T11-FC-SP-ZONING-MIB

All MIBs › T11-FC-SP-ZONING-MIB

Organization: This MIB module was developed through the coordinated effort of two organizations: T11 began the development and the IETF (in the IMSS Working Group) finished it.

Last Updated: 2008-08-20

Category: Fibre Channel and Storage

Description: Extends the FC Zone Server MIB with managed objects for FC-SP Zoning Server management, providing security extensions to fabric zoning.

IPNetwork Monitor uses several OIDs from this MIB in network discovery and polling the applicable devices. Start monitoring T11-FC-SP-ZONING-MIB with a free 30-day trial of IPNetwork Monitor.

What Is T11-FC-SP-ZONING-MIB?

T11-FC-SP-ZONING-MIB is an ANSI T11-defined, IETF-published extension MIB that adds Fibre Channel Security Protocol (FC-SP) support to the base T11-FC-ZONE-SERVER-MIB, covering secure zoning server capabilities in a SAN fabric. It exposes configuration and operational data about zoning server security capabilities, whether FC-SP is enabled on a zoning server, and cryptographic hash values used to verify the integrity of active and database zone sets. Its monitoring value is chiefly about configuration integrity and security posture rather than physical hardware, letting an administrator confirm zoning security is enabled and that zone set hashes match expected values, alongside statistics counters for FC-SP protocol message activity. It explicitly extends and depends on the T11-FC-ZONE-SERVER-MIB, inheriting that module's object persistence and storage-type semantics. It is deployed in Fibre Channel SAN fabrics where FC-SP secure zoning is used to prevent unauthorized zone set changes. Engineers can download the T11-FC-SP-ZONING-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in T11-FC-SP-ZONING-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Fibre Channel switches and directors with FC-SP zoning support
vendor-neutral, standards-based MIB, not tied to a specific manufacturer

Monitoring Examples

An administrator would check t11FcSpZsServerTable entries for t11FcSpZsServerEnabled to confirm FC-SP protection is active on a given zoning server, and compare t11FcSpActiveZoneSetHash against a known-good value to detect unauthorized or unexpected zone set tampering. t11FcSpZoneSetHashStatus indicates whether the hash computation is current or stale, which matters after a zone set edit. The t11FcSpZsStatsTable, with counters such as t11FcSpZsSPCMITrequestsSent, lets an operator track FC-SP protocol chatter volume and spot abnormal spikes that might indicate a misbehaving or attacking node. A mismatch in t11FcSpActiveZoneSetHash across switches in the same fabric would flag a zoning database inconsistency.

What Can Be Monitored

FC-SP enabled status on zoning server
active zone set hash value
zone set database hash value
zone set hash computation status
FC-SP protocol request/response counters

Imported Objects

From IF-MIB

ifIndex

OBJECT-TYPE

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Counter32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
mib-2

From SNMPv2-TC

TruthValue

From T11-FC-SP-TC-MIB

T11FcSpHashCalculationStatus
T11FcSpPolicyHashFormat
T11FcSpPolicyHashValue

From T11-FC-ZONE-SERVER-MIB

t11ZsFabricIndex	OBJECT-TYPE
t11ZsNotifyControlEntry	OBJECT-TYPE
t11ZsServerEntry	OBJECT-TYPE
t11ZsStatsEntry	OBJECT-TYPE

How to Use in IPNetwork Monitor

Example using t11FcSpZsSPCMITrequestsSent OID:

Select a Fibre Channel switches and directors with FC-SP zoning support (secure zoning capability/hash-integrity status) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type t11FcSpZsSPCMITrequestsSent into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. The number of SP Commit Zone Changes (SPCMIT) operation requests sent by the Zone Server. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
t11FcSpZoningMIB	1.3.6.1.2.1.177			This MIB module specifies the extensions to the T11-FC-ZONE-SERVER-MIB module that are necessary for the management of Fibre Channel's FC-SP Zoning Servers, as defined in the FC-SP specification. The persistence of values written to these MIB objects is the same as the persistence of the objects they extend, i.e., it is given by the value of the relevant instance of t11ZsServerDatabaseStorageType (defined in the T11-FC-ZONE-SERVER-MIB module). Copyright (C) The IETF Trust (2008). This version of this MIB module is part of RFC 5324; see the RFC itself for full legal notices.
t11FcSpZsMIBNotifications	1.3.6.1.2.1.177.0
NTF t11FcSpZsFabricJoinSuccessNotify	1.3.6.1.2.1.177.0.1			This notification indicates that a Switch that is part of one Fabric (indicated by the value of t11ZsFabricIndex) has successfully joined (on the interface indicated by the value of ifIndex) with a Switch that is part of another Fabric. If multiple Virtual Fabrics are configured on an interface, and all are successfully joined at the same time, and if the agent so chooses, then it can generate just one notification in which t11ZsFabricIndex has the value 4096.
NTF t11FcSpZsFabricJoinFailureNotify	1.3.6.1.2.1.177.0.2			This notification indicates that an E_Port on the local Switch has entered the Isolated state because a join between two Fabrics failed. The failure occurred on the local Fabric indicated by the value of t11ZsFabricIndex, on the interface indicated by the value of ifIndex. If multiple Virtual Fabrics are configured on an interface, and all have a failure to join at the same time, and if the agent so chooses, then it can generate just one notification in which t11ZsFabricIndex has the value 4096.
t11FcSpZsMIBObjects	1.3.6.1.2.1.177.1
t11FcSpZsConfiguration	1.3.6.1.2.1.177.1.1
t11FcSpZsServerTable	1.3.6.1.2.1.177.1.1.1		not-accessible	A table which provides FC-SP-specific information about the Zone Servers on each Fabric in one or more Switches.
t11FcSpZsServerEntry	1.3.6.1.2.1.177.1.1.1.1		not-accessible	Each entry contains information relevant to FC-SP for a particular Zone Server for a particular Fabric on a particular Switch. The Fabric and Switch are identified in the same manner as in t11ZsServerEntry.
BIT t11FcSpZsServerCapabilityObject	1.3.6.1.2.1.177.1.1.1.1.1	Bits	read-only	Capabilities of the Zone Server for the particular Fabric on the particular Switch, with respect to FC-SP Zoning: fcSpZoning -- set to 1 to indicate the Switch is capable of supporting FC-SP Zoning.
T/F t11FcSpZsServerEnabled	1.3.6.1.2.1.177.1.1.1.1.2	TruthValue	read-write	This object indicates whether the Zone Server for the particular Fabric on the particular Switch, is operating in FC-SP Zoning mode.
T11 t11FcSpZoneSetHashStatus	1.3.6.1.2.1.177.1.1.1.1.3	T11FcSpHashCalculationStatus	read-write	When read, the value of this object is either: correct -- the corresponding instances of both t11FcSpActiveZoneSetHash and t11FcSpZoneSetDatabaseHash contain the correct hash values; or stale -- the corresponding instances of t11FcSpActiveZoneSetHash and t11FcSpZoneSetDatabaseHash contain stale (possibly incorrect) values; Writing a value of 'calculate' is a request to re-calculate and update the values of the corresponding instances of both t11FcSpActiveZoneSetHash and t11FcSpZoneSetDatabaseHash. Writing a value of 'correct' or 'stale' to this object is an error (e.g., 'wrongValue'). When the Active Zone Set and/or the Zone Set Database are updated, it is common that multiple changes need to be made at the same time. In such circumstances, the use of this object allows the hash values to be updated only once after all changes, rather than repeatedly/after each individual change. If and when the corresponding instance of t11ZsServerDatabaseStorageType has the value 'permanent(4)', then if write access is supported to any instance of a read-write object in any row of any table governed by the 'permanent' value of t11ZsServerDatabaseStorageType, then write access to the corresponding instance of this object must also be supported.
T11 t11FcSpActiveZoneSetHashType	1.3.6.1.2.1.177.1.1.1.1.4	T11FcSpPolicyHashFormat	read-only	The format used for the hash value contained in the corresponding instance of t11FcSpActiveZoneSetHash.
T11 t11FcSpActiveZoneSetHash	1.3.6.1.2.1.177.1.1.1.1.5	T11FcSpPolicyHashValue	read-only	The value of the hash for the current Active Zone Set. The format of this value is given by the corresponding instance of t11FcSpActiveZoneSetHashType.
T11 t11FcSpZoneSetDatabaseHashType	1.3.6.1.2.1.177.1.1.1.1.6	T11FcSpPolicyHashFormat	read-only	The format used for the hash value contained in the corresponding instance of t11FcSpZoneSetDatabaseHash.
