TPLINK-ACL-RULE-MIB

All MIBs › TPLINK-ACL-RULE-MIB

Category: Access Control and Authentication

Description: Manages TP-Link switch ACL rule entries, match criteria, and permit/deny actions.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is TPLINK-ACL-RULE-MIB?

TPLINK-ACL-RULE-MIB is a TP-Link private MIB that models Access Control List (ACL) rule configuration on TP-Link managed switches, covering five rule types under a common tpAclRuleConfigure branch. tpMacRuleTable defines Layer 2 MAC-based rules (source/destination MAC address and mask, VLAN ID, EtherType, 802.1p priority, time-segment binding, permit/deny action via tpMacSecOperation); tpStdipRuleTable and tpExtipRuleTable define standard and extended IPv4 ACL rules, with the extended table adding IP fragment handling, L4 protocol number, TCP flag bitmasks, source/destination port ranges, and DSCP/ToS/precedence matching; tpCombRuleTable combines MAC and IP match criteria in a single rule; and tpIPv6RuleTable provides IPv6 traffic-class, flow-label, and upper-64-bit address/port matching. Each rule row uses a shared TPRowStatus object for lifecycle management (active/notInService/createAndGo/destroy, etc.). This is a configuration/security-policy MIB rather than a traffic-counter MIB, so its monitoring value is verifying that intended permit/deny ACL rules are actually present, active, and correctly scoped on the switch — critical for confirming security policy hasn't drifted or been partially applied, and it depends on TPLINK-TC-MIB for TPRowStatus and TPLINK-MIB/TPLINK-ACL-MIB for its OID root. It is deployed on TP-Link managed switches, and network administrators can perform a TPLINK-ACL-RULE-MIB download to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in TPLINK-ACL-RULE-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

TP-Link managed switches (ACL-capable models)

Monitoring Examples

An operator polls tpExtipRuleTable to confirm tpExtipRuleStatus is active and tpExtipSecOperation is set to deny for a rule blocking a known-bad source subnet; an inactive row status or a permit value where deny was expected would indicate the security ACL isn't actually enforcing the intended policy.

What Can Be Monitored

MAC ACL rule match criteria and permit/deny action
standard and extended IPv4 ACL rule tables
combined MAC+IP ACL rule table
IPv6 ACL rule table (traffic class, flow label, address/port)
ACL rule row lifecycle status (active/inactive)

