XYLAN-FLT-MIB

All MIBs › XYLAN-FLT-MIB

Category: Xylan OmniSwitch

Description: Manages Xylan OmniSwitch traffic filtering rules, ACL configuration, and packet classification criteria.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is XYLAN-FLT-MIB?

XYLAN-FLT-MIB is a vendor-specific MIB originally developed for Xylan OmniSwitch platforms and carried forward under Alcatel Internetworking, Inc. (which acquired Xylan and continued shipping the module — the file's copyright header names Alcatel Internetworking while retaining the original 'xylan' object prefixes) to manage the HRE-X hardware filtering engine's ACL-style traffic filtering. It models filter groups and rules in xylanFltGroupTable/xylanFltRuleListTable (IP/IPX address-pair rules with allow/deny dispositions), named services mapping to TCP ports in xylanFltServiceTable, active/global configuration in xylanFltGlobalGroupTable and xylanFltGlobalServiceTable, and live flow-classification lookups via xylanFltIpQueries/xylanFltIpxQueries, plus trap-diagnostic objects for the last denied packet and last COMMIT failure reason. This is useful for monitoring whether the HRE-X filtering subsystem is active (xylanFltActiveOperState) and for auditing which ACL rule most recently denied traffic, aiding diagnosis of unexpected packet drops. It is deployed on Alcatel/Xylan OmniSwitch chassis running the HRE-X filtering feature. Administrators maintaining these switches can download the XYLAN-FLT-MIB file to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in XYLAN-FLT-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Alcatel/Xylan OmniSwitch chassis switches with HRE-X filtering

Monitoring Examples

An operator polls xylanFltActiveAdminState and xylanFltActiveOperState to confirm HRE-X filtering is enabled and active, then checks xylanFltLastIpDenySrc/Dest after a reported connectivity complaint; a populated last-deny entry matching the affected host's address would confirm an ACL rule, not a routing issue, is blocking traffic.

What Can Be Monitored

filtering engine admin/operational state
filter group and rule allow/deny entries
service-to-port mappings
last denied IP/IPX packet source and destination
COMMIT trap failure reason
live IP/IPX flow-disposition query results

