TN-ACL-MIB

All MIBs › TN-ACL-MIB

Organization: Transition Networks, Inc.

Last Updated: 2013-05-16

Category: Security and Filtering, Transition Networks Media Converters

Description: Manages Transition Networks media converter ACL rule configuration and access control enforcement.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is TN-ACL-MIB?

TN-ACL-MIB is a Transition Networks proprietary SNMP module for their managed media-converter and switch product line, defining per-port access control list (ACL) enforcement configuration. It exposes per-port ACL policy binding, action (permit/deny), rate-limiter and EVC policer associations, redirect and mirror settings, and administrative shutdown/logging state for ACL violations. Its monitoring value is primarily security/configuration-policy visibility: an operator can confirm which ACL policy and rate limiter is applied to a port and whether a port has been administratively shut down due to ACL enforcement (tnAclPortShutdownState), which functions as a fault indicator for that port. It is a vendor-specific module without dependency on broader IETF ACL standards, tied to Transition Networks' own switching architecture. It is deployed on Transition Networks managed Ethernet switches and media converters in industrial or access-layer network segments requiring port-level traffic filtering. Engineers can download the TN-ACL-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in TN-ACL-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Transition Networks managed Ethernet switches
Transition Networks media converters with ACL support

Monitoring Examples

An operator polls tnAclPortTable/tnAclPortEntry to check tnAclPortAclState and tnAclPortPolicyId for a given port, confirming the expected ACL policy is enforced. The tnAclPortShutdownState reveals whether a port was automatically disabled due to a policy violation, an important status check after a security event, and tnAclPortLoggingState confirms whether such violations are being logged. The tnAclPortRateLimiterId and tnAclPortEvcPolicerId bindings are checked when unexpected traffic throttling is observed on a port.

What Can Be Monitored

per-port ACL policy and action
port shutdown state due to ACL violation
rate limiter / EVC policer association
ACL violation logging state

Imported Objects

From ENTITY-MIB

entPhysicalIndex

OBJECT-TYPE

From IF-MIB

InterfaceIndexOrZero
ifIndex	OBJECT-TYPE

From INET-ADDRESS-MIB

InetAddress

From Q-BRIDGE-MIB

PortList
VlanIdOrAny
VlanIdOrAnyOrNone
VlanIdOrNone

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Integer32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

MacAddress
RowStatus
StorageType
TEXTUAL-CONVENTION
TruthValue

From TN-MGMT-MIB

tnDevMgmt

OBJECT-IDENTITY

How to Use in IPNetwork Monitor

Example using tnAclPortCounter OID:

Select a Transition Networks managed Ethernet switches, media converters with ACL support (per-port ACL policy/shutdown status) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type tnAclPortCounter into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. Counts the number of frames that match this ACE. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
tnAclMgmt	1.3.6.1.4.1.868.2.5.3.1.1.5			Initial Revision of this module
tnAclPortTable	1.3.6.1.4.1.868.2.5.3.1.1.5.1		not-accessible	This table displays and sets the ACL parameters (ACE) of each switch port.
tnAclPortEntry	1.3.6.1.4.1.868.2.5.3.1.1.5.1.1		not-accessible	This entry represents an ACL port configuration.
INT tnAclPortPolicyId	1.3.6.1.4.1.868.2.5.3.1.1.5.1.1.1	INTEGER	read-write	Select the policy to apply to this port. The allowed values are 0 through 255. The default value is 0.
INT tnAclPortAction	1.3.6.1.4.1.868.2.5.3.1.1.5.1.1.2	INTEGER	read-write	Select the policy to apply to this port. The allowed values are 0 through 255. The default value is 0.
RAT tnAclPortRateLimiterId	1.3.6.1.4.1.868.2.5.3.1.1.5.1.1.3	RateLimiterValue	read-write	Select which rate limiter to apply on this port. The allowed values are Disabled or the values 1 through 16. The default value is 'Disabled'.
INT tnAclPortEvcPolicerState	1.3.6.1.4.1.868.2.5.3.1.1.5.1.1.4	INTEGER	read-write	Select whether EVC policer is enabled or disabled. The default value is 'Disabled'.
INT tnAclPortEvcPolicerId	1.3.6.1.4.1.868.2.5.3.1.1.5.1.1.5	INTEGER	read-write	Select which EVC policer ID to apply on this port. when 'tnAclPortEvcPolicerState' is enabled, the valid value is from 1 to 128.
POR tnAclPortRedirect	1.3.6.1.4.1.868.2.5.3.1.1.5.1.1.6	PortList	read-write	Select which port frames are redirected on. The allowed values is a specific port number and it can't be set when action is permitted. When no bit is selected, port redirect is 'disabled'.
INT tnAclPortMirrorState	1.3.6.1.4.1.868.2.5.3.1.1.5.1.1.7	INTEGER	read-write	Specify the mirror operation of this port. The allowed values are: Enabled: Frames received on the port are mirrored. Disabled: Frames received on the port are not mirrored. The default value is 'Disabled'.
INT tnAclPortLoggingState	1.3.6.1.4.1.868.2.5.3.1.1.5.1.1.8	INTEGER	read-write	Specify the logging operation of this port. The allowed values are: Enabled: Frames received on the port are stored in the System Log. Disabled: Frames received on the port are not logged. The default value is 'Disabled'.
INT tnAclPortShutdownState	1.3.6.1.4.1.868.2.5.3.1.1.5.1.1.9	INTEGER	read-write	Specify the port shut down operation of this port. The allowed values are: Enabled: If a frame is received on the port, the port will be disabled. Disabled: Port shut down is disabled. The default value is 'Disabled'.
INT tnAclPortAclState	1.3.6.1.4.1.868.2.5.3.1.1.5.1.1.10	INTEGER	read-write	Specify the port state of this port. The allowed values are: Enabled: To reopen ports by changing the volatile port configuration of the ACL user module. Disabled: To close ports by changing the volatile port configuration of the ACL user module. The default value is 'Enabled'.
C32 tnAclPortCounterEx	1.3.6.1.4.1.868.2.5.3.1.1.5.1.1.11	Counter32	read-only	Counts the number of frames that match this ACE.
tnAclRateLimiterTable	1.3.6.1.4.1.868.2.5.3.1.1.5.2		not-accessible	This table displays and sets the rate limiter for the ACL of the switch.
tnAclRateLimiterEntry	1.3.6.1.4.1.868.2.5.3.1.1.5.2.1		not-accessible	This entry represents an ACL rate limiter.
INT tnAclRateLimitId	1.3.6.1.4.1.868.2.5.3.1.1.5.2.1.1	INTEGER	not-accessible	The rate limiter ID for the settings contained in the same row.
INT tnAclRateLimitRate	1.3.6.1.4.1.868.2.5.3.1.1.5.2.1.2	INTEGER	read-write	The allowed values are: 0-3276700 in pps or 0, 100, 200, 300, ..., 1000000 in kbps.
INT tnAclRateLimitUnit	1.3.6.1.4.1.868.2.5.3.1.1.5.2.1.3	INTEGER	read-write	Specify the rate unit. The allowed values are: pps: packets per second. kbps: Kbits per second.
tnAclOperTable	1.3.6.1.4.1.868.2.5.3.1.1.5.3		not-accessible	This table sets the ACL operation.
tnAclOperEntry	1.3.6.1.4.1.868.2.5.3.1.1.5.3.1		not-accessible	This entry represents an ACL operation.
INT tnAclClearCounter	1.3.6.1.4.1.868.2.5.3.1.1.5.3.1.1	INTEGER	read-write	Specify ACL clear operation. The allowed values are: nooper: no operation. clear: Clear all ACL counters, including counts the number of frames that match this ACE and ACL port counters.
tnAceTable	1.3.6.1.4.1.868.2.5.3.1.1.5.4		not-accessible	This table contains the configuration of ACE(ACL control entry) of the switch.
tnAceEntry	1.3.6.1.4.1.868.2.5.3.1.1.5.4.1		not-accessible	This entry represents an ACE. Each entry in this table represents an ACE and can be created or deleted by the management system.
