SW-ACLMGMT-MIB

All MIBs › SW-ACLMGMT-MIB

Organization: enterprise, Inc.

Last Updated: 2000-07-15

Category: Access Control, Switch Management - D-Link

Description: Manages switch ACL rules, policy bindings, and access control list configuration for traffic filtering.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is SW-ACLMGMT-MIB?

SW-ACLMGMT-MIB is a proprietary switch access-control-list (ACL) management module (part of a shared "proprietary enterprise" MIB family used across several OEM/white-label switch codebases) governing traffic-filtering policy on managed Ethernet switches. It exposes ACL rule and payload configuration objects that define filtering criteria and bind them to switch ports. Its monitoring emphasis is software/configuration status rather than physical sensors - verifying that ACL payload entries and rule bindings are correctly programmed lets an operator confirm that intended traffic-filtering policy is actually enforced, and a missing or malformed rule entry would reveal a filtering gap that could let unwanted traffic through. It builds on standard switch port/interface indexing (an IF-MIB-style ifIndex) to associate ACL rules with specific ports. It is deployed on managed Ethernet switches used for perimeter or intra-network traffic filtering and access-control enforcement, with the SW-ACLMGMT-MIB MIB exposing the rule and payload objects administrators check to verify policy enforcement.

IPNetwork Monitor allows you to monitor SNMP objects defined in SW-ACLMGMT-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

managed Ethernet switch (proprietary/OEM switch platform)

Monitoring Examples

swACLPayloadEntry and swACLPayloadRuleEntry hold the configured filter payload/match criteria and the associated rule definitions that get bound to switch ports. An administrator would review these entries after applying a new ACL to confirm the rule was actually programmed into the switch's filtering table as intended, rather than merely accepted by the CLI. A discrepancy between the intended policy and what's present in swACLPayloadRuleEntry would explain traffic unexpectedly passing through (or being blocked) on a given port.

What Can Be Monitored

ACL payload/match entries
ACL rule definitions
rule-to-port bindings

Imported Objects

From DLINK-ID-REC-MIB

dlink-mgmt

From Q-BRIDGE-MIB

PortList

From RFC1213-MIB

DisplayString

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-SMI

Counter32
Counter64
IpAddress
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
TimeTicks
Unsigned32

