SW-DES3x50-ACLMGMT-MIB

All MIBs › SW-DES3x50-ACLMGMT-MIB

Organization: enterprise, Inc.

Last Updated: 2000-07-15

Category: Access Control, Switch Management - D-Link

Description: Manages ACL policy rules and access control list bindings on D-Link DES-3x50 series switches.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is SW-DES3x50-ACLMGMT-MIB?

The SW-DES3x50-ACLMGMT-MIB is a D-Link proprietary MIB for the DES-3x50 series switches, defining the structure for Access Control List (ACL) policy rules and their bindings to switch ports or VLANs. It is primarily a configuration MIB, exposing the rule definitions, match criteria, and actions that make up ACL policies enforced by the switch's forwarding hardware. From a monitoring perspective it lets an administrator verify which ACL rules are currently active and bound, which is useful for confirming that security policy intent, such as blocking a subnet, matches what is actually programmed into the switch. It has no explicit dependency on other MIBs beyond D-Link's own private enterprise tree, though it parallels concepts found in generic access-control-list conventions. It is deployed on D-Link DES-3x50 series managed switches in small-to-midsize enterprise networks needing port- or VLAN-level traffic filtering. Engineers can download the SW-DES3x50-ACLMGMT-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in SW-DES3x50-ACLMGMT-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

D-Link DES-3x50 series switches

Monitoring Examples

An administrator could poll the ACL rule and binding tables to confirm a filtering rule intended to block a given source address is still bound to the correct port, catching cases where a configuration change silently removed or reordered an ACL entry. Because sample object names were not available, exact table names should be confirmed against the DES-3x50 MIB source before automated polling.

What Can Be Monitored

ACL rule definitions
ACL-to-port bindings
ACL policy status

Imported Objects

From DLINK-ID-REC-MIB

dlink-mgmt

From Q-BRIDGE-MIB

PortList

From RFC1213-MIB

DisplayString

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-SMI

Counter32
Counter64
IpAddress
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
TimeTicks
Unsigned32

