immediately generated. 0xFFFFFFFF - messages would not be generated. A legal range is 0-86400.
INT rlIpArpInspectMibVersion	1.3.6.1.4.1.89.112.3.1	INTEGER	read-only	MIB's version, the current version is 1.
rlIpArpInspectTrustedPortEntry	1.3.6.1.4.1.89.112.3.7.1		not-accessible	The row definition for this table.
ROW rlIpArpInspectTrustedPortRowStatus	1.3.6.1.4.1.89.112.3.7.1.2	RowStatus	read-write	Entry status. A valid status is CreateandGo or Delete.
rlIpArpInspectTrustedPortTable	1.3.6.1.4.1.89.112.3.7		not-accessible	ARP Inspection Trusted ports entry. The entry created when port is configured as trusted.
INT rlIpArpInspectValidation	1.3.6.1.4.1.89.112.3.4	INTEGER	read-write	Defined a specific check on incoming ARP packets: Source MAC: Compare the source MAC address in the Ethernet header against the sender MAC address in the ARP body. This check is performed on both ARP requests and responses. Destination MAC: Compare the destination MAC address in the Ethernet header against the target MAC address in ARP body. This check is performed for ARP responses. IP addresses: Compare the ARP body for invalid and unexpected IP addresses. Addresses include 0.0.0.0, 255.255.255.255, and all IP multicast addresses.
T/F rlIpArpInspectVlanClearCountersAction	1.3.6.1.4.1.89.112.3.6.1.7	TruthValue	read-write	If true, clear (set to zero) all Arp Inspection counters: rlIpArpInspectVlanNumOfArpForwarded , rlIpArpInspectVlanNumOfArpDropped and rlIpArpInspectVlanNumOfArpMismatched
C32 rlIpArpInspectVlanNumOfArpDropped	1.3.6.1.4.1.89.112.3.6.1.5	Counter32	read-only	Number of dropped ARP packets, which were validated by ARP inspection (mismatch , not-found and dropped for any reason)
C32 rlIpArpInspectVlanNumOfArpForwarded	1.3.6.1.4.1.89.112.3.6.1.4	Counter32	read-only	Total number of forwarded ARP packets, packets which were validated by ARP inspection
C32 rlIpArpInspectVlanNumOfArpMismatched	1.3.6.1.4.1.89.112.3.6.1.6	Counter32	read-only	Number of dropped ARP packets, which were validated by ARP inspection and inconsistency was found for IP and MAC (mismatch)
INT rlIpDhcpOpt82InsertionEnable	1.3.6.1.4.1.89.112.1.8	INTEGER	read-write	Specifies a DHCP option 82 insertion enable state.
INT rlIpDhcpOpt82RxOnUntrustedEnable	1.3.6.1.4.1.89.112.1.9	INTEGER	read-write	Specifies a DHCP option 82 receive on untrusted port enable state.
rlIpDhcpSnoop	1.3.6.1.4.1.89.112.1
INT rlIpDhcpSnoopClearAction	1.3.6.1.4.1.89.112.1.4	INTEGER	read-write	Used to clear DHCP Snoop Table.
INT rlIpDhcpSnoopCurrentEntiresNumber	1.3.6.1.4.1.89.112.1.7	INTEGER	read-only	Contain the current number of DHCP snooping entries for all types.
INT rlIpDhcpSnoopEnable	1.3.6.1.4.1.89.112.1.2	INTEGER	read-write	Specifies a system DHCP Snoop enable state.
rlIpDhcpSnoopEnableVlanEntry	1.3.6.1.4.1.89.112.1.12.1		not-accessible	An Ip Dhcp Snooping enabled VLAN entry.
ROW rlIpDhcpSnoopEnableVlanRowStatus	1.3.6.1.4.1.89.112.1.12.1.2	RowStatus	read-write	Entry status. A valid status is CreateandGo and Delete.
rlIpDhcpSnoopEnableVlanTable	1.3.6.1.4.1.89.112.1.12		not-accessible	An Ip Dhcp Snooping enabled VLAN table.
