S5-SWITCH-BAYSECURE-MIB

All MIBs › S5-SWITCH-BAYSECURE-MIB

Organization: Avaya

Last Updated: 2012-09-13

Category: Avaya BayStack Ethernet Management, Security and Access Control

Description: Manages Avaya BayStack BaySecure port security including MAC address locking and intrusion detection.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is S5-SWITCH-BAYSECURE-MIB?

S5-SWITCH-BAYSECURE-MIB is a Nortel/Avaya BayStack MIB for the BaySecure feature, which enforces MAC-address-based port security to detect and block unauthorized devices. It exposes per-switch and per-board security status, enforcement mode, and counts of allowed versus blocked nodes on secured ports. Its monitoring value is security/fault status: it lets an admin confirm BaySecure is enabled in the expected mode and watch for a port hitting its blocked-node limit, which signals a MAC spoofing or intrusion attempt, alongside explicit MAC violation events. It is part of the same BayStack MIB family as S5-ETHERNET-COMMON-MIB, sharing board/port indexing conventions. It is typically deployed on BayStack switches in environments where MAC-level port security enforcement is required, such as secure wiring closets, and network teams can obtain the S5-SWITCH-BAYSECURE-MIB download to load it into their monitoring tools.

IPNetwork Monitor allows you to monitor SNMP objects defined in S5-SWITCH-BAYSECURE-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Avaya/Nortel BayStack switches with BaySecure MAC-level port security

Monitoring Examples

An admin polls s5SbsSecurityStatus and s5SbsSecurityMode to confirm BaySecure is enabled and in the expected enforcement mode, monitors s5SbsCurrNodesBlocked against s5SbsMaxNodesBlocked to detect a port hitting its blocked-node limit, and checks s5SbsMacViolation events alongside the per-board s5SbsAuthCfgTable/s5SbsAuthCfgEntry configuration to identify exactly where a violation occurred.

What Can Be Monitored

port security status
security enforcement mode
current/max allowed nodes per port
current/max blocked nodes per port
MAC address violation events
per-board security configuration

Imported Objects

From S5-ROOT-MIB

s5Com

OBJECT-IDENTITY

From SNMPv2-SMI

Integer32
IpAddress
MODULE-IDENTITY
OBJECT-TYPE

From SNMPv2-TC

MacAddress
TEXTUAL-CONVENTION
TimeInterval
TruthValue

How to Use in IPNetwork Monitor

Example using s5SbsAuthSecurityLock OID:

Select an Avaya/Nortel BayStack switches with BaySecure MAC-level port security (intrusion/violation status) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type s5SbsAuthSecurityLock into the Find box to locate it in the OID tree, then select it and click OK. It reports if s5SbsAuthSecurityLock is locked(2), the agent will refuse all requests to modify the 'security configuration'. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is an INTEGER-type OID, Value bounds is the most useful condition here — trigger an alert if the value changes unexpectedly, since an unplanned lock or unlock of the security configuration can indicate tampering or a misconfiguration. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
s5SbsAuth	1.3.6.1.4.1.45.1.6.5.3			BaySecure MIB - MAC-based Security MIB Copyright 1999-2012 Avaya All rights reserved. This Avaya SNMP Management Information Base Specification (Specification) embodies Avaya's confidential and proprietary intellectual property. Avaya retains all title and ownership in the Specification, including any revisions. This Specification is supplied 'AS IS,' and Avaya makes no warranty, either express or implied, as to the use, operation, condition, or performance of the Specification.
INT s5SbsAuthSecurityLockEx	1.3.6.1.4.1.45.1.6.5.3.1	INTEGER	read-only	If s5SbsAuthSecurityLock is locked(2), the agent will refuse all requests to modify the 'security configuration'. Objects in s5SbsAuth, the Switch BaySecure MIB Group that are part of the 'security configuration', includes s5SbsAuthCtlPartTime, objects in s5SbsAuthCfgTable, Set requests for all read/write objects in s5SbsAuth group excluding this object will result in a BadValue return value.
I32 s5SbsAuthCtlPartTime	1.3.6.1.4.1.45.1.6.5.3.2	Integer32	read-write	If the value of s5SbsAuthCfgActionMode is partitionPort or partitionPortAndSendTrap, time partition will be done if this value is greater than 0. The value indicates the duration of the time for port partitioning in seconds. The default value is zero. When this value is zero, port remians partitioned until manually re-enabled.
INT s5SbsSecurityStatus	1.3.6.1.4.1.45.1.6.5.3.3	INTEGER	read-write	Indicates whether the switch security feature is enabled or not.
INT s5SbsSecurityMode	1.3.6.1.4.1.45.1.6.5.3.4	INTEGER	read-write	The mode of switch security. singleMACperPort(1) indicates that the switch is in single-MAC-per-port mode which means it allows to configure only one MAC address per port. macList(2) indicates that the switch is in MAC-List mode, user can configure more than one MAC address per port, the maximum numbers of MAC address per port vary from switch to switch. autoLearn(3) indicates that the switch will learn the first MAC address on each port as an allowed address of that port. Change made between singleMACperPort(1), macList(2) and autoLearn(3) will erase all the data in s5SbsAuthCfgTable.
INT s5SbsSecurityAction	1.3.6.1.4.1.45.1.6.5.3.5	INTEGER	read-write	Action performed by software when a violation occurs (if s5SbsSecurityStatus is enabled). The security action specified here applies to all ports of the switch. NOTE: da means destination address. A blocked address will always cause the port to be partitioned when unauthorized access is attempted. See s5SbsAuthCfgAccessCtrlType for more information on allowed and blocked addresses.
I32 s5SbsCurrNodesAllowed	1.3.6.1.4.1.45.1.6.5.3.6	Integer32	read-only	The current number of entries of the nodes allowed in the s5SbsAuthCfgTable.
I32 s5SbsMaxNodesAllowed	1.3.6.1.4.1.45.1.6.5.3.7	Integer32	read-only	The maximum number of entries of the nodes allowed in the s5SbsAuthCfgTable.
I32 s5SbsCurrNodesBlocked	1.3.6.1.4.1.45.1.6.5.3.8	Integer32	read-only	The current number of entries of the nodes blocked in the s5SbsAuthCfgTable.
I32 s5SbsMaxNodesBlocked	1.3.6.1.4.1.45.1.6.5.3.9	Integer32	read-only	The maximum number of entries of the nodes blocked in the s5SbsAuthCfgTable.
s5SbsAuthCfgTable	1.3.6.1.4.1.45.1.6.5.3.10		not-accessible	A table containing a list of boards and ports and MAC addresses that constitute the security configuration.
s5SbsAuthCfgEntry	1.3.6.1.4.1.45.1.6.5.3.10.1		not-accessible	An entry in this table indicates the security configuration for a specified MAC address and a specified port and a specified board. A SNMP SET PDU for a row of the s5SbsAuthCfgTable requires the entired sequence of the MIB Objects in each s5SbsAuthCfgEntry stored in one PDU. Otherwise, GENERR return-value will be returned.