Imported Objects

From SNMPv2-SMI

IpAddress
MODULE-IDENTITY
OBJECT-TYPE

From TPLINK-ACL-MIB

tplinkAclMIBObjects

OBJECT-IDENTITY

From TPLINK-MIB

tplinkMgmt

OBJECT-IDENTITY

From TPLINK-TC-MIB

TPRowStatus

OIDs

OID symbolic	OID numeric	Type	Access	Description
tpAclRuleConfigure	1.3.6.1.4.1.11863.6.26.1.1
INT tpCombAclId	1.3.6.1.4.1.11863.6.26.1.1.4.1.1	INTEGER	read-only	Combined MAC+IP ACL ID.
IP tpCombDipAddress	1.3.6.1.4.1.11863.6.26.1.1.4.1.13	IpAddress	read-create	Destination IP address, value '0.0.0.0' means that the destination IP address is disabled.
IP tpCombDipMask	1.3.6.1.4.1.11863.6.26.1.1.4.1.14	IpAddress	read-create	Destination IP mask, value '0.0.0.0' or zero length means that the mask is 255.255.255.255.
OCT tpCombDmacAddress	1.3.6.1.4.1.11863.6.26.1.1.4.1.6	OCTET STRING	read-create	Destination MAC address, string length setting to zero means that the destination MAC address is disabled.
OCT tpCombDmacMask	1.3.6.1.4.1.11863.6.26.1.1.4.1.7	OCTET STRING	read-create	Destination MAC Mask, string length setting to zero means that every bit of the mask is 1.
INT tpCombEtherType	1.3.6.1.4.1.11863.6.26.1.1.4.1.9	INTEGER	read-create	Ethernet protocol type, 0x0-0x10000. Value '65536' or '0x10000' means that the EtherType field is disabled.
INT tpCombPri	1.3.6.1.4.1.11863.6.26.1.1.4.1.10	INTEGER	read-create	802.1P priority, 0-8, value '8' means that the priority field is disabled.
tpCombRuleEntry	1.3.6.1.4.1.11863.6.26.1.1.4.1		not-accessible	An entry contains of the information of Combined ACL.
INT tpCombRuleId	1.3.6.1.4.1.11863.6.26.1.1.4.1.2	INTEGER	read-only	Combined ACL rule ID.
TPR tpCombRuleStatus	1.3.6.1.4.1.11863.6.26.1.1.4.1.16	TPRowStatus	read-create	the following two values are states: these values may be read or written active(1), notInService(2), the following value is a state: this value may be read, but not written notReady(3), the following three values are actions: these values may be written, but are never read createAndGo(4), createAndWait(5), destroy(6)
tpCombRuleTable	1.3.6.1.4.1.11863.6.26.1.1.4		not-accessible	A list of combined MAC+IP rule entries. Here you can add combined ACL rules for further ACL configuration.
INT tpCombSecOperation	1.3.6.1.4.1.11863.6.26.1.1.4.1.3	INTEGER	read-create	Combined ACL Security Operation.
IP tpCombSipAddress	1.3.6.1.4.1.11863.6.26.1.1.4.1.11	IpAddress	read-create	Source IP address, value '0.0.0.0' means that the source IP address is disabled.
IP tpCombSipMask	1.3.6.1.4.1.11863.6.26.1.1.4.1.12	IpAddress	read-create	Source IP mask, value '0.0.0.0' or zero length means that the mask is 255.255.255.255.
OCT tpCombSmacAddress	1.3.6.1.4.1.11863.6.26.1.1.4.1.4	OCTET STRING	read-create	Source MAC address, string length setting to zero means that the source MAC address is disabled.
OCT tpCombSmacMask	1.3.6.1.4.1.11863.6.26.1.1.4.1.5	OCTET STRING	read-create	Source MAC Mask, string length setting to zero means that every bit of the mask is 1.
OCT tpCombTimeSegment	1.3.6.1.4.1.11863.6.26.1.1.4.1.15	OCTET STRING	read-create	Combined ACL time segment name(max length: 16), the time segment name must be configured previously and string length setting to zero means that this field is disabled.
INT tpCombVlanId	1.3.6.1.4.1.11863.6.26.1.1.4.1.8	INTEGER	read-create	VLAN ID, 0-4094, value '0' means that the vid field is disabled.
INT tpExtipAclId	1.3.6.1.4.1.11863.6.26.1.1.3.1.1	INTEGER	read-only	Extended IP ACL ID.
INT tpExtipDestPort	1.3.6.1.4.1.11863.6.26.1.1.3.1.12	INTEGER	read-create	Extended IP TCP/UDP destination port, 0-65536, value '65536' means that this field is disabled.