INT tnAceIndex	1.3.6.1.4.1.868.2.5.3.1.1.5.4.1.1	INTEGER	not-accessible	The index of ACE.
INT tnAceNextIndex	1.3.6.1.4.1.868.2.5.3.1.1.5.4.1.2	INTEGER	read-create	Specify the created ACE is placed before which ACE.
POR tnAceIngressPort	1.3.6.1.4.1.868.2.5.3.1.1.5.4.1.3	PortList	read-create	Select the ingress port for which this ACE applies.
INT tnAcePolicyFilterType	1.3.6.1.4.1.868.2.5.3.1.1.5.4.1.4	INTEGER	read-create	Specify the policy number filter for this ACE. Any: No policy filter is specified. (policy filter status is 'dont-care'.) Specific: If you want to filter a specific policy with this ACE, choose this value. Two field for entering an policy value and bitmask appears.
INT tnAcePolicyValue	1.3.6.1.4.1.868.2.5.3.1.1.5.4.1.5	INTEGER	read-create	When 'Specific' is selected for the policy filter, you can enter a specific policy value. The allowed range is 0 to 255.
INT tnAcePolicyBitMask	1.3.6.1.4.1.868.2.5.3.1.1.5.4.1.6	INTEGER	read-create	When 'Specific' is selected for the policy filter, you can enter a specific policy bitmask. The allowed range is 0x0 to 0xff.
INT tnAcePolicyFrameType	1.3.6.1.4.1.868.2.5.3.1.1.5.4.1.7	INTEGER	read-create	Select the frame type for this ACE. These frame types are mutually exclusive. any: Any frame can match this ACE. etherType: Only Ethernet Type frames can match this ACE. The IEEE 802.3 describes the value of Length/Type Field specifications to be greater than or equal to 1536 decimal (equal to 0600 hexadecimal). arp: Only ARP frames can match this ACE. Notice the ARP frames won't match the ACE with ethernet type. ipv4: Only IPv4 frames can match this ACE. Notice the IPv4 frames won't match the ACE with ethernet type.
INT tnAceAction	1.3.6.1.4.1.868.2.5.3.1.1.5.4.1.8	INTEGER	read-create	Specify the action to take with a frame that hits this ACE. permit: The frame that hits this ACE is granted permission for the ACE operation. deny: The frame that hits this ACE is dropped.
RAT tnAceRateLimiter	1.3.6.1.4.1.868.2.5.3.1.1.5.4.1.9	RateLimiterValue	read-write	Specify the rate limiter in number of base units. The allowed range is 1 to 16. 'disabled' indicates that the rate limiter operation is disabled.
INT tnAceEvcPolicerState	1.3.6.1.4.1.868.2.5.3.1.1.5.4.1.10	INTEGER	read-create	Select whether EVC policer is enabled or disabled. The default value is 'Disabled'.
INT tnAceEvcPolicerId	1.3.6.1.4.1.868.2.5.3.1.1.5.4.1.11	INTEGER	read-create	Select which EVC policer ID to apply on this ACE. The allowed values are from 1 through 128.
POR tnAcePortRedirect	1.3.6.1.4.1.868.2.5.3.1.1.5.4.1.12	PortList	read-create	Frames that hit the ACE are redirected to the port number specified here. The allowed range is the same as the switch port number range. 'disabled' indicates that the port redirect operation is disabled and the specific port number of 'Port Redirect' can't be set when action is permitted.
INT tnAceMirrorState	1.3.6.1.4.1.868.2.5.3.1.1.5.4.1.13	INTEGER	read-create	Specify the mirror operation of this port. Frames matching the ACE are mirrored to the destination mirror port. The allowed values are: Enabled: Frames received on the port are mirrored. Disabled: Frames received on the port are not mirrored. The default value is 'Disabled'.
INT tnAceLoggingState	1.3.6.1.4.1.868.2.5.3.1.1.5.4.1.14	INTEGER	read-create	Specify the logging operation of the ACE. The allowed values are: Enabled: Frames matching the ACE are stored in the System Log. Disabled: Frames matching the ACE are not logged.
INT tnAceShutdownState	1.3.6.1.4.1.868.2.5.3.1.1.5.4.1.15	INTEGER	read-create	Specify the port shut down operation of the ACE. The allowed values are: Enabled: If a frame matches the ACE, the ingress port will be disabled. Disabled: Port shut down is disabled for the ACE.
C32 tnAceCounter	1.3.6.1.4.1.868.2.5.3.1.1.5.4.1.16	Counter32	read-only	The counter indicates the number of times the ACE was hit by a frame.
INT tnAceVlan8021qTagged	1.3.6.1.4.1.868.2.5.3.1.1.5.4.1.17	INTEGER	read-create	Specify whether frames can hit the action according to the 802.1Q tagged. The allowed values are: any: Any value is allowed ('dont-care'). enabled: Tagged frame only. disabled: Untagged frame only. The default value is 'Any'.
INT tnAceVlanIdFilter	1.3.6.1.4.1.868.2.5.3.1.1.5.4.1.18	INTEGER	read-create	Specify the VLAN ID filter for this ACE. any: No VLAN ID filter is specified. (VLAN ID filter status is 'dont-care'.) specific: If you want to filter a specific VLAN ID with this ACE, choose this value. A field for entering a VLAN ID number appears.