From SNMPv2-TC

MacAddress
RowStatus

OIDs

OID symbolic	OID numeric	Type	Access	Description
swAclMgmtMIB	1.3.6.1.4.1.171.11.5			The Structure of Access Control List Information for the proprietary enterprise.
swAclMaskMgmt	1.3.6.1.4.1.171.11.5.1
swACLEthernetTable	1.3.6.1.4.1.171.11.5.1.1		not-accessible	This table contain ACL mask of Ethernet information. Access profiles will be created on the switch by row creation and to define which parts of each incoming frame's layer 2 part of header the switch will examine. Masks can be entered that will be combined with the values the switch finds in the specified frame header fields.
swACLEthernetEntry	1.3.6.1.4.1.171.11.5.1.1.1		not-accessible	A list of information about ACL of Ethernet.
INT swACLEthernetProfileID	1.3.6.1.4.1.171.11.5.1.1.1.1	INTEGER	read-only	The ID of ACL mask entry ,and is unique in the mask list.
INT swACLEthernetUsevlan	1.3.6.1.4.1.171.11.5.1.1.1.2	INTEGER	read-create	Specifies that the switch will examine the VLAN part of each packet header.
INT swACLEthernetMacAddrMaskState	1.3.6.1.4.1.171.11.5.1.1.1.3	INTEGER	read-create	This object indicates the status of MAC address mask. other(1) - Neither source MAC address nor destination MAC address are masked. dst-mac-addr(2) - recieved frames's destination MAC address are currently used to be filtered as it meets with the MAC address entry of the table. src-mac-addr(3) - recieved frames's source MAC address are currently used to be filtered as it meets with the MAC address entry of the table. dst-src-mac-addr(4) - recieved frames's destination MAC address or source MAC address are currently used to be filtered as it meets with the MAC address entry of the table.
MAC swACLEthernetSrcMacAddrMask	1.3.6.1.4.1.171.11.5.1.1.1.4	MacAddress	read-create	This object Specifies the MAC address mask for the source MAC address.
MAC swACLEthernetDstMacAddrMask	1.3.6.1.4.1.171.11.5.1.1.1.5	MacAddress	read-create	This object Specifies the MAC address mask for the destination MAC address.
INT swACLEthernetUse8021p	1.3.6.1.4.1.171.11.5.1.1.1.6	INTEGER	read-create	Specifies if the switch will examine the 802.1p priority value in the frame's header or not.
INT swACLEthernetUseEthernetType	1.3.6.1.4.1.171.11.5.1.1.1.7	INTEGER	read-create	Specifies if the switch will examine the Ethernet type value in each frame's header or not.
POR swACLEthernetPort	1.3.6.1.4.1.171.11.5.1.1.1.8	PortList	read-create	This object indicates the portlist of this entry.
ROW swACLEthernetRowStatus	1.3.6.1.4.1.171.11.5.1.1.1.9	RowStatus	read-create	This object indicates the status of this entry.
swACLIpTable	1.3.6.1.4.1.171.11.5.1.2		not-accessible	This table contain ACL mask of IP information. Access profiles will be created on the switch by row creation and to define which parts of each incoming frame's IP layer part of header the switch will examine. Masks can be entered that will be combined with the values the switch finds in the specified frame header fields.
swACLIpEntry	1.3.6.1.4.1.171.11.5.1.2.1		not-accessible	A list of information about ACL of IP Layer.
INT swACLIpProfileID	1.3.6.1.4.1.171.11.5.1.2.1.1	INTEGER	read-only	The ID of ACL mask entry ,and is unique in the mask list.
INT swACLIpUsevlan	1.3.6.1.4.1.171.11.5.1.2.1.2	INTEGER	read-create	This object indicates if IP layer vlan is examined or not.