I32 s5SbsAuthCfgBrdIndx	1.3.6.1.4.1.45.1.6.5.3.10.1.1	Integer32	read-only	The index of the slot containing the board on which the port is located. This value is meaningful --NEW only if s5SbsAuthCfgSecureList value is zero. --NEW For other SecureList values it should have the value of zero.
I32 s5SbsAuthCfgPortIndx	1.3.6.1.4.1.45.1.6.5.3.10.1.2	Integer32	read-only	The index of the port on the board. This value is meaningful only if s5SbsAuthCfgSecureList value is zero. --NEW For other SecureList values it should have the value of zero.
MAC s5SbsAuthCfgMACIndx	1.3.6.1.4.1.45.1.6.5.3.10.1.3	MacAddress	read-only	The index of source MAC address of allowed station or not-allowed station.
INT s5SbsAuthCfgAccessCtrlType	1.3.6.1.4.1.45.1.6.5.3.10.1.4	INTEGER	read-write	This Node Access Control Type represents whether the node entry is node allowed or node blocked type. A MAC address may be allowed on multiple ports.
INT s5SbsAuthCfgStatus	1.3.6.1.4.1.45.1.6.5.3.10.1.5	INTEGER	read-write	The status of the AuthCfg entry. The primary use of this object is for modifying the AuthCfg table. Values that can be written create(2), delete(3), modify(4). Values that can be read: valid(1). Setting this entry to delete(3) causes the entry to be deleted from the table. Setting a new entry with create(2) causes the entry to be created in the table. Setting an entry with modify(4) causes the entry to be modified. The response to a get request or get-next request will always indicate a status of valid (1), since invalid entries are removed from the table. This object cannot be modified for entries whose value of s5SbsAuthCfgSource is autoLearn(2) if the value of s5SbsAutoLearningSticky is false(2). Any such attempt will generate an inconsistentValue error.
I32 s5SbsAuthCfgSecureList	1.3.6.1.4.1.45.1.6.5.3.10.1.6	Integer32	read-write	The index of the security list. This value is meaningful only if s5SbsAuthCfgBrdIndx and s5SbsAuthCfgPortIndx values are zero. For other board and port index values it should have the value of zero. This value is used as an index into s5SbsSecurityListTable. The corresponding MAC Address of this entry is allowed or blocked on all the ports of that port list. Note that this value must be 0 for entries where the value of s5SbsAuthCfgSource is either autoLearn(2) or sticky(3).
INT s5SbsAuthCfgSource	1.3.6.1.4.1.45.1.6.5.3.10.1.7	INTEGER	read-only	This object indicates the source of an entry. A value of static(1) indicates that the entry was manually created by a user. A value of autoLearn(2) indicates that the entry was auto-learned. Note that if the value of s5SbsAutoLearningSticky is false(2), then an auto-learned entry cannot be directly deleted, though disabling auto-learning for a port will delete all auto-learned MAC addresses for the port. However, if the value of s5SbsAutoLearningSticky is true(1), then auto-learned addresses can be deleted normally.
NUM s5SbsAuthCfgLifetime	1.3.6.1.4.1.45.1.6.5.3.10.1.8	TimeInterval	read-only	This object indicates the lifetime of an auto-learned entry. This is the time until the entry is automatically deleted by the system. This object does not apply to entries whose value of s5SbsAuthCfgSource is static(1), and for such entries, the value of this object will always be 0.
I32 s5SbsAuthCfgTrunk	1.3.6.1.4.1.45.1.6.5.3.10.1.9	Integer32	read-write	The trunk on which a MAC address is allowed or disallowed. This value must be 0 if the value of any of these objects is non-zero: s5SbsAuthCfgBrdIndx s5SbsAuthCfgPortIndx s5SbsAuthCfgSecureList The value of this object is only used if the above objects all have zero values. The value of this object must also be 0 if the value of s5SbsAuthCfgSource is either autoLearn(2) or sticky(3).
s5SbsAuthStatusTable	1.3.6.1.4.1.45.1.6.5.3.11		not-accessible	A table containing a snapshot of the authorized boards and ports status data collection. Port security information consists of an action to be performed when an unAuthorized station is detected and the current security status of a port.
s5SbsAuthStatusEntry	1.3.6.1.4.1.45.1.6.5.3.11.1		not-accessible	An entry in this table may represent a single MAC address, all MAC addresses on a single port, a single port, all the ports on a single board, a particuler port on all the boards, or all the ports on all the boards.