VLA rlIpDhcpSnoopEnableVlanTag	1.3.6.1.4.1.89.112.1.12.1.1	VlanId	not-accessible	A DHCP Snoop entry vlan tag.
rlIpDhcpSnoopEntry	1.3.6.1.4.1.89.112.1.11.1		not-accessible	The row definition for this table.
INT rlIpDhcpSnoopFileEnable	1.3.6.1.4.1.89.112.1.3	INTEGER	read-write	Specifies a system DHCP Snoop file enable state.
INT rlIpDhcpSnoopFileUpdateTime	1.3.6.1.4.1.89.112.1.5	INTEGER	read-write	Configures in seconds the period of time between file updates. The valid range is 600 - 86400.
IP rlIpDhcpSnoopIPAddress	1.3.6.1.4.1.89.112.1.11.1.5	IpAddress	read-write	The IP address of the DHCP client referred to in this table entry.
U32 rlIpDhcpSnoopLeaseTime	1.3.6.1.4.1.89.112.1.11.1.4	Unsigned32	read-write	A DHCP Snoop lease time. For static entry the lease time is 0xFFFFFFFF
MAC rlIpDhcpSnoopMACAddress	1.3.6.1.4.1.89.112.1.11.1.2	MacAddress	not-accessible	A DHCP Snoop entry mac address
INT rlIpDhcpSnoopMibVersion	1.3.6.1.4.1.89.112.1.1	INTEGER	read-only	MIB's version, the current version is 1.
NUM rlIpDhcpSnoopPortInterface	1.3.6.1.4.1.89.112.1.11.1.6	InterfaceIndex	read-write	Identifies the port Interface ifindex, which connected to DHCP client identified with the entry.
ROW rlIpDhcpSnoopRowStatus	1.3.6.1.4.1.89.112.1.11.1.7	RowStatus	read-write	Entry status. A valid status is CreateandGo or Delete.
rlIpDhcpSnoopStaticEntry	1.3.6.1.4.1.89.112.1.10.1		not-accessible	The row definition for this table.
IP rlIpDhcpSnoopStaticIPAddress	1.3.6.1.4.1.89.112.1.10.1.3	IpAddress	read-write	A DHCP Snoop Static entry IP address.
MAC rlIpDhcpSnoopStaticMACAddress	1.3.6.1.4.1.89.112.1.10.1.2	MacAddress	not-accessible	A DHCP Snoop Static entry mac address
NUM rlIpDhcpSnoopStaticPortInterface	1.3.6.1.4.1.89.112.1.10.1.4	InterfaceIndex	read-write	A DHCP Snoop Static entry Port interface.
ROW rlIpDhcpSnoopStaticRowStatus	1.3.6.1.4.1.89.112.1.10.1.5	RowStatus	read-write	A status can be destroy, active or createAndGo
rlIpDhcpSnoopStaticTable	1.3.6.1.4.1.89.112.1.10		not-accessible	The table specifies all DHCP Snoop Static (configured by user) entries. The entry contains a local IP address of the DHCP client, a Port interface to which a DHCP client is connected to the switch.
VLA rlIpDhcpSnoopStaticVLANTag	1.3.6.1.4.1.89.112.1.10.1.1	VlanId	not-accessible	A DHCP Snoop Static entry vlan tag.
rlIpDhcpSnoopTable	1.3.6.1.4.1.89.112.1.11		not-accessible	DHCP Snoop entry. Use to add/delete a dynamic entries and to view all entries (dynamic and static)
rlIpDhcpSnoopTrustedPortEntry	1.3.6.1.4.1.89.112.1.13.1		not-accessible	The row definition for this table.
ROW rlIpDhcpSnoopTrustedPortRowStatus	1.3.6.1.4.1.89.112.1.13.1.2	RowStatus	read-write	Entry status. A valid status is CreateandGo or Delete.
rlIpDhcpSnoopTrustedPortTable	1.3.6.1.4.1.89.112.1.13		not-accessible	DHCP Snoop Trusted ports entry. The entry created when port is configured as trusted.