INT swACLIpIpAddrMaskState	1.3.6.1.4.1.171.11.5.1.2.1.3	INTEGER	read-create	This object indicates the status of IP address mask. other(1) - Neither source IP address nor destination IP address are masked. dst-ip-addr(2) - recieved frames's destination IP address are currently used to be filtered as it meets with the IP address entry of the table. src-ip-addr(3) - recieved frames's source IP address are currently used to be filtered as it meets with the IP address entry of the table. dst-src-ip-addr(4) - recieved frames's destination IP address or source IP address are currently used to be filtered as it meets with the IP address entry of the table.
IP swACLIpSrcIpAddrMask	1.3.6.1.4.1.171.11.5.1.2.1.4	IpAddress	read-create	This object Specifies IP address mask for the source IP address.
IP swACLIpDstIpAddrMask	1.3.6.1.4.1.171.11.5.1.2.1.5	IpAddress	read-create	This object Specifies the IP address mask for the destination IP address.
INT swACLIpUseDSCP	1.3.6.1.4.1.171.11.5.1.2.1.6	INTEGER	read-create	This object indicates DSCP protocol is is examined or not.
INT swACLIpUseProtoType	1.3.6.1.4.1.171.11.5.1.2.1.7	INTEGER	read-create	That object indicates which protocol will be examined.
INT swACLIpIcmpOption	1.3.6.1.4.1.171.11.5.1.2.1.8	INTEGER	read-create	This object indicates which fields should be filled in of ICMP. none(1)- two fields are null. type(2)- type field should be filled in. code(3)- code field should be filled in. type-code(4)- not only type fileld but code field should be filled in.
INT swACLIpIgmpOption	1.3.6.1.4.1.171.11.5.1.2.1.9	INTEGER	read-create	This object indicates Options of IGMP is examined or not.
INT swACLIpTcpOption	1.3.6.1.4.1.171.11.5.1.2.1.10	INTEGER	read-create	This object indicates the status of filtered address of TCP. other(1) - Neither source port nor destination port are masked. dst-addr(2) - recieved frames's destination port are currently used to be filtered . src-addr(3) - recieved frames's source port are currently used to be filtered . dst-src-addr(4) - both recieved frames's destination port and source port are currently used to be filtered .
INT swACLIpUdpOption	1.3.6.1.4.1.171.11.5.1.2.1.11	INTEGER	read-create	This object indicates the status of filtered address of UDP . other(1) - Neither source port nor destination port are masked. dst-addr(2) - recieved frames's destination port are currently used to be filtered . src-addr(3) - recieved frames's source port are currently used to be filtered . dst-src-addr(4) - recieved frames's destination port or source port are currently used to be filtered.
OCT swACLIpTCPorUDPSrcPortMask	1.3.6.1.4.1.171.11.5.1.2.1.12	OCTET STRING	read-create	Specifies a TCP port mask for the source port if swACLIpUseProtoType is TCP Specifies a UDP port mask for the source port if swACLIpUseProtoType is UDP.
OCT swACLIpTCPorUDPDstPortMask	1.3.6.1.4.1.171.11.5.1.2.1.13	OCTET STRING	read-create	Specifies a TCP port mask for the destination port if swACLIpUseProtoType is TCP Specifies a UDP port mask for the destination port if swACLIpUseProtoType is UDP.
INT swACLIpTCPFlagBit	1.3.6.1.4.1.171.11.5.1.2.1.14	INTEGER	read-create	Specifies a TCP connection flag mask.
INT swACLIpProtoIDOption	1.3.6.1.4.1.171.11.5.1.2.1.16	INTEGER	read-create	Specifies that the switch will examine each frame's Protocol ID field or not.
OCT swACLIpProtoIDMask	1.3.6.1.4.1.171.11.5.1.2.1.17	OCTET STRING	read-create	Specifies that the rule applies to the IP protocol ID and the mask options behind the IP header.
POR swACLIpPort	1.3.6.1.4.1.171.11.5.1.2.1.18	PortList	read-create	This object indicates the portlist of this entry.