I32 s5SbsAuthStatusBrdIndx	1.3.6.1.4.1.45.1.6.5.3.11.1.1	Integer32	read-only	The index of the board. This corresponds to the index of the slot containing the board if the index is greater than zero. A zero index is a wild card.
I32 s5SbsAuthStatusPortIndx	1.3.6.1.4.1.45.1.6.5.3.11.1.2	Integer32	read-only	The index of the port on the board. This corresponds to the index of the last manageable port on the board if the index is greater than zero. A zero index is a wild card.
MAC s5SbsAuthStatusMACIndx	1.3.6.1.4.1.45.1.6.5.3.11.1.3	MacAddress	read-only	The index of MAC address on the port. This corresponds to the index of the MAC address on the port if the index is greater than zero. A zero index is a wild card.
INT s5SbsCurrentAccessCtrlType	1.3.6.1.4.1.45.1.6.5.3.11.1.4	INTEGER	read-only	This Node Access Control Type represents whether the node entry is node allowed or node blocked type.
INT s5SbsCurrentActionMode	1.3.6.1.4.1.45.1.6.5.3.11.1.5	INTEGER	read-only	An integer value representing the type of information contained in this s5SbsAuthStatusEntry. noAction(1) represents that port does not have any security assigned or the security is turned off. partitionPort(2) represents port is partitioned. partitionPortAndsendTrap(3) represents port is partitioned and a trap will be sent to trap receive station(s). daFiltering(4) represents port will filter out the frames with the desitnation address field is the MAC address of unauthorized station. daFilteringAndsendTrap(5) represents port will filter out the frames with the desitnation address field is the MAC address of unauthorized station and a trap will be sent to trap receive station(s). sendtrap(6) represents a trap will be sent to trap receive station(s). partitionPortAnddaFiltering(7) represents port is partitioned and port will filter out the frames with the destination address field is the MAC address of unauthorized station. partitionPortdaFilteringAndsendTrap(8) represents port is partitioned, port will filter out the frames with the destination address field is the MAC address of unauthorized station and a trap will be sent to trap receive station(s).
INT s5SbsCurrentPortSecurStatus	1.3.6.1.4.1.45.1.6.5.3.11.1.6	INTEGER	read-only	This represents the current port security status. If s5SbsSecurityStatus is disable, notApplicable(1) will be returned. The port in a normal situation returns the status with portSecure(2). portPartition(3) will be returned only if the port is partitioned.
s5SbsViolationStatusTable	1.3.6.1.4.1.45.1.6.5.3.12		not-accessible	A table containing a list of boards, ports where network access violations have occurred. Information also contains the offending MAC addrersses.
s5SbsViolationStatusEntry	1.3.6.1.4.1.45.1.6.5.3.12.1		not-accessible	An entry in this table
I32 s5SbsViolationStatusBrdIndx	1.3.6.1.4.1.45.1.6.5.3.12.1.1	Integer32	read-only	The index of the board. This corresponds to the slot containing the board. This index will be 1 where it is not applicable, e.g., ByaStack 303/304.
I32 s5SbsViolationStatusPortIndx	1.3.6.1.4.1.45.1.6.5.3.12.1.2	Integer32	read-only	The index of the port on the board. This corresponds to the port on which a security violation was seen.
MAC s5SbsViolationStatusMACAddress	1.3.6.1.4.1.45.1.6.5.3.12.1.3	MacAddress	read-only	The MAC address of the device attempting unauthorized network access. (MAC addrees-based security)
INT s5SbsMgmViolationType	1.3.6.1.4.1.45.1.6.5.3.13	INTEGER	read-only	Type of management access attempted when the violation occurred.
IP s5SbsMgmViolationIpAddress	1.3.6.1.4.1.45.1.6.5.3.14	IpAddress	read-only	IP Address of the station attempting unauthorized management access.
POR s5SbsPortSecurityStatus	1.3.6.1.4.1.45.1.6.5.3.15	PortSet	read-write	The set of ports for which security is enabled. The bitwise AND of s5SbsPortSecurityStatus and s5SbsPortLearnStatus must be the empty set.
POR s5SbsPortLearnStatus	1.3.6.1.4.1.45.1.6.5.3.16	PortSet	read-write	The set of ports for which auto learning is enabled. Note that a port's bit in this object may not be turned on if the port's value of s5SbsAutoLearningConfigEnabled is true(1).
I32 s5SbsCurrSecurityLists	1.3.6.1.4.1.45.1.6.5.3.17	Integer32	read-only	The current number of entries of the Security lists in the s5SbsSecurityListTable.
I32 s5SbsMaxSecurityLists	1.3.6.1.4.1.45.1.6.5.3.18	Integer32	read-only	The maximum number of entries of the Security lists in the s5SbsSecurityListTable.