INT tnAceVlanId	1.3.6.1.4.1.868.2.5.3.1.1.5.4.1.19	INTEGER	read-create	When 'Specific' is selected for the VLAN ID filter, you can enter a specific VLAN ID number. The allowed range is 1 to 4095. A frame that hits this ACE matches this VLAN ID value.
INT tnAceTagPriority	1.3.6.1.4.1.868.2.5.3.1.1.5.4.1.20	INTEGER	read-create	Specify the tag priority for this ACE. A frame that hits this ACE matches this tag priority. The allowed number range is 0 to 7. The value Any means that no tag priority is specified (tag priority is 'dont-care').
ROW tnAceRowStatus	1.3.6.1.4.1.868.2.5.3.1.1.5.4.1.21	RowStatus	read-create	The status of this conceptual row entry of ACE table. This object isused to manage the creation and deletion of conceptual rows. The status column has six defined values: - 'active', which indicates that the conceptual row is available for use by the managed device; - 'notInService', which indicates that the conceptual row exists in the agent, but is unavailable for use by the managed device (see NOTE below); - 'notReady', which indicates that the conceptual row exists in the agent, but is missing information necessary in order to be available for use by the managed device; - 'createAndGo', which is supplied by a management station wishing to create a new instance of a conceptual row and to have its status automatically set to active, making it available for use by the managed device; - 'createAndWait', which is supplied by a management station wishing to create a new instance of a conceptual row (but not make it available for use by the managed device); and, - 'destroy', which is supplied by a management station wishing to delete all of the instances associated with an existing conceptual row. For a detailed description of this object, please refer to SNMPv2-TC MIB.
T/F tnAceLookup	1.3.6.1.4.1.868.2.5.3.1.1.5.4.1.22	TruthValue	read-create	Specify the second lookup operation of the ACE.
tnAceEtherTable	1.3.6.1.4.1.868.2.5.3.1.1.5.5		not-accessible	This table contains the related configuration of ACE when frame type is etherType.
tnAceEtherEntry	1.3.6.1.4.1.868.2.5.3.1.1.5.5.1		not-accessible	This entry represents an etherType related ACE configuration.
INT tnAceEtherSmacFilter	1.3.6.1.4.1.868.2.5.3.1.1.5.5.1.1	INTEGER	read-write	Specify the source MAC filter for this ACE. any: No SMAC filter is specified. (SMAC filter status is 'dont-care'.) specific: If you want to filter a specific source MAC address with this ACE, choose this value. A field for entering an SMAC value appears.
MAC tnAceEtherSmacVal	1.3.6.1.4.1.868.2.5.3.1.1.5.5.1.2	MacAddress	read-write	When 'Specific' is selected for the SMAC/DMAC filter, you can enter a specific value. The legal format is 'xx-xx-xx-xx-xx-xx' or 'xx.xx.xx.xx.xx.xx' or 'xxxxxxxxxxxx' (x is a hexadecimal digit). A frame that hits this ACE matches this SMAC value.
INT tnAceEtherDmacFilter	1.3.6.1.4.1.868.2.5.3.1.1.5.5.1.3	INTEGER	read-write	Specify the destination MAC filter for this ACE. any: No DMAC filter is specified. (DMAC filter status is 'dont-care'.) unicast: Frame must be unicast. multicast: Frame must be multicast. broadcast: Frame must be broadcast. specific: If you want to filter a specific destination MAC address with this ACE, choose this value. A field for entering a DMAC value appears.
MAC tnAceEtherDmacVal	1.3.6.1.4.1.868.2.5.3.1.1.5.5.1.4	MacAddress	read-write	When 'Specific' is selected for the DMAC filter, you can enter a specific value. The legal format is 'xx-xx-xx-xx-xx-xx' or 'xx.xx.xx.xx.xx.xx' or 'xxxxxxxxxxxx' (x is a hexadecimal digit). A frame that hits this ACE matches this DMAC value.
INT tnAceEtherTypeFilter	1.3.6.1.4.1.868.2.5.3.1.1.5.5.1.5	INTEGER	read-write	Specify the Ethernet type filter for this ACE: any: No EtherType filter is specified. (EtherType filter status is 'don't-care'. specific: If you want to filter a specific EtherType filter with this ACE, you can enter a specific EtherType value. A field for entering a EtherType value appears.
INT tnAceEtherTypeVal	1.3.6.1.4.1.868.2.5.3.1.1.5.5.1.6	INTEGER	read-create	When 'Specific' is selected for the EtherType filter, you can enter a specific EtherType value. The allowed range is 0x600 to 0xFFFF but excluding 0x800(IPv4), 0x806(ARP) and 0x86DD(IPv6). A frame that hits this ACE matches this EtherType value.
tnAceArpTable	1.3.6.1.4.1.868.2.5.3.1.1.5.6		not-accessible	This table contains the related configuration of ACE when frame type is ARP.
tnAceArpEntry	1.3.6.1.4.1.868.2.5.3.1.1.5.6.1		not-accessible	This entry represents an ARP related ACE configuration.
INT tnAceArpSmacFilter	1.3.6.1.4.1.868.2.5.3.1.1.5.6.1.1	INTEGER	read-write	Specify the source MAC filter for this ACE. any: No SMAC filter is specified. (SMAC filter status is 'dont-care'.) specific: If you want to filter a specific source MAC address with this ACE, choose this value. A field for entering an SMAC value appears.