ROW swACLIpRowStatus	1.3.6.1.4.1.171.11.5.1.2.1.19	RowStatus	read-create	This object indicates the status of this entry.
INT swACLIpTCPFlagBitMask	1.3.6.1.4.1.171.11.5.1.2.1.115	INTEGER	read-create	A value which indicates the set of TCP flags that this entity may potentially offers. The value is a sum. This sum initially takes the value zero, Then, for each flag, L, in the range 1 through 6, that this node performs transactions for, 2 raised to (L - 1) is added to the sum. Note that values should be calculated accordingly: Flag functionality 6 urg bit 5 ack bit 4 psh bit 3 rst bit 2 syn bit 1 fin bit For example,it you want to enable urg bit and ack bit,you should set vlaue 48(2^(5-1) + 2^(6-1)).
swACLPayloadTable	1.3.6.1.4.1.171.11.5.1.3		not-accessible	This table contain ACL mask of payload information.
swACLPayloadEntry	1.3.6.1.4.1.171.11.5.1.3.1		not-accessible	This Entry contain ACL mask of payload information.
INT swACLPayloadProfileID	1.3.6.1.4.1.171.11.5.1.3.1.1	INTEGER	read-only	The ID of ACL mask entry ,and is unique in the mask list.
POR swACLPayloadPort	1.3.6.1.4.1.171.11.5.1.3.1.2	PortList	read-create	The portlist of ACL mask entry .
OCT swACLPayloadOffSet0to15	1.3.6.1.4.1.171.11.5.1.3.1.3	OCTET STRING	read-create	The offset of ACL mask entry .
OCT swACLPayloadOffSet16to31	1.3.6.1.4.1.171.11.5.1.3.1.4	OCTET STRING	read-create	The offset of ACL mask entry .
OCT swACLPayloadOffSet32to47	1.3.6.1.4.1.171.11.5.1.3.1.5	OCTET STRING	read-create	The offset of ACL mask entry .
OCT swACLPayloadOffSet48to63	1.3.6.1.4.1.171.11.5.1.3.1.6	OCTET STRING	read-create	The offset of ACL mask entry .
OCT swACLPayloadOffSet64to79	1.3.6.1.4.1.171.11.5.1.3.1.7	OCTET STRING	read-create	The offset of ACL mask entry .
ROW swACLPayloadRowStatus	1.3.6.1.4.1.171.11.5.1.3.1.8	RowStatus	read-create	The status of the entry .
swAclRuleMgmt	1.3.6.1.4.1.171.11.5.2
swACLEtherRuleTable	1.3.6.1.4.1.171.11.5.2.1		not-accessible	This table contain ACL rule of ethernet information.
swACLEtherRuleEntry	1.3.6.1.4.1.171.11.5.2.1.1		not-accessible	A list of information about ACL rule of the layer 2 part of each packet.
INT swACLEtherRuleProfileID	1.3.6.1.4.1.171.11.5.2.1.1.1	INTEGER	read-only	The ID of ACL mask entry ,and is unique in the mask list.
INT swACLEtherRuleAccessID	1.3.6.1.4.1.171.11.5.2.1.1.2	INTEGER	read-only	The ID of ACL rule entry relate to swACLEtherRuleProfileID.
STR swACLEtherRuleVlan	1.3.6.1.4.1.171.11.5.2.1.1.3	SnmpAdminString	read-create	Specifies that the access will apply to only to this VLAN.
MAC swACLEtherRuleSrcMacAddress	1.3.6.1.4.1.171.11.5.2.1.1.4	MacAddress	read-create	Specifies that the access will apply to only packets with this source MAC address.
MAC swACLEtherRuleDstMacAddress	1.3.6.1.4.1.171.11.5.2.1.1.5	MacAddress	read-create	Specifies that the access will apply to only packets with this destination MAC address.
INT swACLEtherRule8021P	1.3.6.1.4.1.171.11.5.2.1.1.6	INTEGER	read-create	Specifies that the access will apply only to packets with this 802.1p priority value.
OCT swACLEtherRuleEtherType	1.3.6.1.4.1.171.11.5.2.1.1.7	OCTET STRING	read-create	Specifies that the access will apply only to packets with this hexidecimal 802.1Q Ethernet type value in the packet header.
INT swACLEtherRuleEnablePriority	1.3.6.1.4.1.171.11.5.2.1.1.8	INTEGER	read-create	Specifies that the access will apply only to packets with priority value.
INT swACLEtherRulePriority	1.3.6.1.4.1.171.11.5.2.1.1.9	INTEGER	read-create	Specific the priority will change to the packets while the swACLEtherRuleReplacePriority is enabled .
