USERGROUP-MIB

All MIBs › USERGROUP-MIB

Organization: Hirschmann Automation and Control GmbH

Last Updated: 2007-09-13

Category: VLAN and Layer 2 Switching

Description: Manages Hirschmann switch user group definitions, access rights, and authentication policies.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is USERGROUP-MIB?

USERGROUP-MIB is a Hirschmann vendor-specific MIB for their industrial/managed Ethernet switch Platform devices, defining user group definitions, group membership, access rights, and authentication/security policy for device management access. It exposes tables of user groups with descriptions and security actions, group membership mappings of users to groups, and extended port-security group associations. Its monitoring relevance is primarily configuration/software-state auditing rather than hardware sensors: an operator can verify which access-control groups exist, which users belong to them, and whether restricted/security-action policies are correctly applied, which is important for confirming device management security posture. It is a vendor-specific access-control extension likely layered on top of standard SNMPv3 USM/VACM access control rather than replacing it. It is typically deployed on Hirschmann industrial switches in critical infrastructure or industrial automation networks where strict user access segmentation is required. Engineers can download the USERGROUP-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in USERGROUP-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Hirschmann industrial managed Ethernet switch

Monitoring Examples

An operator can walk hmUserGroupTable to review each hmUserGroupEntry's hmUserGroupID, hmUserGroupDescription, and hmUserGroupRestricted flag to confirm which groups have restricted access and what hmUserGroupSecAction is configured for policy violations. Cross-referencing hmUserGroupMemberTable (keyed by hmUserGroupMemberGroupID and hmUserGroupMemberUserID) against hmUserTable verifies that only authorized users belong to sensitive groups. An unexpected new entry in hmUserGroupMemberTable linking an unfamiliar user to a privileged group would be a red flag for unauthorized access provisioning.

What Can Be Monitored

user group definitions and descriptions
group restricted/security-action policy
group membership mappings
port security group association

Imported Objects

From HMPRIV-MGMT-SNMP-MIB

hmConfiguration

MODULE-IDENTITY

From SNMPv2-SMI

Integer32
IpAddress
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-IDENTITY
OBJECT-TYPE
TEXTUAL-CONVENTION