MAC tnAceArpSmacVal	1.3.6.1.4.1.868.2.5.3.1.1.5.6.1.2	MacAddress	read-write	When 'Specific' is selected for the SMAC/DMAC filter, you can enter a specific value. The legal format is 'xx-xx-xx-xx-xx-xx' or 'xx.xx.xx.xx.xx.xx' or 'xxxxxxxxxxxx' (x is a hexadecimal digit). A frame that hits this ACE matches this SMAC value.
INT tnAceArpDmacFilter	1.3.6.1.4.1.868.2.5.3.1.1.5.6.1.3	INTEGER	read-write	Specify the destination MAC filter for this ACE. any: No DMAC filter is specified. (DMAC filter status is 'dont-care'.) unicast: Frame must be unicast. multicast: Frame must be multicast. broadcast: Frame must be broadcast.
INT tnAceArpParmArpRarp	1.3.6.1.4.1.868.2.5.3.1.1.5.6.1.4	INTEGER	read-write	Specify the available ARP/RARP opcode (OP) flag for this ACE. any: No ARP/RARP OP flag is specified. (OP is 'dont-care'.) arp: Frame must have ARP/RARP opcode set to ARP. rarp: Frame must have ARP/RARP opcode set to RARP. other: Frame has unknown ARP/RARP Opcode flag.
INT tnAceArpParmRequestReply	1.3.6.1.4.1.868.2.5.3.1.1.5.6.1.5	INTEGER	read-write	Specify the available requset/reply opcode (OP) flag for this ACE. any: No ARP/RARP OP flag is specified. (OP is 'dont-care'.) request: Frame must have ARP Request or RARP Request OP flag set. reply: Frame must have ARP Reply or RARP Reply OP flag.
HOS tnAceArpParmSenderIpFilter	1.3.6.1.4.1.868.2.5.3.1.1.5.6.1.6	HostOrNetworkOrAny	read-write	Specify the sender IP filter for this ACE. any: No sender filter is specified. (sender ip filter status is 'don't-care'.) host: If you want to filter a specific host address with this ECE, choose this value. A field for entering a host address appears. network: If you want to filter a specific network address with this ECE, choose this value. A Two fields for entering a specific network address and network mask appears.
IP tnAceArpParmSenderIpAddress	1.3.6.1.4.1.868.2.5.3.1.1.5.6.1.7	InetAddress	read-write	When 'Host' or 'Network' is selected for the sender ip filter, you can enter a specific host or network address.
IP tnAceArpParmSenderIpMask	1.3.6.1.4.1.868.2.5.3.1.1.5.6.1.8	InetAddress	read-write	When 'Network' is selected for the sender ip filter, you can enter a specific network mask.
HOS tnAceArpParmTargetIpFilter	1.3.6.1.4.1.868.2.5.3.1.1.5.6.1.9	HostOrNetworkOrAny	read-write	Specify the target IP filter for this ACE. any: No sender filter is specified. (target ip filter status is 'don't-care'.) host: If you want to filter a specific host address with this ECE, choose this value. A field for entering a host address appears. network: If you want to filter a specific network address with this ECE, choose this value. A Two fields for entering a specific network address and network mask appears.
IP tnAceArpParmTargetIpAddress	1.3.6.1.4.1.868.2.5.3.1.1.5.6.1.10	InetAddress	read-write	When 'Host' or 'Network' is selected for the target ip filter, you can enter a specific host or network address.
IP tnAceArpParmTargetIpMask	1.3.6.1.4.1.868.2.5.3.1.1.5.6.1.11	InetAddress	read-write	When 'Network' is selected for the target ip filter, you can enter a specific network mask.
TRU tnAceArpSenderMacMatch	1.3.6.1.4.1.868.2.5.3.1.1.5.6.1.12	TruthValueOrAny	read-write	Specify whether frames can hit the action according to their sender hardware address field (SHA) settings. 0: ARP frames where SHA is not equal to the SMAC address. 1: ARP frames where SHA is equal to the SMAC address. Any: Any value is allowed ('dont-care').
TRU tnAceArpRarpTargetMacMatch	1.3.6.1.4.1.868.2.5.3.1.1.5.6.1.13	TruthValueOrAny	read-write	Specify whether frames can hit the action according to their target hardware address field (THA) settings. 0: RARP frames where THA is not equal to the SMAC address. 1: RARP frames where THA is equal to the SMAC address. Any: Any value is allowed ('dont-care').
TRU tnAceArpIpEthernetLength	1.3.6.1.4.1.868.2.5.3.1.1.5.6.1.14	TruthValueOrAny	read-write	Specify whether frames can hit the action according to their ARP/RARP hardware address length (HLN) and protocol address length (PLN) settings. 0: ARP/RARP frames where the HLN is not equal to Ethernet (0x06) or the (PLN) is not equal to IPv4 (0x04). 1: ARP/RARP frames where the HLN is equal to Ethernet (0x06) and the (PLN) is equal to IPv4 (0x04). Any: Any value is allowed ('dont-care').
TRU tnAceArpIp	1.3.6.1.4.1.868.2.5.3.1.1.5.6.1.15	TruthValueOrAny	read-write	Specify whether frames can hit the action according to their ARP/RARP hardware address space (HRD) settings. 0: ARP/RARP frames where the HLD is not equal to Ethernet (1). 1: ARP/RARP frames where the HLD is equal to Ethernet (1). Any: Any value is allowed ('dont-care').