s5SbsSecurityListTable	1.3.6.1.4.1.45.1.6.5.3.19		not-accessible	A table containing a list of Security port lists.
s5SbsSecurityListEntry	1.3.6.1.4.1.45.1.6.5.3.19.1		not-accessible	An entry in this table
I32 s5SbsSecurityListIndx	1.3.6.1.4.1.45.1.6.5.3.19.1.1	Integer32	read-only	The index of the security list. This corresponds to the Security port list which can be used as index into s5SbsAuthCfgTable.
POR s5SbsSecurityListMembers	1.3.6.1.4.1.45.1.6.5.3.19.1.2	PortSet	read-write	The set of ports that are currently members in this Port list.
INT s5SbsSecurityListStatus	1.3.6.1.4.1.45.1.6.5.3.19.1.3	INTEGER	read-write	The status of the SecurityList entry. The primary use of this object is for modifying the SecurityList table. Values that can be written create(2), delete(3), modify(4). Values that can be read: valid(1). Setting this entry to delete(3) causes the entry to be deleted from the table. Setting a new entry with create(2) causes the entry to be created in the table. Setting an entry with modify(4) causes the entry to be modified. The response to a get request or get-next request will always indicate a status of valid (1), since invalid entries are removed from the table.
s5SbsMacViolation	1.3.6.1.4.1.45.1.6.5.3.20
INT s5SbsMacViolationClear	1.3.6.1.4.1.45.1.6.5.3.20.1	INTEGER	read-write	This object is used to clear all entries in the s5SbsMacViolationTable. Setting it to clear(2) will clear all entries in that table. Setting it to other(1) has no effect. This object always returns a value of other(1).
s5SbsMacViolationTable	1.3.6.1.4.1.45.1.6.5.3.20.2		not-accessible	A table containing a list of Security port lists.
s5SbsMacViolationEntry	1.3.6.1.4.1.45.1.6.5.3.20.2.1		not-accessible	An entry in this table
MAC s5SbsMacViolationAddress	1.3.6.1.4.1.45.1.6.5.3.20.2.1.1	MacAddress	read-only	The MAC address that caused an access violation.
I32 s5SbsMacViolationBrd	1.3.6.1.4.1.45.1.6.5.3.20.2.1.2	Integer32	read-only	The last board/slot/unit number on which the MAC address caused an access violation.
I32 s5SbsMacViolationPort	1.3.6.1.4.1.45.1.6.5.3.20.2.1.3	Integer32	read-only	The last port number on which the MAC address caused an access violation.
I32 s5SbsAutoLearningAgingTime	1.3.6.1.4.1.45.1.6.5.3.21	Integer32	read-write	The lifetime for MAC addresses which are auto-learned. This is measured in minutes. A value of 0 means addresses are not aged out.
s5SbsAutoLearningConfigTable	1.3.6.1.4.1.45.1.6.5.3.22		not-accessible	A table containing per-port configuration for auto-learning. Entries exist in the table for each ethernet port in the system.
s5SbsAutoLearningConfigEntry	1.3.6.1.4.1.45.1.6.5.3.22.1		not-accessible	An entry in this table
I32 s5SbsAutoLearningConfigBrd	1.3.6.1.4.1.45.1.6.5.3.22.1.1	Integer32	not-accessible	The board/slot/unit number.
I32 s5SbsAutoLearningConfigPort	1.3.6.1.4.1.45.1.6.5.3.22.1.2	Integer32	not-accessible	The port number.
T/F s5SbsAutoLearningConfigEnabled	1.3.6.1.4.1.45.1.6.5.3.22.1.3	TruthValue	read-write	This object indicates whether auto-learning is enabled on the port. Note that this object may not be set to true(1) for a port whose bit is turned on in s5SbsPortLearnStatus. Likewise, a port's bit in s5SbsPortLearnStatus may not be turned on if the port's value of s5SbsAutoLearningConfigEnabled is true(1). Note that if this object is changed from true(1) to false(2), all auto-learned MAC addresses for the port will be removed.
I32 s5SbsAutoLearningConfigMaxMacs	1.3.6.1.4.1.45.1.6.5.3.22.1.4	Integer32	read-write	This object indicates the maximum number of MAC addresses that may be learned on the port.
POR s5SbsAutoLearningPorts	1.3.6.1.4.1.45.1.6.5.3.23	PortSet	read-write	This object specifies the set of ports for which auto- learning is enabled. It is an alternative to s5SbsAutoLearningConfigEnabled.
T/F s5SbsAutoLearningSticky	1.3.6.1.4.1.45.1.6.5.3.24	TruthValue	read-write	This object controls whether the 'sticky-mac' feature is enabled.
POR s5SbsSecurityLockoutPortList	1.3.6.1.4.1.45.1.6.5.3.25	PortSet	read-write	This object controls the set of ports that are locked such that they cannot have mac-security enabled.

RFC description

Manages MAC-based security and access control features for Avaya switches including auto-learning, port lock-out, and sticky MAC functionality.

Start monitoring Avaya/Nortel BayStack switches with BaySecure MAC-level port security (intrusion/violation status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download S5-SWITCH-BAYSECURE-MIB