RLI rlIpDhcpSnoopType	1.3.6.1.4.1.89.112.1.11.1.3	RlIpDhcpSnoopType	read-write	A DHCP Snoop entry type: static or dynamic.
INT rlIpDhcpSnoopVerifyMacAddress	1.3.6.1.4.1.89.112.1.6	INTEGER	read-write	Configures on an un-trusted port whether the source MAC address in a DHCP packet matches the client hardware address.
VLA rlIpDhcpSnoopVLANTag	1.3.6.1.4.1.89.112.1.11.1.1	VlanId	not-accessible	A DHCP Snoop entry vlan tag.
rlIpSourceGuard	1.3.6.1.4.1.89.112.2
INT rlIpSourceGuardEnable	1.3.6.1.4.1.89.112.2.2	INTEGER	read-write	FALSE - There is no Ip Source Guard in the system. TRUE - Ip Source Guard is enabled on system.
rlIpSourceGuardEntry	1.3.6.1.4.1.89.112.2.6.1		not-accessible	The row definition for this table.
RLI rlIpSourceGuardFailReason	1.3.6.1.4.1.89.112.2.6.1.6	RlIpSourceGuardFailReason	read-only	Identifies the reason for in-activity of Ip Source Guard entry.
IP rlIpSourceGuardIPAddress	1.3.6.1.4.1.89.112.2.6.1.1	IpAddress	not-accessible	The IP address of the Ip Source Guard entry.
MAC rlIpSourceGuardMACAddress	1.3.6.1.4.1.89.112.2.6.1.3	MacAddress	read-only	A Ip Source Guard entry mac address
INT rlIpSourceGuardMibVersion	1.3.6.1.4.1.89.112.2.1	INTEGER	read-only	MIB's version, the current version is 1.
rlIpSourceGuardPermittedRuleCounterEntry	1.3.6.1.4.1.89.112.2.7.1		not-accessible	The row definition for this table.
C32 rlIpSourceGuardPermittedRuleCounterNumOfDhcpRules	1.3.6.1.4.1.89.112.2.7.1.3	Counter32	read-only	Number of rules added by IP Source Guard for the permitted Hosts, as a result of DHCP Snooping dynamic information.
C32 rlIpSourceGuardPermittedRuleCounterNumOfStaticRules	1.3.6.1.4.1.89.112.2.7.1.2	Counter32	read-only	Number of static rules added by IP Source Guard for the permitted Hosts
rlIpSourceGuardPermittedRuleCounterTable	1.3.6.1.4.1.89.112.2.7		not-accessible	The table includes, per vlan, the IP Source Guard permitted rules counters.
VLA rlIpSourceGuardPermittedRuleCounterVLANTag	1.3.6.1.4.1.89.112.2.7.1.1	VlanId	not-accessible	Ip Source Guard permitted rules counters entry Vlan tag.
rlIpSourceGuardPortEntry	1.3.6.1.4.1.89.112.2.5.1		not-accessible	The row definition for this table.
ROW rlIpSourceGuardPortRowStatus	1.3.6.1.4.1.89.112.2.5.1.2	RowStatus	read-write	Entry status. A valid status is CreateAndGo or Delete.
rlIpSourceGuardPortTable	1.3.6.1.4.1.89.112.2.5		not-accessible	IP Source Guard ports entry. The entry created when IP Source Guard enabled on port.
INT rlIpSourceGuardRetryTime	1.3.6.1.4.1.89.112.2.4	INTEGER	read-write	Configures in seconds the period of time the application retries to insert inactive by resource problem rules. The actual range is 10-600. 0 used to sign that the timer is not active.
INT rlIpSourceGuardRetryToInsert	1.3.6.1.4.1.89.112.2.3	INTEGER	read-write	When setted to retryToInsertNow all IP Source Guard inactive entries due to resource problem reinserted in the Policy. On get always return noAction.