TRU tnAceArpEthernet	1.3.6.1.4.1.868.2.5.3.1.1.5.6.1.16	TruthValueOrAny	read-write	Specify whether frames can hit the action according to their ARP/RARP protocol address space (PRO) settings. 0: ARP/RARP frames where the PRO is not equal to IP (0x800). 1: ARP/RARP frames where the PRO is equal to IP (0x800). Any: Any value is allowed ('dont-care').
tnAceIpv4Table	1.3.6.1.4.1.868.2.5.3.1.1.5.7		not-accessible	This table contains the related configuration of ACE when frame type is IPv4.
tnAceIpv4Entry	1.3.6.1.4.1.868.2.5.3.1.1.5.7.1		not-accessible	This entry represents an IPv4 related ACE configuration.
INT tnAceIpv4ProtoFilter	1.3.6.1.4.1.868.2.5.3.1.1.5.7.1.1	INTEGER	read-write	Specify the IP protocol filter for this ACE. any: No IP protocol filter is specified. (Protocol filter status is 'don't-care'.) other: If you want to filter a specific IP protocol filter with this ACE, choose this value. A field for entering an IP protocol filter appears. icmp: Select ICMP to filter IPv4 ICMP protocol frames. Extra fields for defining ICMP parameters will appear. These fields are explained later in this help file. udp: Select UDP to filter IPv4 UDP protocol frames. Extra fields for defining UDP parameters will appear. These fields are explained later in this help file. tcp: Select TCP to filter IPv4 TCP protocol frames. Extra fields for defining TCP parameters will appear. These fields are explained later in this help file.
INT tnAceIpv4ProtoValue	1.3.6.1.4.1.868.2.5.3.1.1.5.7.1.2	INTEGER	read-write	When 'Specific' is selected for the IP protocol value, you can enter a specific value. The allowed range is 0 to 255. A frame that hits this ACE matches this IP protocol value.
INT tnAceIpv4Ttl	1.3.6.1.4.1.868.2.5.3.1.1.5.7.1.3	INTEGER	read-write	Specify the Time-to-Live settings for this ACE. zero: IPv4 frames with a Time-to-Live field greater than zero must not be able to match this entry. nonZero: IPv4 frames with a Time-to-Live field greater than zero must be able to match this entry. any: Any value is allowed ('don't-care').
INT tnAceIpv4Fragment	1.3.6.1.4.1.868.2.5.3.1.1.5.7.1.4	INTEGER	read-write	Specify the fragment offset settings for this ACE. This involves the settings for the More Fragments (MF) bit and the Fragment Offset (FRAG OFFSET) field for an IPv4 frame. any: Any value is allowed ('don't-care'). yes: IPv4 frames where the MF bit is set or the FRAG OFFSET field is greater than zero must be able to match this entry. no: IPv4 frames where the MF bit is set or the FRAG OFFSET field is greater than zero must not be able to match this entry.
INT tnAceIpv4Option	1.3.6.1.4.1.868.2.5.3.1.1.5.7.1.5	INTEGER	read-write	Specify the options flag setting for this ACE. any: Any value is allowed ('don't-care'). yes: IPv4 frames where the options flag is set must be able to match this entry. no: IPv4 frames where the options flag is set must not be able to match this entry.
HOS tnAceIpv4SipFilter	1.3.6.1.4.1.868.2.5.3.1.1.5.7.1.6	HostOrNetworkOrAny	read-write	Specify the source IP filter for this ACE. any: No source IP filter is specified. (source ip filter is 'don't-care'.) host: Source IP filter is set to Host. Specify the source IP address in the SIP Address field that appears. network: Source IP filter is set to Network. Specify the source IP address and source IP mask in the SIP Address and SIP Mask fields that appear.
IP tnAceIpv4SipAddress	1.3.6.1.4.1.868.2.5.3.1.1.5.7.1.7	InetAddress	read-write	When 'Host' or 'Network' is selected for the source ip filter, you can enter a specific host or network address.
IP tnAceIpv4SipMask	1.3.6.1.4.1.868.2.5.3.1.1.5.7.1.8	InetAddress	read-write	When 'Network' is selected for the source ip filter, you can enter a specific network mask.
HOS tnAceIpv4DipFilter	1.3.6.1.4.1.868.2.5.3.1.1.5.7.1.9	HostOrNetworkOrAny	read-write	Specify the destination IP filter for this ACE. any: No destination IP filter is specified. (source ip filter is 'don't-care'.) host: Destination IP filter is set to Host. Specify the destination IP address in the SIP Address field that appears. network: Destination IP filter is set to Network. Specify the destination IP address and source IP mask in the DIP Address and DIP Mask fields that appear.
IP tnAceIpv4DipAddress	1.3.6.1.4.1.868.2.5.3.1.1.5.7.1.10	InetAddress	read-write	When 'Host' or 'Network' is selected for the destination ip filter, you can enter a specific host or network address.
IP tnAceIpv4DipMask	1.3.6.1.4.1.868.2.5.3.1.1.5.7.1.11	InetAddress	read-write	When 'Network' is selected for the destination ip filter, you can enter a specific network mask.