Imported Objects

From BRIDGE-MIB

MacAddress

From RFC-1212

OBJECT-TYPE

From RFC1155-SMI

IpAddress

From RFC1213-MIB

DisplayString

From XYLAN-BASE-MIB

xylanFltArch

OBJECT-IDENTITY

OIDs

OID symbolic	OID numeric	Type	Access	Description
INT xylanFltActDefaultIpDisp	1.3.6.1.4.1.800.2.22.3.6	INTEGER	read-only	The current default IP disposition if no other rule applies.
INT xylanFltActDefaultIpxDisp	1.3.6.1.4.1.800.2.22.3.8	INTEGER	read-only	The current default IPX disposition if no other rule applies.
INT xylanFltActIpPrecedence	1.3.6.1.4.1.800.2.22.3.7	INTEGER	read-only	The current precedence for IP rules.
INT xylanFltActiveAdminState	1.3.6.1.4.1.800.2.22.1.1	INTEGER	read-only	The current administrative state of the HRE-X filtering software.
xylanFltActiveConfig	1.3.6.1.4.1.800.2.22.3
INT xylanFltActiveOperState	1.3.6.1.4.1.800.2.22.1.2	INTEGER	read-only	The current operational state of the HRE-X filtering software. This is independent of the administrative state.
INT xylanFltCommit	1.3.6.1.4.1.800.2.22.1.4	INTEGER	write-only	Commits the current configuration.
xylanFltCommitTrapInfo	1.3.6.1.4.1.800.2.22.4.3
INT xylanFltConfigAdminState	1.3.6.1.4.1.800.2.22.1.3	INTEGER	read-write	The current configured administrative state of the HRE-X filtering software.
INT xylanFltGlobalGroupAdminState	1.3.6.1.4.1.800.2.22.2.3.4.1.2	INTEGER	read-write	The current status of this group. active (1) means the route is functioning, delete (2) tells SNMP to delete the route
xylanFltGlobalGroupEntry	1.3.6.1.4.1.800.2.22.2.3.4.1		not-accessible	Each entry corresponds to one group.
OCT xylanFltGlobalGroupIndex	1.3.6.1.4.1.800.2.22.2.3.4.1.1	OCTET STRING	read-only	Global group index is made up of the octets of the group name.
xylanFltGlobalGroupTable	1.3.6.1.4.1.800.2.22.2.3.4		not-accessible	List of active groups.
INT xylanFltGlobalIPRule	1.3.6.1.4.1.800.2.22.2.3.1	INTEGER	read-write	Global IP rule.
INT xylanFltGlobalIPXRule	1.3.6.1.4.1.800.2.22.2.3.2	INTEGER	read-write	Global IPX rule.
INT xylanFltGlobalPrecedence	1.3.6.1.4.1.800.2.22.2.3.3	INTEGER	read-write	Global rule precedence (tie breaker).
xylanFltGlobals	1.3.6.1.4.1.800.2.22.2.3
INT xylanFltGlobalServiceAdminState	1.3.6.1.4.1.800.2.22.2.3.5.1.2	INTEGER	read-write	The current status of this service. active (1) means the route is functioning, delete (2) tells SNMP to delete the route
xylanFltGlobalServiceEntry	1.3.6.1.4.1.800.2.22.2.3.5.1		not-accessible	Each entry corresponds to one service.
OCT xylanFltGlobalServiceIndex	1.3.6.1.4.1.800.2.22.2.3.5.1.1	OCTET STRING	read-only	Global service index is made up of the octets of the service name.
xylanFltGlobalServiceTable	1.3.6.1.4.1.800.2.22.2.3.5		not-accessible	List of active services.
INT xylanFltGroupAdminState	1.3.6.1.4.1.800.2.22.2.1.1.1.2	INTEGER	read-write	The current status of this group. active (1) means the route is functioning, delete (2) tells SNMP to delete the route
INT xylanFltGroupAdrType	1.3.6.1.4.1.800.2.22.2.1.1.1.4	INTEGER	read-write	This indicates which address is designated first. e.g. If destination is specified, the addresses the OIDs of the rules are ordered . If the group is an IPX group, this indicator does not affect the OID.
xylanFltGroupEntry	1.3.6.1.4.1.800.2.22.2.1.1.1		not-accessible	Each entry corresponds to one Group.
OCT xylanFltGroupIndex	1.3.6.1.4.1.800.2.22.2.1.1.1.1	OCTET STRING	read-only	The group index which is the octet string of printable characters containing the name of the group.
INT xylanFltGroupProtocol	1.3.6.1.4.1.800.2.22.2.1.1.1.3	INTEGER	read-write	The protocol type of the group. This has significance with the index of the OIDs of the rules in the group.
xylanFltGroups	1.3.6.1.4.1.800.2.22.2.1
xylanFltGroupTable	1.3.6.1.4.1.800.2.22.2.1.1		not-accessible	Group entry for HRE-X filtering feature. This object contains a collection of Group objects when contain a list of filtering rules.
xylanFltIpQueries	1.3.6.1.4.1.800.2.22.3.4		not-accessible	IP flow result queries.
xylanFltIpQuery	1.3.6.1.4.1.800.2.22.3.4.1		not-accessible	IP flow result query.
IP xylanFltIpQueryDest	1.3.6.1.4.1.800.2.22.3.4.1.1	IpAddress	read-only	Destination IP address to be used in the query.