INT swACLEtherRuleReplacePriority	1.3.6.1.4.1.171.11.5.2.1.1.10	INTEGER	read-create	Specific the packets that match the access profile will changed the 802.1p priority tag field by the switch or not .
INT swACLEtherRuleEnableReplaceDscp	1.3.6.1.4.1.171.11.5.2.1.1.11	INTEGER	read-create	Specific the packets that match the access profile will replaced the DSCP field by the switch or not .
INT swACLEtherRuleRepDscp	1.3.6.1.4.1.171.11.5.2.1.1.12	INTEGER	read-create	specify a value to be written to the DSCP field of an incoming packet that meets the criteria specified in the first part of the command. This value will over-write the value in the DSCP field of the packet.
INT swACLEtherRulePermit	1.3.6.1.4.1.171.11.5.2.1.1.14	INTEGER	read-create	This object indicates the permit status of this entry.
ROW swACLEtherRuleRowStatus	1.3.6.1.4.1.171.11.5.2.1.1.15	RowStatus	read-create	This object indicates the status of this entry.
swACLIpRuleTable	1.3.6.1.4.1.171.11.5.2.2		not-accessible
swACLIpRuleEntry	1.3.6.1.4.1.171.11.5.2.2.1		not-accessible
INT swACLIpRuleProfileID	1.3.6.1.4.1.171.11.5.2.2.1.1	INTEGER	read-only	The ID of ACL mask entry ,and is unique in the mask list.
INT swACLIpRuleAccessID	1.3.6.1.4.1.171.11.5.2.2.1.2	INTEGER	read-only	The ID of ACL IP rule entry .
STR swACLIpRuleVlan	1.3.6.1.4.1.171.11.5.2.2.1.3	SnmpAdminString	read-create	Specifies that the access will apply to only to this VLAN.
IP swACLIpRuleSrcIpaddress	1.3.6.1.4.1.171.11.5.2.2.1.4	IpAddress	read-create	Specific an IP source address.
IP swACLIpRuleDstIpaddress	1.3.6.1.4.1.171.11.5.2.2.1.5	IpAddress	read-create	Specific an IP destination address.
INT swACLIpRuleDscp	1.3.6.1.4.1.171.11.5.2.2.1.6	INTEGER	read-create	Specific the value of dscp, the value can be configured 0 to 63
INT swACLIpRuleProtocol	1.3.6.1.4.1.171.11.5.2.2.1.7	INTEGER	read-only	Specifies the IP protocol which has been configured in swACLIpEntry .
INT swACLIpRuleType	1.3.6.1.4.1.171.11.5.2.2.1.8	INTEGER	read-create	Specific that the rule applies to the value of icmp type traffic.
INT swACLIpRuleCode	1.3.6.1.4.1.171.11.5.2.2.1.9	INTEGER	read-create	Specific that the rule applies to the value of icmp code traffic.
INT swACLIpRuleSrcPort	1.3.6.1.4.1.171.11.5.2.2.1.10	INTEGER	read-create	Specific that the rule applies the range of tcp/udp source port
INT swACLIpRuleDstPort	1.3.6.1.4.1.171.11.5.2.2.1.11	INTEGER	read-create	Specific the range of tcp/udp destination port range
INT swACLIpRuleFlagBits	1.3.6.1.4.1.171.11.5.2.2.1.12	INTEGER	read-create	A value which indicates the set of TCP flags that this entity may potentially offers. The value is a sum. This sum initially takes the value zero, Then, for each flag, L, in the range 1 through 6, that this node performs transactions for, 2 raised to (L - 1) is added to the sum. Note that values should be calculated accordingly: Flag functionality 6 urg bit 5 ack bit 4 rsh bit 3 rst bit 2 syn bit 1 fin bit For example,it you want to enable urg bit and ack bit,you should set vlaue 48(2^(5-1) + 2^(6-1)).
INT swACLIpRuleProtoID	1.3.6.1.4.1.171.11.5.2.2.1.13	INTEGER	read-create	Specific that the rule applies to the value of ip protocol id traffic
OCT swACLIpRuleUserMask	1.3.6.1.4.1.171.11.5.2.2.1.14	OCTET STRING	read-create	Specific that the rule applies to the ip protocol id and the range of options behind the IP header.