T11 t11FcSpZoneSetDatabaseHash	1.3.6.1.2.1.177.1.1.1.1.7	T11FcSpPolicyHashValue	read-only	The value of the hash for the current Zone Set Database. The format of this value is given by the corresponding instance of t11FcSpZoneSetDatabaseHashType.
t11FcSpZsNotifyControlTable	1.3.6.1.2.1.177.1.1.2		not-accessible	A table of control information for notifications generated due to Zone Server events related to FC-SP Zoning.
t11FcSpZsNotifyControlEntry	1.3.6.1.2.1.177.1.1.2.1		not-accessible	Each entry is an augmentation of the notification control information for a Zone Server for a particular Fabric on a particular Switch. The Fabric and Switch are identified in the same manner as in t11ZsNotifyControlEntry.
T/F t11FcSpZsNotifyJoinSuccessEnable	1.3.6.1.2.1.177.1.1.2.1.1	TruthValue	read-write	This object specifies whether t11FcSpZsFabricJoinFailureNotify notifications should be generated by the Zone Server for this Fabric.
T/F t11FcSpZsNotifyJoinFailureEnable	1.3.6.1.2.1.177.1.1.2.1.2	TruthValue	read-write	This object specifies whether t11FcSpZsFabricJoinSuccessNotify notifications should be generated by the Zone Server for this Fabric.
t11FcSpZsStatistics	1.3.6.1.2.1.177.1.2
t11FcSpZsStatsTable	1.3.6.1.2.1.177.1.2.1		not-accessible	A table of statistics specific to FC-SP that are maintained by Zone Servers.
t11FcSpZsStatsEntry	1.3.6.1.2.1.177.1.2.1.1		not-accessible	A set of statistics specific to FC-SP for a particular Zone Server for a particular Fabric on a particular Switch. The Fabric and Switch are identified in the same manner as in t11ZsStatsEntry.
C32 t11FcSpZsSPCMITrequestsSentEx	1.3.6.1.2.1.177.1.2.1.1.1	Counter32	read-only	The number of SP Commit Zone Changes (SPCMIT) operation requests sent by the Zone Server. This counter has no discontinuities other than those that all Counter32's have when sysUpTime=0.
C32 t11FcSpZsSPCMITrequestsAccepted	1.3.6.1.2.1.177.1.2.1.1.2	Counter32	read-only	The number of SP Commit Zone Changes (SPCMIT) operation requests received and accepted by the Zone Server. This counter has no discontinuities other than those that all Counter32's have when sysUpTime=0.
C32 t11FcSpZsSPCMITrequestsRejected	1.3.6.1.2.1.177.1.2.1.1.3	Counter32	read-only	The number of SP Commit Zone Changes (SPCMIT) operation requests received but rejected by the Zone Server. This counter has no discontinuities other than those that all Counter32's have when sysUpTime=0.
C32 t11FcSpZsZcpRequestsSent	1.3.6.1.2.1.177.1.2.1.1.4	Counter32	read-only	The number of Zoning Check Protocol (ZCP) requests sent by the Zone Server. This counter has no discontinuities other than those that all Counter32's have when sysUpTime=0.
C32 t11FcSpZsZcpRequestsAccepted	1.3.6.1.2.1.177.1.2.1.1.5	Counter32	read-only	The number of Zoning Check Protocol (ZCP) requests received and accepted by the Zone Server. This counter has no discontinuities other than those that all Counter32's have when sysUpTime=0.
C32 t11FcSpZsZcpRequestsRejected	1.3.6.1.2.1.177.1.2.1.1.6	Counter32	read-only	The number of Zoning Check Protocol (ZCP) requests received but rejected by the Zone Server. This counter has no discontinuities other than those that all Counter32's have when sysUpTime=0.
C32 t11FcSpZsZirRequestsAccepted	1.3.6.1.2.1.177.1.2.1.1.7	Counter32	read-only	The number of Zoning Information Request (ZIR) requests received and accepted by the Zone Server. This counter has no discontinuities other than those that all Counter32's have when sysUpTime=0.
C32 t11FcSpZsZirRequestsRejected	1.3.6.1.2.1.177.1.2.1.1.8	Counter32	read-only	The number of Zoning Information Request (ZIR) requests received but rejected by the Zone Server. This counter has no discontinuities other than those that all Counter32's have when sysUpTime=0.
t11FcSpZsMIBConformance	1.3.6.1.2.1.177.2
t11FcSpZsMIBCompliances	1.3.6.1.2.1.177.2.1
t11FcSpZsMIBCompliance	1.3.6.1.2.1.177.2.1.1			The compliance statement for entities that implement the extensions specified in FC-SP for Fibre Channel's Zone Server.
t11FcSpZsMIBGroups	1.3.6.1.2.1.177.2.2
t11FcSpZsObjectsGroup	1.3.6.1.2.1.177.2.2.1			A collection of objects for Zone configuration information of a Zone Server capable of operating in FC-SP Zoning mode.
t11FcSpZsNotificationControlGroup	1.3.6.1.2.1.177.2.2.2			A collection of notification control objects for monitoring Zone Server failures specific to FC-SP.
t11FcSpZsStatisticsGroup	1.3.6.1.2.1.177.2.2.3			A collection of objects for collecting Zone Server statistics which are specific to FC-SP.
t11FcSpZsNotificationGroup	1.3.6.1.2.1.177.2.2.4			A collection of notification(s) for monitoring Zone Server events that are specific to FC-SP.

RFC description

Manages Fibre Channel Security Protocol zone server configuration and policy hash verification.

Start monitoring Fibre Channel switches and directors with FC-SP zoning support (secure zoning capability/hash-integrity status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download T11-FC-SP-ZONING-MIB