From SNMPv2-TC

DisplayString

OIDs

OID symbolic	OID numeric	Type	Access	Description
hmUserGroup	1.3.6.1.4.1.248.14.3			The Hirschmann Private Usergroup MIB definitions for Platform devices.
hmUserGroupEvent	1.3.6.1.4.1.248.14.3.0			The events of hmUserGroup.
NTF hmNewUserTrap	1.3.6.1.4.1.248.14.3.0.1			This trap is sent if an unknown MAC address is detected on a port.
NTF hmPortSecurityTrap	1.3.6.1.4.1.248.14.3.0.2			This trap is sent if a MAC address / IP address is detected on a port which is not acceptable for the current setting of hmPortSecPermission AND ...SecAction is either set to trapOnly(2) or portDisable(3).
NTF hmPortSecConfigErrorTrap	1.3.6.1.4.1.248.14.3.0.3			This trap is sent when two or more users with incompatible user group settings have been detected at the port.
hmUserGroupTable	1.3.6.1.4.1.248.14.3.1		not-accessible	A list of user group definitions.
hmUserGroupEntry	1.3.6.1.4.1.248.14.3.1.1		not-accessible	user group definition
I32 hmUserGroupID	1.3.6.1.4.1.248.14.3.1.1.1	Integer32	read-only	The user group number identifying this instance.
STR hmUserGroupDescription	1.3.6.1.4.1.248.14.3.1.1.2	DisplayString	read-write	A textual description of the user group instance.
INT hmUserGroupRestricted	1.3.6.1.4.1.248.14.3.1.1.3	INTEGER	read-write	If set to true(1) any member of this group is restricted to ports - which have hmPortSecPermission set to group(2) and - the group is in hmPortSecAllowedGroupIDs. If set to false(2) the user may also connect to a port if permitted by other hmPortSecPermission settings, e.g. known(3) or world(4). The following access restrictions apply: UserRestr. UserGroupRestr. PortSecPermission access allowed -------------------------------------------------------------------- false false user hmPortSecAllowedUserID false false group hmPortSecAllowedGroupIDs false false known any user group member false false world yes true false/true user hmPortSecAllowedUserID true false/true group no true false/true known no true false/true world no false true user hmPortSecAllowedUserID false true group hmPortSecAllowedGroupIDs false true known no false true world no
INT hmUserGroupSecAction	1.3.6.1.4.1.248.14.3.1.1.4	INTEGER	read-write	This variable specifies the action which is taken if a user tries to connect to the given port when he is not allowed to do so. Setting the variable to none(1) disables any action. A value of trapOnly(2) generates a trap. Setting the value to portDisable(3) will send a trap, and additionally disable the port until it is re-enabled by management.
hmUserGroupMemberTable	1.3.6.1.4.1.248.14.3.2		not-accessible	A list of users which are members of a given user group.
hmUserGroupMemberEntry	1.3.6.1.4.1.248.14.3.2.1		not-accessible	An user group member entry.
I32 hmUserGroupMemberGroupID	1.3.6.1.4.1.248.14.3.2.1.1	Integer32	read-only	user group id of this member.
MEM hmUserGroupMemberUserID	1.3.6.1.4.1.248.14.3.2.1.2	MemberID	read-only	user ID of this member.
hmUserTable	1.3.6.1.4.1.248.14.3.3		not-accessible	List of all user group members.
hmUserEntry	1.3.6.1.4.1.248.14.3.3.1		not-accessible	An user entry.
MEM hmUserID	1.3.6.1.4.1.248.14.3.3.1.1	MemberID	read-only	User ID.
INT hmUserRestricted	1.3.6.1.4.1.248.14.3.3.1.2	INTEGER	read-write	If set to true(1) the user may only connect to ports which have hmPortSecPermission set to user(1) and hmPortSecAllowedUserID set to hmUserID. If set to false(2) the user may also connect to a port if permitted by other hmPortSecPermission settings, e.g. group(2), known(3) or world(4). The following access restrictions apply: UserRestr. UserGroupRestr. PortSecPermission access allowed --------------------------------------------------------------------- false false user hmPortSecAllowedUserID false false group hmPortSecAllowedGroupIDs false false known any user group member false false world yes true false/true user hmPortSecAllowedUserID true false/true group no true false/true known no true false/true world no false true user hmPortSecAllowedUserID false true group hmPortSecAllowedGroupIDs false true known no false true world no
hmPortSecurityTable	1.3.6.1.4.1.248.14.3.4		not-accessible	List of port security entries.
hmPortSecurityEntry	1.3.6.1.4.1.248.14.3.4.1		not-accessible	A single port security entry.
I32 hmPortSecSlotID	1.3.6.1.4.1.248.14.3.4.1.1	Integer32	read-only	Slot number the switch unit is plugged in.
I32 hmPortSecPortID	1.3.6.1.4.1.248.14.3.4.1.2	Integer32	read-only	Port number within the group.
INT hmPortSecPermission	1.3.6.1.4.1.248.14.3.4.1.3	INTEGER	read-write	This variable specifies the security level of the port. If set to user(1) only the user defined by hmPortSecAllowedUserID may connect to this port. In group(2) mode only members of the user group specified by hmPortSecAllowedGroupIDs are allowed. known(3) means that all users belonging to any user group (all known users) are accepted. Setting the value to world(4) disables the security features, i.e. any user is permitted. For backbone ports the value uplink(5) should be used. If a user does not match the allowed permission he is not able to connect to the network over this port, additionally the actions configured through hmPortSecAction are taken.
MEM hmPortSecAllowedUserID	1.3.6.1.4.1.248.14.3.4.1.4	MemberID	read-write	This variable specifies the allowed user ID if hmPortSecPermission has been set to user(1).
OCT hmPortSecAllowedGroupIDs	1.3.6.1.4.1.248.14.3.4.1.5	OCTET STRING	read-write	This variable specifies the allowed user groups if hmPortSecPermission has been set to group(2). Each group is represented by a single bit. If a group does not exist the value of the bit is ignored.