INT xylanFltIpQueryDisp	1.3.6.1.4.1.800.2.22.3.4.1.4	INTEGER	read-only	The disposition that results from the query.
INT xylanFltIpQueryPort	1.3.6.1.4.1.800.2.22.3.4.1.3	INTEGER	read-only	Destination TCP port to be used in the query. 0 is an indication to not use the port.
INT xylanFltIpQueryRuleID	1.3.6.1.4.1.800.2.22.3.4.1.6	INTEGER	read-only	Rule ID used to determine the disposition for the query. -1 indicates no rule applied.
STR xylanFltIpQueryService	1.3.6.1.4.1.800.2.22.3.4.1.5	DisplayString	read-only	Service that contains the rule that is applied to determine the disposition of the query. The empty string indicates no rule applied.
IP xylanFltIpQuerySrc	1.3.6.1.4.1.800.2.22.3.4.1.2	IpAddress	read-only	Source IP address to be used in the query.
STR xylanFltIpServicePortName	1.3.6.1.4.1.800.2.22.3.1.1.1	DisplayString	read-only	Name of service for HRE-X Filtering Engine.
INT xylanFltIpServicePortNumber	1.3.6.1.4.1.800.2.22.3.1.1.2	INTEGER	read-only	TCP port number assigned to a service for HRE-X Filtering Engine.
xylanFltIpServicePortTbl	1.3.6.1.4.1.800.2.22.3.1		not-accessible	Table that maps a service name to the list of TCP ports it represents.
xylanFltIpServicePortTblEntry	1.3.6.1.4.1.800.2.22.3.1.1		not-accessible	Entry in table that maps a service name to the list of TCP ports it represents.
INT xylanFltIpServiceRuleCount	1.3.6.1.4.1.800.2.22.3.2.1.8	INTEGER	read-only	The number of times the filtering rule has been applied.
IP xylanFltIpServiceRuleDest	1.3.6.1.4.1.800.2.22.3.2.1.3	IpAddress	read-only	Destination address for the filtering rule.
OCT xylanFltIpServiceRuleDestMask	1.3.6.1.4.1.800.2.22.3.2.1.4	OCTET STRING	read-only	The destination address mask.
INT xylanFltIpServiceRuleDisp	1.3.6.1.4.1.800.2.22.3.2.1.7	INTEGER	read-only	The disposition for the filtering rule.
STR xylanFltIpServiceRuleGroup	1.3.6.1.4.1.800.2.22.3.2.1.9	DisplayString	read-only	Name of group in which the filtering rule is defined.
INT xylanFltIpServiceRuleID	1.3.6.1.4.1.800.2.22.3.2.1.2	INTEGER	read-only	Rule ID for filtering rule.
STR xylanFltIpServiceRuleName	1.3.6.1.4.1.800.2.22.3.2.1.1	DisplayString	read-only	Name of service (or Global for global rules) for HRE-X Filtering Engine.
IP xylanFltIpServiceRuleSrc	1.3.6.1.4.1.800.2.22.3.2.1.5	IpAddress	read-only	Source address for the filtering rule.
OCT xylanFltIpServiceRuleSrcMask	1.3.6.1.4.1.800.2.22.3.2.1.6	OCTET STRING	read-only	The source address mask.
xylanFltIpServiceRuleTbl	1.3.6.1.4.1.800.2.22.3.2		not-accessible	Table that maps a service name to the list of filtering rules. This includes the special service, GLOBAL, which is comprised of the global rules.
xylanFltIpServiceRuleTblEntry	1.3.6.1.4.1.800.2.22.3.2.1		not-accessible	Entry in table that maps a service name (or GLOBAL for global rules to its list of filtering rules.
xylanFltIpTrapInfo	1.3.6.1.4.1.800.2.22.4.1
xylanFltIpxQueries	1.3.6.1.4.1.800.2.22.3.5		not-accessible	IPX flow result queries.
xylanFltIpxQuery	1.3.6.1.4.1.800.2.22.3.5.1		not-accessible	IPX flow result query.
INT xylanFltIpxQueryDisp	1.3.6.1.4.1.800.2.22.3.5.1.3	INTEGER	read-only	The disposition that results from the query.
OCT xylanFltIpxQueryNetwork	1.3.6.1.4.1.800.2.22.3.5.1.1	OCTET STRING	read-only	Destination IPX network for query.
OCT xylanFltIpxQueryNode	1.3.6.1.4.1.800.2.22.3.5.1.2	OCTET STRING	read-only	Destination IPX node for query.
INT xylanFltIpxQueryRuleID	1.3.6.1.4.1.800.2.22.3.5.1.5	INTEGER	read-only	Rule ID used to determine the disposition for the query. -1 is used when no rule applied.
INT xylanFltIpxQueryRuleType	1.3.6.1.4.1.800.2.22.3.5.1.4	INTEGER	read-only	IPX rules are categorized into four types: Full Address - both the network number and node must match for the rule to be applied Node - only the node must match for the rule to be applied Network - only the network number must match for the rule to be applied Global - this rule type always matches Full Address has the highest precedence, followed by Node, Network, and then Global.
INT xylanFltIpxRuleCount	1.3.6.1.4.1.800.2.22.3.3.1.6	INTEGER	read-only	The number of times the filtering rule has been applied.
INT xylanFltIpxRuleDisp	1.3.6.1.4.1.800.2.22.3.3.1.5	INTEGER	read-only	The disposition for the filtering rule.