IP tpExtipDipAddress	1.3.6.1.4.1.11863.6.26.1.1.3.1.7	IpAddress	read-create	Destination IP address, value '0.0.0.0' means that the Destination IP address is disabled.
IP tpExtipDipMask	1.3.6.1.4.1.11863.6.26.1.1.3.1.8	IpAddress	read-create	Destination IP Mask, value '0.0.0.0' or zero length means that the mask is 255.255.255.255.
INT tpExtipDscp	1.3.6.1.4.1.11863.6.26.1.1.3.1.13	INTEGER	read-create	Extended IP DSCP, 0-64, value '64' means this field is disabled. conflicts with the Tos and Pre.
INT tpExtipFragment	1.3.6.1.4.1.11863.6.26.1.1.3.1.4	INTEGER	read-create	Extended IP fragment, conflicts with all the L4 feature.
INT tpExtipPre	1.3.6.1.4.1.11863.6.26.1.1.3.1.15	INTEGER	read-create	Extended IP pre, 0-8, value '8' means this field is disabled.
INT tpExtipProtocol	1.3.6.1.4.1.11863.6.26.1.1.3.1.9	INTEGER	read-create	L4 protocol type, 0-255, value '0' means this field is disabled. This field conflicts with the TCP Flags or the source/destination port numbers when it is not the value '6'(TCP), or '17'(UDP).
tpExtipRuleEntry	1.3.6.1.4.1.11863.6.26.1.1.3.1		not-accessible	An entry contains of the information of EXTIP ACL.
INT tpExtipRuleId	1.3.6.1.4.1.11863.6.26.1.1.3.1.2	INTEGER	read-only	Extended IP ACL rule ID.
TPR tpExtipRuleStatus	1.3.6.1.4.1.11863.6.26.1.1.3.1.17	TPRowStatus	read-create	the following two values are states: these values may be read or written active(1), notInService(2), the following value is a state: this value may be read, but not written notReady(3), the following three values are actions: these values may be written, but are never read createAndGo(4), createAndWait(5), destroy(6)
tpExtipRuleTable	1.3.6.1.4.1.11863.6.26.1.1.3		not-accessible	A list of extended IP rule entries. Here you can add extended IP ACL rules for further ACL configuration.
INT tpExtipSecOperation	1.3.6.1.4.1.11863.6.26.1.1.3.1.3	INTEGER	read-create	Extended IP ACL Security Operation.
IP tpExtipSipAddress	1.3.6.1.4.1.11863.6.26.1.1.3.1.5	IpAddress	read-create	Source IP address, value '0.0.0.0' means that the source IP address is disabled.
IP tpExtipSipMask	1.3.6.1.4.1.11863.6.26.1.1.3.1.6	IpAddress	read-create	Source IP Mask, value '0.0.0.0' or zero length means that the mask is 255.255.255.255.
INT tpExtipSourcePort	1.3.6.1.4.1.11863.6.26.1.1.3.1.11	INTEGER	read-create	Extended IP TCP/UDP source port, 0-65536, value '65536' means that this field is disabled.
INT tpExtipTcpFlag	1.3.6.1.4.1.11863.6.26.1.1.3.1.10	INTEGER	read-create	Extended IP TCP flag, this field is described as a bit-map structure: There are 12 bits of this field, the higher 6 bits show us whether these TCP flags are enabled(1) or disabled(0). The lower 6 bits show us the 6 kind of TCP flags' value (0-1). From the highest bit(bit11) to the lowest bit(0), each bit stands for a TCP flag: bit11 & bit5 -- URG flag bit10 & bit4 -- ACK flag bit9 & bit3 -- PSH flag bit8 & bit2 -- RST flag bit7 & bit1 -- SYN flag bit6 & bit0 -- FIN flag
OCT tpExtipTimeSegment	1.3.6.1.4.1.11863.6.26.1.1.3.1.16	OCTET STRING	read-create	EXTIP ACL time segment name(max length: 16), the time segment name must be configured previously and string length setting to zero means that this field is disabled.
INT tpExtipTos	1.3.6.1.4.1.11863.6.26.1.1.3.1.14	INTEGER	read-create	Extended IP type of service(ToS), 0-16, value '16' means this field is disabled.
INT tpIPv6AclId	1.3.6.1.4.1.11863.6.26.1.1.5.1.1	INTEGER	read-only	IPv6 ACL ID.