From SNMPv2-TC

MacAddress
RowStatus

OIDs

OID symbolic	OID numeric	Type	Access	Description
swAclMgmtMIB	1.3.6.1.4.1.171.11.5			The Structure of Access Control List Information for the proprietary enterprise.
swAclMaskMgmt	1.3.6.1.4.1.171.11.5.1
swACLEthernetTable	1.3.6.1.4.1.171.11.5.1.1		not-accessible	This table contain ACL mask of Ethernet information. Access profiles will be created on the switch by row creation and to define which parts of each incoming frame's layer 2 part of header the switch will examine. Masks can be entered that will be combined with the values the switch finds in the specified frame header fields.
swACLEthernetEntry	1.3.6.1.4.1.171.11.5.1.1.1		not-accessible	A list of information about ACL of Ethernet.
INT swACLEthernetProfileID	1.3.6.1.4.1.171.11.5.1.1.1.1	INTEGER	read-only	The ID of ACL mask entry ,and is unique in the mask list.
INT swACLEthernetUsevlan	1.3.6.1.4.1.171.11.5.1.1.1.2	INTEGER	read-create	Specifies that the switch will examine the VLAN part of each packet header.
INT swACLEthernetMacAddrMaskState	1.3.6.1.4.1.171.11.5.1.1.1.3	INTEGER	read-create	This object indicates the status of MAC address mask. other(1) - Neither source MAC address nor destination MAC address are masked. dst-mac-addr(2) - recieved frames's destination MAC address are currently used to be filtered as it meets with the MAC address entry of the table. src-mac-addr(3) - recieved frames's source MAC address are currently used to be filtered as it meets with the MAC address entry of the table. dst-src-mac-addr(4) - recieved frames's destination MAC address or source MAC address are currently used to be filtered as it meets with the MAC address entry of the table.
MAC swACLEthernetSrcMacAddrMask	1.3.6.1.4.1.171.11.5.1.1.1.4	MacAddress	read-create	This object Specifies the MAC address mask for the source MAC address.
MAC swACLEthernetDstMacAddrMask	1.3.6.1.4.1.171.11.5.1.1.1.5	MacAddress	read-create	This object Specifies the MAC address mask for the destination MAC address.
INT swACLEthernetUse8021p	1.3.6.1.4.1.171.11.5.1.1.1.6	INTEGER	read-create	Specifies if the switch will examine the 802.1p priority value in the frame's header or not.
INT swACLEthernetUseEthernetType	1.3.6.1.4.1.171.11.5.1.1.1.7	INTEGER	read-create	Specifies if the switch will examine the Ethernet type value in each frame's header or not.
POR swACLEthernetPort	1.3.6.1.4.1.171.11.5.1.1.1.8	PortList	read-create	.
ROW swACLEthernetRowStatus	1.3.6.1.4.1.171.11.5.1.1.1.9	RowStatus	read-create	This object indicates the status of this entry.
swACLIpTable	1.3.6.1.4.1.171.11.5.1.2		not-accessible	This table contain ACL mask of IP information. Access profiles will be created on the switch by row creation and to define which parts of each incoming frame's IP layer part of header the switch will examine. Masks can be entered that will be combined with the values the switch finds in the specified frame header fields.
swACLIpEntry	1.3.6.1.4.1.171.11.5.1.2.1		not-accessible	A list of information about ACL of IP Layer.
INT swACLIpProfileID	1.3.6.1.4.1.171.11.5.1.2.1.1	INTEGER	read-only	The ID of ACL mask entry ,and is unique in the mask list.
INT swACLIpUsevlan	1.3.6.1.4.1.171.11.5.1.2.1.2	INTEGER	read-create	This object indicates if IP layer vlan is examined or not.
INT swACLIpIpAddrMaskState	1.3.6.1.4.1.171.11.5.1.2.1.3	INTEGER	read-create	This object indicates the status of IP address mask. other(1) - Neither source IP address nor destination IP address are masked. dst-ip-addr(2) - recieved frames's destination IP address are currently used to be filtered as it meets with the IP address entry of the table. src-ip-addr(3) - recieved frames's source IP address are currently used to be filtered as it meets with the IP address entry of the table. dst-src-ip-addr(4) - recieved frames's destination IP address or source IP address are currently used to be filtered as it meets with the IP address entry of the table.
IP swACLIpSrcIpAddrMask	1.3.6.1.4.1.171.11.5.1.2.1.4	IpAddress	read-create	This object Specifies IP address mask for the source IP address.