STR xylanFltIpxRuleGroup	1.3.6.1.4.1.800.2.22.3.3.1.7	DisplayString	read-only	Name of group in which the filtering rule is defined.
INT xylanFltIpxRuleID	1.3.6.1.4.1.800.2.22.3.3.1.2	INTEGER	read-only	Rule ID for filtering rule.
OCT xylanFltIpxRuleNet	1.3.6.1.4.1.800.2.22.3.3.1.3	OCTET STRING	read-only	Destination IPX network.
OCT xylanFltIpxRuleNode	1.3.6.1.4.1.800.2.22.3.3.1.4	OCTET STRING	read-only	Destination IPX node.
xylanFltIpxRuleTbl	1.3.6.1.4.1.800.2.22.3.3		not-accessible	Table of IPX filtering rules.
xylanFltIpxRuleTblEntry	1.3.6.1.4.1.800.2.22.3.3.1		not-accessible	Entry in table of IPX filtering rules.
INT xylanFltIpxRuleType	1.3.6.1.4.1.800.2.22.3.3.1.1	INTEGER	read-only	IPX rules are categorized into four types: Full Address - both the network number and node must match for the rule to be applied Node - only the node must match for the rule to be applied Network - only the network number must match for the rule to be applied Global - this rule type always matches Full Address has the highest precedence, followed by Node, Network, and then Global.
xylanFltIpxTrapInfo	1.3.6.1.4.1.800.2.22.4.2
STR xylanFltLastCommitTrapEntity1	1.3.6.1.4.1.800.2.22.4.3.2	DisplayString	read-only	An entity associated with the last HRE-X Filtering COMMIT trap; the value depends on the value of the last xylanFltLastCommitTrapReason. These are: 0 - The data is invalid. 1 - The name of the service that was referenced. 2 - The name of the service that referenced the group. 3 - The name of the service that contained the IPX rule. 4 - The name of the first service to include the port. This service will retain the port. 5 - The service name that appears twice. 6 - The name of the group that contains the second rule for the same IPX address.
STR xylanFltLastCommitTrapEntity2	1.3.6.1.4.1.800.2.22.4.3.3	DisplayString	read-only	An entity associated with the last HRE-X Filtering COMMIT trap; the value depends on the value of the last xylanFltLastCommitTrapReason. These are: 0 - The data is invalid. 1 - This data item is unused. 2 - The name of the group that could not be found. 3 - The name of the group that contained the IPX rule. 4 - The name of the second service to include the port. This service will not retain the port. 5 - This data item is unused. 6 - The name of the group that contains the first rule for an IPX address for which there is a duplicate.
OCT xylanFltLastCommitTrapIpxNet	1.3.6.1.4.1.800.2.22.4.3.5	OCTET STRING	read-only	Destination IPX network for last HRE-X Filtering COMMIT trap; the value depends on the value of the last xylanFltLastCommitTrapReason. These are: 0 - The data is invalid. 1 - This data item is unused. 2 - This data item is unused. 3 - This data item is unused. 4 - This data item is unused. 5 - This data item is unused. 6 - Contains the IPX network number for which there was a duplicate rule.
OCT xylanFltLastCommitTrapIpxNode	1.3.6.1.4.1.800.2.22.4.3.6	OCTET STRING	read-only	Destination IPX node for last HRE-X Filtering COMMIT trap; the value depends on the value of the last xylanFltLastCommitTrapReason. These are: 0 - The data is invalid. 1 - This data item is unused. 2 - This data item is unused. 3 - This data item is unused. 4 - This data item is unused. 5 - This data item is unused. 6 - Contains the IPX node address for which there was a duplicate rule.
INT xylanFltLastCommitTrapPort	1.3.6.1.4.1.800.2.22.4.3.4	INTEGER	read-only	The port number associated with the last HRE-X Filtering COMMIT trap; the value depends on the value of the last xylanFltLastCommitTrapReason. These are: 0 - The data is invalid. 1 - This data item is unused. 2 - This data item is unused. 3 - This data item is unused. 4 - The port that was assigned to two services. 5 - This data item is unused. 6 - This data item is unused.
INT xylanFltLastCommitTrapReason	1.3.6.1.4.1.800.2.22.4.3.1	INTEGER	read-only	The reason for the last HRE-X Filtering COMMIT trap; the valid reasons are: 0 - No trap has been sent. 1 - A service that was referenced from the global configuration could not be found. 2 - A group that was referenced from the GLOBAL level or some other service could not be found. 3 - An IPX rule was found in a group assigned to a service rather than the GLOBAL level. 4 - The same port was assigned to two services. 5 - The same service name appears twice. 6 - The same IPX address has two rules associated with it.