INT tpIPv6DestPort	1.3.6.1.4.1.11863.6.26.1.1.5.1.11	INTEGER	read-create	IPv6 L4 destination port, 0-65536, value '65536' means that this field is disabled.
OCT tpIPv6DipAddress	1.3.6.1.4.1.11863.6.26.1.1.5.1.8	OCTET STRING	read-create	IPv6 destination IP address, only upper 64 bits supported; the all-zero address means that the destination IPv6 address is disabled.
OCT tpIPv6DipMask	1.3.6.1.4.1.11863.6.26.1.1.5.1.9	OCTET STRING	read-create	IPv6 destination IP mask, 64 bits, format: ffff:ffff:ffff:ffff; zero length means that every bit of the mask is 1.
INT tpIPv6FlowLabel	1.3.6.1.4.1.11863.6.26.1.1.5.1.5	INTEGER	read-create	IPv6 Flow Label, 0x0-0x100000, value '0x100000' or '1048576' means that this field is disabled.
tpIPv6RuleEntry	1.3.6.1.4.1.11863.6.26.1.1.5.1		not-accessible	An entry contains of the information of IPv6 ACL.
INT tpIPv6RuleId	1.3.6.1.4.1.11863.6.26.1.1.5.1.2	INTEGER	read-only	IPv6 ACL rule ID.
TPR tpIPv6RuleStatus	1.3.6.1.4.1.11863.6.26.1.1.5.1.13	TPRowStatus	read-create	the following two values are states: these values may be read or written active(1), notInService(2), the following value is a state: this value may be read, but not written notReady(3), the following three values are actions: these values may be written, but are never read createAndGo(4), createAndWait(5), destroy(6)
tpIPv6RuleTable	1.3.6.1.4.1.11863.6.26.1.1.5		not-accessible	A list of IPv6 rule entries. Here you can add IPv6 ACL rules for further ACL configuration.
INT tpIPv6SecOperation	1.3.6.1.4.1.11863.6.26.1.1.5.1.3	INTEGER	read-create	IPv6 ACL Security Operation.
OCT tpIPv6SipAddress	1.3.6.1.4.1.11863.6.26.1.1.5.1.6	OCTET STRING	read-create	IPv6 source IP address, only upper 64 bits supported; the all-zero address means that the source IPv6 address is disabled.
OCT tpIPv6SipMask	1.3.6.1.4.1.11863.6.26.1.1.5.1.7	OCTET STRING	read-create	IPv6 source IP mask, 64 bits, format: ffff:ffff:ffff:ffff; zero length means that every bit of the mask is 1.
INT tpIPv6SourcePort	1.3.6.1.4.1.11863.6.26.1.1.5.1.10	INTEGER	read-create	IPv6 L4 source port, 0-65536, value '65536' means that this field is disabled.
OCT tpIPv6TimeSegment	1.3.6.1.4.1.11863.6.26.1.1.5.1.12	OCTET STRING	read-create	IPv6 ACL time segment name(max length: 16), the time segment name must be configured previously and string length setting to zero means that this field is disabled.
INT tpIPv6TrafficClass	1.3.6.1.4.1.11863.6.26.1.1.5.1.4	INTEGER	read-create	Traffic Class DSCP, 0-64, value '64' means that this field is disabled.
INT tpMacAclId	1.3.6.1.4.1.11863.6.26.1.1.1.1.1	INTEGER	read-only	MAC ACL ID.
OCT tpMacDmacAddress	1.3.6.1.4.1.11863.6.26.1.1.1.1.6	OCTET STRING	read-create	Destination MAC address, string length setting to zero means that the destination MAC address is disabled.
OCT tpMacDmacMask	1.3.6.1.4.1.11863.6.26.1.1.1.1.7	OCTET STRING	read-create	Destination Mac Mask, string length setting to zero means that every bit of the mask is 1.
INT tpMacEtherType	1.3.6.1.4.1.11863.6.26.1.1.1.1.9	INTEGER	read-create	Ethernet protocol type, 0x0-0x10000. Value '65536' or '0x10000' means that the EtherType field is disabled.
INT tpMacPri	1.3.6.1.4.1.11863.6.26.1.1.1.1.10	INTEGER	read-create	802.1P priority, 0-8, value '8' means that the priority field is disabled.
tpMacRuleEntry	1.3.6.1.4.1.11863.6.26.1.1.1.1		not-accessible	An entry contains of the information of MAC ACL.
INT tpMacRuleId	1.3.6.1.4.1.11863.6.26.1.1.1.1.2	INTEGER	read-only	MAC ACL rule ID.