IP swACLIpDstIpAddrMask	1.3.6.1.4.1.171.11.5.1.2.1.5	IpAddress	read-create	This object Specifies the IP address mask for the destination IP address.
INT swACLIpUseDSCP	1.3.6.1.4.1.171.11.5.1.2.1.6	INTEGER	read-create	This object indicates DSCP protocol is is examined or not.
INT swACLIpUseProtoType	1.3.6.1.4.1.171.11.5.1.2.1.7	INTEGER	read-create	That object indicates which protocol will be examined.
INT swACLIpIcmpOption	1.3.6.1.4.1.171.11.5.1.2.1.8	INTEGER	read-create	This object indicates which fields should be filled in of ICMP. none(1)- two fields are null. type(2)- type field should be filled in. code(3)- code field should be filled in. type-code(4)- not only type fileld but code field should be filled in.
INT swACLIpIgmpOption	1.3.6.1.4.1.171.11.5.1.2.1.9	INTEGER	read-create	This object indicates Options of IGMP is examined or not.
INT swACLIpTcpOption	1.3.6.1.4.1.171.11.5.1.2.1.10	INTEGER	read-create	This object indicates the status of filtered address of TCP. other(1) - Neither source port nor destination port are masked. dst-addr(2) - recieved frames's destination port are currently used to be filtered . src-addr(3) - recieved frames's source port are currently used to be filtered . dst-src-addr(4) - both recieved frames's destination port and source port are currently used to be filtered .
INT swACLIpUdpOption	1.3.6.1.4.1.171.11.5.1.2.1.11	INTEGER	read-create	This object indicates the status of filtered address of UDP . other(1) - Neither source port nor destination port are masked. dst-addr(2) - recieved frames's destination port are currently used to be filtered . src-addr(3) - recieved frames's source port are currently used to be filtered . dst-src-addr(4) - recieved frames's destination port or source port are currently used to be filtered.
OCT swACLIpTCPorUDPSrcPortMask	1.3.6.1.4.1.171.11.5.1.2.1.12	OCTET STRING	read-create	Specifies a TCP port mask for the source port if swACLIpUseProtoType is TCP Specifies a UDP port mask for the source port if swACLIpUseProtoType is UDP.
OCT swACLIpTCPorUDPDstPortMask	1.3.6.1.4.1.171.11.5.1.2.1.13	OCTET STRING	read-create	Specifies a TCP port mask for the destination port if swACLIpUseProtoType is TCP Specifies a UDP port mask for the destination port if swACLIpUseProtoType is UDP.
INT swACLIpTCPFlagBit	1.3.6.1.4.1.171.11.5.1.2.1.14	INTEGER	read-create	Specifies a TCP connection flag mask.
INT swACLIpProtoIDOption	1.3.6.1.4.1.171.11.5.1.2.1.15	INTEGER	read-create	Specifies that the switch will examine each frame's Protocol ID field or not.
OCT swACLIpProtoIDMask	1.3.6.1.4.1.171.11.5.1.2.1.16	OCTET STRING	read-create	Specifies that the rule applies to the IP protocol ID and the mask options behind the IP header.
POR swACLIpPort	1.3.6.1.4.1.171.11.5.1.2.1.17	PortList	read-create	.
ROW swACLIpRowStatus	1.3.6.1.4.1.171.11.5.1.2.1.18	RowStatus	read-create	This object indicates the status of this entry.
swACLPayloadTable	1.3.6.1.4.1.171.11.5.1.3		not-accessible
swACLPayloadEntry	1.3.6.1.4.1.171.11.5.1.3.1		not-accessible
INT swACLPayloadProfileID	1.3.6.1.4.1.171.11.5.1.3.1.1	INTEGER	read-only	.
OCT swACLPayloadOffSet0to15	1.3.6.1.4.1.171.11.5.1.3.1.2	OCTET STRING	read-create	.
OCT swACLPayloadOffSet16to31	1.3.6.1.4.1.171.11.5.1.3.1.3	OCTET STRING	read-create	.
OCT swACLPayloadOffSet32to47	1.3.6.1.4.1.171.11.5.1.3.1.4	OCTET STRING	read-create	.
OCT swACLPayloadOffSet48to63	1.3.6.1.4.1.171.11.5.1.3.1.5	OCTET STRING	read-create	.
OCT swACLPayloadOffSet64to79	1.3.6.1.4.1.171.11.5.1.3.1.6	OCTET STRING	read-create	.
POR swACLPayloadPort	1.3.6.1.4.1.171.11.5.1.3.1.7	PortList	read-create	.
ROW swACLPayloadRowStatus	1.3.6.1.4.1.171.11.5.1.3.1.8	RowStatus	read-create	.
swAclRuleMgmt	1.3.6.1.4.1.171.11.5.2
swACLEtherRuleTable	1.3.6.1.4.1.171.11.5.2.1		not-accessible	This table contain ACL rule of ethernet information.
swACLEtherRuleEntry	1.3.6.1.4.1.171.11.5.2.1.1		not-accessible	A list of information about ACL rule of the layer 2 part of each packet.
INT swACLEtherRuleProfileID	1.3.6.1.4.1.171.11.5.2.1.1.1	INTEGER	read-only	The ID of ACL mask entry ,and is unique in the mask list.