INT swACLIpRuleEnablePriority	1.3.6.1.4.1.171.11.5.2.2.1.15	INTEGER	read-create	Specifies that the access will apply only to packets with priority value.
INT swACLIpRulePriority	1.3.6.1.4.1.171.11.5.2.2.1.16	INTEGER	read-create	Specifies that the access profile will apply to packets that contain this value in their 802.1p priority field of their header.
INT swACLIpRuleReplacePriority	1.3.6.1.4.1.171.11.5.2.2.1.17	INTEGER	read-create	Specific the packets that match the access profile will changed the 802.1p priority tag field by the switch or not .
INT swACLIpRuleEnableReplaceDscp	1.3.6.1.4.1.171.11.5.2.2.1.18	INTEGER	read-create	Indicate weather the DSCP field can be over-write or not.
INT swACLIpRuleRepDscp	1.3.6.1.4.1.171.11.5.2.2.1.19	INTEGER	read-create	specify a value to be written to the DSCP field of an incoming packet that meets the criteria specified in the first part of the command. This value will over-write the value in the DSCP field of the packet.
INT swACLIpRulePermit	1.3.6.1.4.1.171.11.5.2.2.1.21	INTEGER	read-create
ROW swACLIpRuleRowStatus	1.3.6.1.4.1.171.11.5.2.2.1.22	RowStatus	read-create	This object indicates the status of this entry.
swACLPayloadRuleTable	1.3.6.1.4.1.171.11.5.2.3		not-accessible
swACLPayloadRuleEntry	1.3.6.1.4.1.171.11.5.2.3.1		not-accessible
INT swACLPayloadRuleProfileID	1.3.6.1.4.1.171.11.5.2.3.1.1	INTEGER	read-only	The ID of ACL RULE entry ,and is unique in the mask list.
INT swACLPayloadRuleAccessID	1.3.6.1.4.1.171.11.5.2.3.1.2	INTEGER	read-only	th id of the entry
OCT swACLPayloadRuleOffSet0to15	1.3.6.1.4.1.171.11.5.2.3.1.4	OCTET STRING	read-create	The offset of ACL rule entry .
OCT swACLPayloadRuleOffSet16to31	1.3.6.1.4.1.171.11.5.2.3.1.5	OCTET STRING	read-create	The offset of ACL rule entry .
OCT swACLPayloadRuleOffSet32to47	1.3.6.1.4.1.171.11.5.2.3.1.6	OCTET STRING	read-create	The offset of ACL rule entry .
OCT swACLPayloadRuleOffSet48to63	1.3.6.1.4.1.171.11.5.2.3.1.7	OCTET STRING	read-create	The offset of ACL rule entry .
OCT swACLPayloadRuleOffSet64to79	1.3.6.1.4.1.171.11.5.2.3.1.8	OCTET STRING	read-create	The offset of ACL rule entry .
INT swACLPayloadRuleEnablePriority	1.3.6.1.4.1.171.11.5.2.3.1.9	INTEGER	read-create
INT swACLPayloadRulePriority	1.3.6.1.4.1.171.11.5.2.3.1.10	INTEGER	read-create	Specifies that the access profile will apply to packets that contain this value in their 802.1p priority field of their header.
INT swACLPayloadRuleReplacePriority	1.3.6.1.4.1.171.11.5.2.3.1.11	INTEGER	read-create
INT swACLPayloadRuleEnableReplaceDscp	1.3.6.1.4.1.171.11.5.2.3.1.12	INTEGER	read-create	Indicate wether the DSCP field can be over-write or not
INT swACLPayloadRuleRepDscp	1.3.6.1.4.1.171.11.5.2.3.1.13	INTEGER	read-create	specify a value to be written to the DSCP field of an incoming packet that meets the criteria specified in the first part of the command. This value will over-write the value in the DSCP field of the packet.
INT swACLPayloadRulePermit	1.3.6.1.4.1.171.11.5.2.3.1.14	INTEGER	read-create	The offset of ACL rule entry .
ROW swACLPayloadRuleRowStatus	1.3.6.1.4.1.171.11.5.2.3.1.15	RowStatus	read-create	The status of ACL rule entry .

RFC description

Access control list management MIB for D-Link switches supporting Ethernet, IP, and TCP flag filtering.

Start monitoring managed Ethernet switch, proprietary/OEM switch platform (ACL rule/port-binding config) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download SW-ACLMGMT-MIB

What Is SW-ACLMGMT-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description