IP xylanFltLastIpDenyDest	1.3.6.1.4.1.800.2.22.4.1.2	IpAddress	read-only	Destination IP address for last denied route by HRE-X Filtering.
INT xylanFltLastIpDenyPort	1.3.6.1.4.1.800.2.22.4.1.3	INTEGER	read-only	Destination IP address for last denied route by HRE-X Filtering.
IP xylanFltLastIpDenySrc	1.3.6.1.4.1.800.2.22.4.1.1	IpAddress	read-only	Source IP address for last denied route by HRE-X Filtering.
OCT xylanFltLastIpxDenyNet	1.3.6.1.4.1.800.2.22.4.2.1	OCTET STRING	read-only	Destination IPX network for last denied route by HRE-X Filtering.
OCT xylanFltLastIpxDenyNode	1.3.6.1.4.1.800.2.22.4.2.2	OCTET STRING	read-only	Destination IPX node for last denied route by HRE-X Filtering.
INT xylanFltRuleListAdminState	1.3.6.1.4.1.800.2.22.2.1.2.1.2	INTEGER	read-write	The current status of this group. active (1) means the route is functioning, delete (2) tells SNMP to delete the route
xylanFltRuleListEntry	1.3.6.1.4.1.800.2.22.2.1.2.1		not-accessible	Each entry corresponds to one rule.
OCT xylanFltRuleListIndex	1.3.6.1.4.1.800.2.22.2.1.2.1.1	OCTET STRING	read-only	Rule index is made up of the octets of the group name and the network addresses of the rule. It has the following format: IP - ,0, IPX - ,0,
INT xylanFltRuleListRule	1.3.6.1.4.1.800.2.22.2.1.2.1.3	INTEGER	read-write	The rule for the address pair. 1) allows traffic for the addresses and 2) rejects all trafic for the pair.
xylanFltRuleListTable	1.3.6.1.4.1.800.2.22.2.1.2		not-accessible	The address and rule pairings.
INT xylanFltServiceAdminState	1.3.6.1.4.1.800.2.22.2.2.1.1.2	INTEGER	read-write	The current status of this group. active (1) means the route is functioning, delete (2) tells SNMP to delete the route
xylanFltServiceEntry	1.3.6.1.4.1.800.2.22.2.2.1.1		not-accessible	Each entry corresponds to one service.
INT xylanFltServiceGroupAdminState	1.3.6.1.4.1.800.2.22.2.2.3.1.2	INTEGER	read-write	The current status of this group. active (1) means the route is functioning, delete (2) tells SNMP to delete the route
xylanFltServiceGroupEntry	1.3.6.1.4.1.800.2.22.2.2.3.1		not-accessible	Each entry corresponds to one group.
OCT xylanFltServiceGroupIndex	1.3.6.1.4.1.800.2.22.2.2.3.1.1	OCTET STRING	read-only	Service group index is made up of the octets of the service name and the group name: ,0,
xylanFltServiceGroupTable	1.3.6.1.4.1.800.2.22.2.2.3		not-accessible	This table contains the groups associated with a particular service.
OCT xylanFltServiceIndex	1.3.6.1.4.1.800.2.22.2.2.1.1.1	OCTET STRING	read-only	The index is made up of an octet string of ASCII characters containing the name of the service.
INT xylanFltServiceNumberAdminState	1.3.6.1.4.1.800.2.22.2.2.2.1.2	INTEGER	read-write	The current status of this group. active (1) means the route is functioning, delete (2) tells SNMP to delete the route
xylanFltServiceNumberEntry	1.3.6.1.4.1.800.2.22.2.2.2.1		not-accessible	Each entry corresponds to one port number.
OCT xylanFltServiceNumberIndex	1.3.6.1.4.1.800.2.22.2.2.2.1.1	OCTET STRING	read-only	Service number index is made up of the octets of the group name and the port number: ,0,
xylanFltServiceNumberTable	1.3.6.1.4.1.800.2.22.2.2.2		not-accessible	This table contains the port numbers associated with a particular service.
xylanFltServices	1.3.6.1.4.1.800.2.22.2.2
xylanFltServiceTable	1.3.6.1.4.1.800.2.22.2.2.1		not-accessible	Service entry for HRE-X filtering feature. This object contains a collection of IP port numbers and filtering Group objects. Thus rules for different service such as FTP or Telnet may be defined.
xylanFltStaticConfig	1.3.6.1.4.1.800.2.22.2
xylanFltStatus	1.3.6.1.4.1.800.2.22.1
xylanFltTraps	1.3.6.1.4.1.800.2.22.4

RFC description

Manages filtering configuration and status for Alcatel HRE-X filtering architecture on network devices.

Start monitoring Alcatel/Xylan OmniSwitch chassis switches with HRE-X filtering (ACL filter-group/last-denied-packet status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download XYLAN-FLT-MIB

What Is XYLAN-FLT-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description