INT swACLEtherRuleAccessID	1.3.6.1.4.1.171.11.5.2.1.1.2	INTEGER	read-only	The ID of ACL rule entry relate to swACLEtherRuleProfileID.
STR swACLEtherRuleVlan	1.3.6.1.4.1.171.11.5.2.1.1.3	SnmpAdminString	read-create	Specifies that the access will apply to only to this VLAN.
MAC swACLEtherRuleSrcMacAddress	1.3.6.1.4.1.171.11.5.2.1.1.4	MacAddress	read-create	Specifies that the access will apply to only packets with this source MAC address.
MAC swACLEtherRuleDstMacAddress	1.3.6.1.4.1.171.11.5.2.1.1.5	MacAddress	read-create	Specifies that the access will apply to only packets with this destination MAC address.
INT swACLEtherRule8021P	1.3.6.1.4.1.171.11.5.2.1.1.6	INTEGER	read-create	Specifies that the access will apply only to packets with this 802.1p priority value.
OCT swACLEtherRuleEtherType	1.3.6.1.4.1.171.11.5.2.1.1.7	OCTET STRING	read-create	Specifies that the access will apply only to packets with this hexidecimal 802.1Q Ethernet type value in the packet header.
INT swACLEtherRuleEnablePriority	1.3.6.1.4.1.171.11.5.2.1.1.8	INTEGER	read-create	Specifies that the access will apply only to packets with priority value.
INT swACLEtherRulePriority	1.3.6.1.4.1.171.11.5.2.1.1.9	INTEGER	read-create	Specific the priority will change to the packets while the swACLEtherRuleReplacePriority is enabled .
INT swACLEtherRuleReplacePriority	1.3.6.1.4.1.171.11.5.2.1.1.10	INTEGER	read-create	Specific the packets that match the access profile will changed the 802.1p priority tag field by the switch or not .
INT swACLEtherRuleEnableReplaceDscp	1.3.6.1.4.1.171.11.5.2.1.1.11	INTEGER	read-create	Specific the packets that match the access profile will replaced the DSCP field by the switch or not .
INT swACLEtherRuleRepDscp	1.3.6.1.4.1.171.11.5.2.1.1.12	INTEGER	read-create	specify a value to be written to the DSCP field of an incoming packet that meets the criteria specified in the first part of the command. This value will over-write the value in the DSCP field of the packet.
INT swACLEtherRulePermit	1.3.6.1.4.1.171.11.5.2.1.1.13	INTEGER	read-create	This object indicates resoult of examination is permit or deny;default is permit(1) permit - Specifies that packets that match the access profile are permitted to be forwarded by the switch. deny - Specifies that packets that do not match the access profile are not permitted to be forwarded by the switch and will be filtered.
ROW swACLEtherRuleRowStatus	1.3.6.1.4.1.171.11.5.2.1.1.14	RowStatus	read-create	This object indicates the status of this entry.
swACLIpRuleTable	1.3.6.1.4.1.171.11.5.2.2		not-accessible	.
swACLIpRuleEntry	1.3.6.1.4.1.171.11.5.2.2.1		not-accessible	.
INT swACLIpRuleProfileID	1.3.6.1.4.1.171.11.5.2.2.1.1	INTEGER	read-only	The ID of ACL mask entry ,and is unique in the mask list.
INT swACLIpRuleAccessID	1.3.6.1.4.1.171.11.5.2.2.1.2	INTEGER	read-only	The ID of ACL IP rule entry .
STR swACLIpRuleVlan	1.3.6.1.4.1.171.11.5.2.2.1.3	SnmpAdminString	read-create	Specifies that the access will apply to only to this VLAN.
IP swACLIpRuleSrcIpaddress	1.3.6.1.4.1.171.11.5.2.2.1.4	IpAddress	read-create	Specific an IP source address.
IP swACLIpRuleDstIpaddress	1.3.6.1.4.1.171.11.5.2.2.1.5	IpAddress	read-create	Specific an IP destination address.
INT swACLIpRuleDscp	1.3.6.1.4.1.171.11.5.2.2.1.6	INTEGER	read-create	Specific the value of dscp, the value can be configured 0 to 63
INT swACLIpRuleProtocol	1.3.6.1.4.1.171.11.5.2.2.1.7	INTEGER	read-only	Specifies the IP protocol which has been configured in swACLIpEntry .
INT swACLIpRuleType	1.3.6.1.4.1.171.11.5.2.2.1.8	INTEGER	read-create	Specific that the rule applies to the value of icmp type traffic.
INT swACLIpRuleCode	1.3.6.1.4.1.171.11.5.2.2.1.9	INTEGER	read-create	Specific that the rule applies to the value of icmp code traffic.
INT swACLIpRuleSrcPort	1.3.6.1.4.1.171.11.5.2.2.1.10	INTEGER	read-create	Specific that the rule applies the range of tcp/udp source port
INT swACLIpRuleDstPort	1.3.6.1.4.1.171.11.5.2.2.1.11	INTEGER	read-create	Specific the range of tcp/udp destination port range