RLI rlIpSourceGuardStatus	1.3.6.1.4.1.89.112.2.6.1.5	RlIpSourceGuardStatus	read-only	Identifies the status of Ip Source Guard entry.
rlIpSourceGuardTable	1.3.6.1.4.1.89.112.2.6		not-accessible	IP Source Guard entry. Use to view all entries (dynamic and static)
RLI rlIpSourceGuardType	1.3.6.1.4.1.89.112.2.6.1.4	RlIpSourceGuardType	read-only	A Ip Source Guard entry type: static or dynamic.
VLA rlIpSourceGuardVLANTag	1.3.6.1.4.1.89.112.2.6.1.2	VlanId	not-accessible	A Ip Source Guard entry vlan tag.
rlProtocolFiltering	1.3.6.1.4.1.89.112.4
rlProtocolFilteringEntry	1.3.6.1.4.1.89.112.4.1.1		not-accessible	The row definition for this table.
PRO rlProtocolFilteringList	1.3.6.1.4.1.89.112.4.1.1.1	ProtocolFilteringMap	read-write	The list of protocol to be filtered.
ROW rlProtocolFilteringRowStatus	1.3.6.1.4.1.89.112.4.1.1.2	RowStatus	read-write	A status can be destroy, active or createAndGo
rlProtocolFilteringTable	1.3.6.1.4.1.89.112.4.1		not-accessible	Protocol filter configuration entry
rlSelectiveQinq	1.3.6.1.4.1.89.112.5
RLS rlSelectiveQinqListAction	1.3.6.1.4.1.89.112.5.2.1.8	RlSelectiveQinqAction	read-write	Selective QinQ entry action
VLA rlSelectiveQinqListActionVID	1.3.6.1.4.1.89.112.5.2.1.9	VlanId	read-write	Selective QinQ entry action's vlan id
INT rlSelectiveQinqListClassifierEtherType	1.3.6.1.4.1.89.112.5.2.1.6	INTEGER	read-write	Selective QinQ entry classifier's ethertype value
RLS rlSelectiveQinqListClassifierField	1.3.6.1.4.1.89.112.5.2.1.3	RlSelectiveQinqClassifierField	read-write	Selective QinQ entry classifier field
NUM rlSelectiveQinqListClassifierIfIndex	1.3.6.1.4.1.89.112.5.2.1.2	InterfaceIndex	read-write	Selective QinQ entry classifier's interface index
IP rlSelectiveQinqListClassifierSrcIp	1.3.6.1.4.1.89.112.5.2.1.7	IpAddress	read-write	Selective QinQ entry classifier's IP address
MAC rlSelectiveQinqListClassifierSrcMac3bytes	1.3.6.1.4.1.89.112.5.2.1.5	MacAddr3bytes	read-write	Selective QinQ entry classifier's 3 bytes out of MAC address
VLA rlSelectiveQinqListClassifierVID	1.3.6.1.4.1.89.112.5.2.1.4	VlanId	read-write	Selective QinQ entry classifier's vlan id
INT rlSelectiveQinqListDeleteAllAction	1.3.6.1.4.1.89.112.5.1	INTEGER	read-write	Used to delete the entire Selective QinQ Table.
RLS rlSelectiveQinqListDirection	1.3.6.1.4.1.89.112.5.2.1.1	RlSelectiveQinqDirection	read-only	Selective QinQ entry index
rlSelectiveQinqListEntry	1.3.6.1.4.1.89.112.5.2.1		not-accessible	The row definition for this table.
ROW rlSelectiveQinqListRowStatus	1.3.6.1.4.1.89.112.5.2.1.10	RowStatus	read-write	A status can be destroy, active or createAndGo
rlSelectiveQinqListTable	1.3.6.1.4.1.89.112.5.2		not-accessible	The table specifies all Selective QinQ rules (configured by user). The entry contains a classifier and an action.

RFC description

RADLAN bridge security MIB defines management objects for bridge-related security features on NETGEAR/Radlan devices, including MSTP (Multiple Spanning Tree Protocol) and bridge security configuration.

Start monitoring RADLAN/Marvell-based managed Ethernet switches (DHCP Snooping/ARP Inspection/IP Source Guard) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download RADLAN-BRIDGE-SECURITY

What Is RADLAN-BRIDGE-SECURITY?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description