INT tnAceIpv4IcmpTypeFilter	1.3.6.1.4.1.868.2.5.3.1.1.5.7.1.12	INTEGER	read-write	Specify the ICMP filter for this ACE. any: No ICMP filter is specified. (ICMP filter status is 'dont-care'.) specific: If you want to filter a specific ICMP filter with this ACE, you can enter a specific ICMP value. A field for entering an ICMP value appears.
INT tnAceIpv4IcmpTypeValue	1.3.6.1.4.1.868.2.5.3.1.1.5.7.1.13	INTEGER	read-write	When 'Specific' is selected for the ICMP filter, you can enter a specific ICMP value. The allowed range is 0 to 255. A frame that hits this ACE matches this ICMP value.
INT tnAceIpv4IcmpCodeFilter	1.3.6.1.4.1.868.2.5.3.1.1.5.7.1.14	INTEGER	read-write	Specify the ICMP code filter for this ACE. any: No ICMP code is specified. (ICMP filter status is 'dont-care'.) specific: If you want to filter a specific ICMP code filter with this ACE, you can enter a specific ICMP code value. A field for entering an ICMP code value appears.
INT tnAceIpv4IcmpCodeValue	1.3.6.1.4.1.868.2.5.3.1.1.5.7.1.15	INTEGER	read-write	When 'Specific' is selected for the ICMP code filter, you can enter a specific ICMP code value. The allowed range is 0 to 255. A frame that hits this ACE matches this ICMP code value.
INT tnAceIPv4SrcPortFilterType	1.3.6.1.4.1.868.2.5.3.1.1.5.7.1.16	INTEGER	read-write	The TCP/UDP source port for matching the ACE. It only significant if protocol filter 'UDP' or 'TCP' is selected. The possible values are: any: No TCP/UDP source port filter is specified. (Source port filter status is 'don't-care'.) specific: If you want to filter a specific TCP/UDP source port No. with this ACE, choose this value. A field for entering a specific source port No. appears. range: If you want to filter a specific TCP/UDP source port range filter with this ACE, choose this value. A field for entering a range appears.
INT tnAceIPv4SrcPortFilterNo	1.3.6.1.4.1.868.2.5.3.1.1.5.7.1.17	INTEGER	read-write	When 'Specific' is selected for the source port filter, you can enter a specific value. The allowed value is from 0 through 65535.
INT tnAceIPv4SrcPortRangeStart	1.3.6.1.4.1.868.2.5.3.1.1.5.7.1.18	INTEGER	read-write	When 'Range' is selected for the source port filter, you can enter a specific range. The allowed range start is from 0 through 65535.
INT tnAceIPv4SrcPortRangeEnd	1.3.6.1.4.1.868.2.5.3.1.1.5.7.1.19	INTEGER	read-write	When 'Range' is selected for the source port filter, you can enter a specific range. The allowed range end is from 0 through 65535.
INT tnAceIPv4DstPortFilterType	1.3.6.1.4.1.868.2.5.3.1.1.5.7.1.20	INTEGER	read-write	The TCP/UDP destination port for matching the ACE. It only significant if protocol filter 'UDP' or 'TCP' is selected. The possible values are: any: No TCP/UDP destination port filter is specified. (Destination port filter status is 'don't-care'.) specific: If you want to filter a specific TCP/UDP destination port No. with this ACE, choose this value. A field for entering a specific No. appears. range: If you want to filter a specific TCP/UDP destination port range filter with this ACE, choose this value. A field for entering a range appears.
INT tnAceIPv4DstPortFilterNo	1.3.6.1.4.1.868.2.5.3.1.1.5.7.1.21	INTEGER	read-write	When 'Specific' is selected for the destination port filter, you can enter a specific value. The allowed value is from 0 through 65535.
INT tnAceIPv4DstPortRangeStart	1.3.6.1.4.1.868.2.5.3.1.1.5.7.1.22	INTEGER	read-write	When 'Range' is selected for the destination port filter, you can enter a specific range. The allowed range start is from 0 through 65535.
INT tnAceIPv4DstPortRangeEnd	1.3.6.1.4.1.868.2.5.3.1.1.5.7.1.23	INTEGER	read-write	When 'Range' is selected for the destination port filter, you can enter a specific range. The allowed range end is from 0 through 65535.
TRU tnAceIPv4TcpFin	1.3.6.1.4.1.868.2.5.3.1.1.5.7.1.24	TruthValueOrAny	read-write	Specify the TCP 'No more data from sender' (FIN) value for this ACE. 0: TCP frames where the FIN field is set must not be able to match this entry. 1: TCP frames where the FIN field is set must be able to match this entry. Any: Any value is allowed ('dont-care').
TRU tnAceIPv4TcpSyn	1.3.6.1.4.1.868.2.5.3.1.1.5.7.1.25	TruthValueOrAny	read-write	Specify the TCP 'Synchronize sequence numbers' (SYN) value for this ACE. 0: TCP frames where the SYN field is set must not be able to match this entry. 1: TCP frames where the SYN field is set must be able to match this entry. Any: Any value is allowed ('dont-care').
TRU tnAceIPv4TcpRst	1.3.6.1.4.1.868.2.5.3.1.1.5.7.1.26	TruthValueOrAny	read-write	Specify the TCP 'Reset the connection' (RST) value for this ACE. 0: TCP frames where the RST field is set must not be able to match this entry. 1: TCP frames where the RST field is set must be able to match this entry. Any: Any value is allowed ('dont-care').