TPR tpMacRuleStatus	1.3.6.1.4.1.11863.6.26.1.1.1.1.12	TPRowStatus	read-create	the following two values are states: these values may be read or written active(1), notInService(2), the following value is a state: this value may be read, but not written notReady(3), the following three values are actions: these values may be written, but are never read createAndGo(4), createAndWait(5), destroy(6)
tpMacRuleTable	1.3.6.1.4.1.11863.6.26.1.1.1		not-accessible	A list of L2 MAC ACL rule entries. Here you can add MAC ACL rules for further ACL configuration.
INT tpMacSecOperation	1.3.6.1.4.1.11863.6.26.1.1.1.1.3	INTEGER	read-create	MAC ACL Security Operation.
OCT tpMacSmacAddress	1.3.6.1.4.1.11863.6.26.1.1.1.1.4	OCTET STRING	read-create	Source MAC address, string length setting to zero means that the source MAC address is disabled.
OCT tpMacSmacMask	1.3.6.1.4.1.11863.6.26.1.1.1.1.5	OCTET STRING	read-create	Source Mac Mask, string length setting to zero means that every bit of the mask is 1.
OCT tpMacTimeSegment	1.3.6.1.4.1.11863.6.26.1.1.1.1.11	OCTET STRING	read-create	MAC ACL time segment name(max length: 16), the time segment name must be configured previously and string length setting to zero means that this field is disabled.
INT tpMacVlanId	1.3.6.1.4.1.11863.6.26.1.1.1.1.8	INTEGER	read-create	VLAN ID, 0-4094, value '0' means that the vid field is disabled.
INT tpStdipAclId	1.3.6.1.4.1.11863.6.26.1.1.2.1.1	INTEGER	read-only	Standard IP ACL ID.
IP tpStdipDipAddress	1.3.6.1.4.1.11863.6.26.1.1.2.1.6	IpAddress	read-create	Destination IP address, value '0.0.0.0' means that the destination IP address is disabled.
IP tpStdipDipMask	1.3.6.1.4.1.11863.6.26.1.1.2.1.7	IpAddress	read-create	Destination IP Mask, value '0.0.0.0' or zero length means that the mask is 255.255.255.255.
tpStdipRuleEntry	1.3.6.1.4.1.11863.6.26.1.1.2.1		not-accessible	An entry contains of the information of STDIP ACL.
INT tpStdipRuleId	1.3.6.1.4.1.11863.6.26.1.1.2.1.2	INTEGER	read-only	Standard IP ACL rule ID.
TPR tpStdipRuleStatus	1.3.6.1.4.1.11863.6.26.1.1.2.1.9	TPRowStatus	read-create	the following two values are states: these values may be read or written active(1), notInService(2), the following value is a state: this value may be read, but not written notReady(3), the following three values are actions: these values may be written, but are never read createAndGo(4), createAndWait(5), destroy(6)
tpStdipRuleTable	1.3.6.1.4.1.11863.6.26.1.1.2		not-accessible	A list of standard IP rule entries. Here you can add standard IP ACL rules for further ACL configuration.
INT tpStdipSecOperation	1.3.6.1.4.1.11863.6.26.1.1.2.1.3	INTEGER	read-create	Standard IP ACL Security Operation.
IP tpStdipSipAddress	1.3.6.1.4.1.11863.6.26.1.1.2.1.4	IpAddress	read-create	Source IP address, value '0.0.0.0' means that the source IP address is disabled.
IP tpStdipSipMask	1.3.6.1.4.1.11863.6.26.1.1.2.1.5	IpAddress	read-create	Source IP Mask, value '0.0.0.0' or zero length means that the mask is 255.255.255.255.
OCT tpStdipTimeSegment	1.3.6.1.4.1.11863.6.26.1.1.2.1.8	OCTET STRING	read-create	STDIP ACL time segment name(max length: 16), the time segment name must be configured previously and string length setting to zero means that this field is disabled.

RFC description

TP-Link access control list configuration and MAC/IP ACL rule management for network switches.

Start monitoring TP-Link managed switches, ACL-capable models (MAC/IPv4/IPv6 ACL rule config status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download TPLINK-ACL-RULE-MIB

What Is TPLINK-ACL-RULE-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description