INT swACLIpRuleFlagBits	1.3.6.1.4.1.171.11.5.2.2.1.12	INTEGER	read-create	A value which indicates the set of TCP flags that this entity may potentially offers. The value is a sum. This sum initially takes the value zero, Then, for each flag, L, in the range 1 through 6, that this node performs transactions for, 2 raised to (L - 1) is added to the sum. Note that values should be calculated accordingly: Flag functionality 6 urg bit 5 ack bit 4 rsh bit 3 rst bit 2 syn bit 1 fin bit For example,it you want to enable urg bit and ack bit,you should set vlaue 48(2^(5-1) + 2^(6-1)).
INT swACLIpRuleProtoID	1.3.6.1.4.1.171.11.5.2.2.1.13	INTEGER	read-create	Specific that the rule applies to the value of ip protocol id traffic
OCT swACLIpRuleUserMask	1.3.6.1.4.1.171.11.5.2.2.1.14	OCTET STRING	read-create	Specific that the rule applies to the ip protocol id and the range of options behind the IP header.
INT swACLIpRuleEnablePriority	1.3.6.1.4.1.171.11.5.2.2.1.15	INTEGER	read-create	Specifies that the access will apply only to packets with priority value.
INT swACLIpRulePriority	1.3.6.1.4.1.171.11.5.2.2.1.16	INTEGER	read-create	Specifies that the access profile will apply to packets that contain this value in their 802.1p priority field of their header.
INT swACLIpRuleReplacePriority	1.3.6.1.4.1.171.11.5.2.2.1.17	INTEGER	read-create	Specific the packets that match the access profile will changed the 802.1p priority tag field by the switch or not .
INT swACLIpRuleEnableReplaceDscp	1.3.6.1.4.1.171.11.5.2.2.1.18	INTEGER	read-create	Indicate weather the DSCP field can be over-write or not.
INT swACLIpRuleRepDscp	1.3.6.1.4.1.171.11.5.2.2.1.19	INTEGER	read-create	specify a value to be written to the DSCP field of an incoming packet that meets the criteria specified in the first part of the command. This value will over-write the value in the DSCP field of the packet.
INT swACLIpRulePermit	1.3.6.1.4.1.171.11.5.2.2.1.20	INTEGER	read-create	This object indicates filter is permit or deny; default is permit(1)
ROW swACLIpRuleRowStatus	1.3.6.1.4.1.171.11.5.2.2.1.21	RowStatus	read-create	This object indicates the status of this entry.
swACLPayloadRuleTable	1.3.6.1.4.1.171.11.5.2.3		not-accessible
swACLPayloadRuleEntry	1.3.6.1.4.1.171.11.5.2.3.1		not-accessible
INT swACLPayloadRuleProfileID	1.3.6.1.4.1.171.11.5.2.3.1.1	INTEGER	read-only
INT swACLPayloadRuleAccessID	1.3.6.1.4.1.171.11.5.2.3.1.2	INTEGER	read-only
OCT swACLPayloadRuleOffSet0to15	1.3.6.1.4.1.171.11.5.2.3.1.3	OCTET STRING	read-create
OCT swACLPayloadRuleOffSet16to31	1.3.6.1.4.1.171.11.5.2.3.1.4	OCTET STRING	read-create
OCT swACLPayloadRuleOffSet32to47	1.3.6.1.4.1.171.11.5.2.3.1.5	OCTET STRING	read-create
OCT swACLPayloadRuleOffSet48to63	1.3.6.1.4.1.171.11.5.2.3.1.6	OCTET STRING	read-create
OCT swACLPayloadRuleOffSet64to79	1.3.6.1.4.1.171.11.5.2.3.1.7	OCTET STRING	read-create
INT swACLPayloadRuleEnablePriority	1.3.6.1.4.1.171.11.5.2.3.1.8	INTEGER	read-create
INT swACLPayloadRulePriority	1.3.6.1.4.1.171.11.5.2.3.1.9	INTEGER	read-create	Specifies that the access profile will apply to packets that contain this value in their 802.1p priority field of their header.
INT swACLPayloadRuleReplacePriority	1.3.6.1.4.1.171.11.5.2.3.1.10	INTEGER	read-create
INT swACLPayloadRuleEnableReplaceDscp	1.3.6.1.4.1.171.11.5.2.3.1.11	INTEGER	read-create	Indicate wether the DSCP field can be over-write or not
INT swACLPayloadRuleRepDscp	1.3.6.1.4.1.171.11.5.2.3.1.12	INTEGER	read-create	specify a value to be written to the DSCP field of an incoming packet that meets the criteria specified in the first part of the command. This value will over-write the value in the DSCP field of the packet.
INT swACLPayloadRulePermit	1.3.6.1.4.1.171.11.5.2.3.1.13	INTEGER	read-create
ROW swACLPayloadRuleRowStatus	1.3.6.1.4.1.171.11.5.2.3.1.14	RowStatus	read-create

RFC description

Manages access control lists on D-Link switches for Ethernet and IP traffic filtering and masking.

Start monitoring D-Link DES-3x50 series switch (ACL policy rule/port-VLAN binding config) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download SW-DES3x50-ACLMGMT-MIB

What Is SW-DES3x50-ACLMGMT-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description