TRU tnAceIPv4TcpPsh	1.3.6.1.4.1.868.2.5.3.1.1.5.7.1.27	TruthValueOrAny	read-write	Specify the TCP 'Push Function' (PSH) value for this ACE. 0: TCP frames where the PSH field is set must not be able to match this entry. 1: TCP frames where the PSH field is set must be able to match this entry. Any: Any value is allowed ('dont-care').
TRU tnAceIPv4TcpAck	1.3.6.1.4.1.868.2.5.3.1.1.5.7.1.28	TruthValueOrAny	read-write	Specify the TCP 'Acknowledgment field significant' (ACK) value for this ACE. 0: TCP frames where the ACK field is set must not be able to match this entry. 1: TCP frames where the ACK field is set must be able to match this entry. Any: Any value is allowed ('dont-care').
TRU tnAceIPv4TcpUrg	1.3.6.1.4.1.868.2.5.3.1.1.5.7.1.29	TruthValueOrAny	read-write	Specify the TCP 'Urgent Pointer field significant' (URG) value for this ACE. 0: TCP frames where the URG field is set must not be able to match this entry. 1: TCP frames where the URG field is set must be able to match this entry. Any: Any value is allowed ('dont-care').
tnAclStatusTable	1.3.6.1.4.1.868.2.5.3.1.1.5.8		not-accessible	This table shows the ACL status by different ACL users. Each row describes the ACE that is defined. It is a conflict if a specific ACE is not applied to the hardware due to hardware limitations. The maximum number of ACEs is 256 on each switch.
tnAclStatusEntry	1.3.6.1.4.1.868.2.5.3.1.1.5.8.1		not-accessible	This entry represents ACL status by different ACL users.
INT tnAclStatusUser	1.3.6.1.4.1.868.2.5.3.1.1.5.8.1.1	INTEGER	not-accessible	Indicates the ACL user.
POR tnAclStatusIngressPort	1.3.6.1.4.1.868.2.5.3.1.1.5.8.1.2	PortList	read-only	Indicates the ingress port of the ACE. Possible values are: All: The ACE will match all ingress port. Port: The ACE will match a specific ingress port.
INT tnAclStatusFrameType	1.3.6.1.4.1.868.2.5.3.1.1.5.8.1.3	INTEGER	read-only	Indicates the frame type of the ACE. Possible values are: Any: The ACE will match any frame type. EType: The ACE will match Ethernet Type frames. Note that an Ethernet Type based ACE will not get matched by IP and ARP frames. ARP: The ACE will match ARP/RARP frames. IPv4: The ACE will match all IPv4 frames. IPv4/ICMP: The ACE will match IPv4 frames with ICMP protocol. IPv4/UDP: The ACE will match IPv4 frames with UDP protocol. IPv4/TCP: The ACE will match IPv4 frames with TCP protocol. IPv4/Other: The ACE will match IPv4 frames, which are not ICMP/UDP/TCP. IPv6: The ACE will match all IPv6 standard frames.
INT tnAclStatusEtypeVal	1.3.6.1.4.1.868.2.5.3.1.1.5.8.1.4	INTEGER	read-only	Indicates the type value when frame type of the ACE is Ethernet Type.
INT tnAclStatusAction	1.3.6.1.4.1.868.2.5.3.1.1.5.8.1.5	INTEGER	read-only	Indicates the forwarding action of the ACE. Permit: Frames matching the ACE may be forwarded and learned. Deny: Frames matching the ACE are dropped.
RAT tnAclStatusRateLimiter	1.3.6.1.4.1.868.2.5.3.1.1.5.8.1.6	RateLimiterValue	read-only	Indicates the rate limiter number of the ACE. The allowed range is 1 to 16. When Disabled is displayed, the rate limiter operation is disabled.
POR tnAclStatusPortRedirect	1.3.6.1.4.1.868.2.5.3.1.1.5.8.1.7	PortList	read-only	Indicates the port redirect operation of the ACE. Frames matching the ACE are redirected to the port number. The allowed values are Disabled or a specific port number. When Disabled is displayed, the port redirect operation is disabled.
INT tnAclStatusMirror	1.3.6.1.4.1.868.2.5.3.1.1.5.8.1.8	INTEGER	read-only	Specify the mirror operation of this port. The allowed values are: Enabled: Frames received on the port are mirrored. Disabled: Frames received on the port are not mirrored. The default value is 'Disabled'.
INT tnAclStatusCpu	1.3.6.1.4.1.868.2.5.3.1.1.5.8.1.9	INTEGER	read-only	Forward packet that matched the specific ACE to CPU.
INT tnAclStatusCpuOnce	1.3.6.1.4.1.868.2.5.3.1.1.5.8.1.10	INTEGER	read-only	Forward first packet that matched the specific ACE to CPU.
C32 tnAclStatusCounter	1.3.6.1.4.1.868.2.5.3.1.1.5.8.1.11	Counter32	read-only	The counter indicates the number of times the ACE was hit by a frame.
INT tnAclStatusConflict	1.3.6.1.4.1.868.2.5.3.1.1.5.8.1.12	INTEGER	read-only	Indicates the hardware status of the specific ACE. The specific ACE is not applied to the hardware due to hardware limitations.

RFC description

Access Control List (ACL) management and rate limiting for Transition Networks devices.

Start monitoring Transition Networks managed Ethernet switches, media converters with ACL support (per-port ACL policy/shutdown status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download TN-ACL-MIB