MEM hmPortSecConnectedUserID	1.3.6.1.4.1.248.14.3.4.1.6	MemberID	read-only	This variable reflects the user ID of a connected user actually seen on this port. If there is no user connected the value will be 0x00:00:00:00:00:00.
INT hmPortSecAction	1.3.6.1.4.1.248.14.3.4.1.7	INTEGER	read-write	This variable specifies the action which is taken if a user tries to connect to the given port when he is not allowed to do so. Setting the variable to none(1) disables any action. A value of trapOnly(2) generates a trap. Setting the value to portDisable(3) will send a trap, and additionally disable the port until it is re-enabled by management. Setting the value to autoDisable(3) will send a trap, and additionally auto-disable the port for the amount of time specified per port.
INT hmPortSecAutoReconfigure	1.3.6.1.4.1.248.14.3.4.1.8	INTEGER	read-write	This variable controls whether the agent should re-configure the port when another user with an incompatible user group setting has been detected. The default setting, true(1), should be used if a single user is connected to the port. The value false(2) might be useful if more than one user is connected to the port (workgroup mode).
INT hmPortSecPortStatus	1.3.6.1.4.1.248.14.3.4.1.9	INTEGER	read-only	This variable shows the current status of the port with respect to port security. If the address seen on the port is allowed, the status is enabled(1), if it is not allowed, the status is disabled(2) if hmUserGroupSecurityAction is portDisable(3), or enabledWithWrongAddr(3) if hmUserGroupSecurityAction is none(1) or trapOnly(2).
IP hmPortSecAllowedUserIPID	1.3.6.1.4.1.248.14.3.4.1.10	IpAddress	read-write	This variable specifies the allowed user IP ID if hmPortSecPermission has been set to user(1).
I32 hmPortSecDynamicLimit	1.3.6.1.4.1.248.14.3.4.1.11	Integer32	read-write	This variable signifies the limit of dynamically learned allowed MAC addresses for a specific port.
I32 hmPortSecDynamicCount	1.3.6.1.4.1.248.14.3.4.1.12	Integer32	read-only	The current number of dynamically learned allowed MAC addresses on this port.
INT hmUserGroupSecurityAction	1.3.6.1.4.1.248.14.3.5	INTEGER	read-write	This variable specifies the action which is taken if a user tries to connect to the given port when he is not allowed to do so. Setting the variable to none(1) disables any action. A value of trapOnly(2) generates a trap. Setting the value to portDisable(3) will send a trap, and additionally disable the port until it is re-enabled by management.
INT hmUserGroupPortSecurityMode	1.3.6.1.4.1.248.14.3.8	INTEGER	read-write	This variable specifies the mode of the hmPortSecurityTable.
hmPortSecExtendedGroup	1.3.6.1.4.1.248.14.3.10
hmPortSecExtendedTable	1.3.6.1.4.1.248.14.3.10.1		not-accessible	List of extended port security entries.
hmPortSecExtendedEntry	1.3.6.1.4.1.248.14.3.10.1.1		not-accessible	A single extended port security entry.
I32 hmPortSecExtSlotID	1.3.6.1.4.1.248.14.3.10.1.1.1	Integer32	not-accessible	Slot number the switch unit is plugged in.
I32 hmPortSecExtPortID	1.3.6.1.4.1.248.14.3.10.1.1.2	Integer32	not-accessible	Port number within the group.
INT hmPortSecExtAction	1.3.6.1.4.1.248.14.3.10.1.1.3	INTEGER	read-write	This variable specifies the action which is taken if a user tries to connect to the given port when he is not allowed to do so. Setting the variable to none(1) disables any action. A value of trapOnly(2) generates a trap. Setting the value to portDisable(3) will send a trap, and additionally disable the port until it is re-enabled by management.
INT hmPortSecExtPortStatus	1.3.6.1.4.1.248.14.3.10.1.1.4	INTEGER	read-only	This variable shows the current status of the port with respect to port security. If the address seen on the port is allowed, the status is enabled(1), if it is not allowed, the status is disabled(2) if hmUserGroupSecurityAction is portDisable(3), or enabledWithWrongAddr(3) if hmUserGroupSecurityAction is none(1) or trapOnly(2).
hmPortSecMultipleAdressesTable	1.3.6.1.4.1.248.14.3.10.2		not-accessible	List of port security entries with multiple allowed addresses.
hmPortSecMultipleAdressesEntry	1.3.6.1.4.1.248.14.3.10.2.1		not-accessible	A single port security entry with multiple allowed addresses.
I32 hmPortSecMASlotID	1.3.6.1.4.1.248.14.3.10.2.1.1	Integer32	not-accessible	Slot number the switch unit is plugged in.
I32 hmPortSecMAPortID	1.3.6.1.4.1.248.14.3.10.2.1.2	Integer32	not-accessible	Port number within the group.
I32 hmPortSecMAExtendedIndex	1.3.6.1.4.1.248.14.3.10.2.1.3	Integer32	not-accessible	Number of adresses.
MEM hmPortSecMAAllowedUserIDs	1.3.6.1.4.1.248.14.3.10.2.1.4	MemberID	read-write	This variable specifies the allowed user ID if hmPortSecPermission has been set to user(1).
IP hmPortSecMAAllowedUserIPIDs	1.3.6.1.4.1.248.14.3.10.2.1.5	IpAddress	read-write	This variable specifies the allowed user IP ID if hmPortSecPermission has been set to user(1).
I32 hmPortSecMAAllowedUserIDMask	1.3.6.1.4.1.248.14.3.10.2.1.6	Integer32	read-write	The number of bits from left ro right, that are used from the MAC address.

RFC description

Manages user groups and member management on Hirschmann platform network devices.

Start monitoring Hirschmann industrial managed Ethernet switch (user-group membership/access-rights status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download USERGROUP-MIB

What Is USERGROUP-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description