ZTE-AN-ARP-MIB

All MIBs › ZTE-AN-ARP-MIB

Organization: ZTE Corporation

Last Updated: 2011-08-10

Category: ZTE Access Node (ZTE-AN) Management

Description: Manages ZTE access node ARP table entries, proxy ARP settings, and ARP security configurations.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is ZTE-AN-ARP-MIB?

ZTE-AN-ARP-MIB is a ZTE enterprise MIB for access node equipment, focused on ARP table management, ARP anti-spoofing, and ARP reply agent behavior. It exposes configuration for validating ARP packets on access ports and for controlling how the device responds to ARP queries and replies between the network and customer sides. This is primarily a security/configuration MIB rather than a hardware-health one, but it does allow monitoring of ARP anti-spoofing enforcement state and ARP table entries, which can reveal spoofing attempts or misconfigured ARP proxy behavior. It depends on the standard ARP/IP-MIB concepts that it extends with anti-spoofing and proxy semantics. It is deployed on ZTE access nodes (such as broadband access aggregation devices) at the network edge where ARP-based attacks are a security concern. Engineers can download the ZTE-AN-ARP-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in ZTE-AN-ARP-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

ZTE access node
broadband access aggregation device

Monitoring Examples

An administrator would monitor the ARP anti-spoofing feature's enforcement status on access ports to confirm invalid ARP packets are being dropped, and check ARP reply agent settings to verify the device is answering ARP queries correctly on behalf of customer-side hosts. Only the generic 'IMPORTS' clause was present in sample_objects, so specific table names are inferred from the module description rather than confirmed directly.

What Can Be Monitored

ARP anti-spoofing status
ARP table entries
ARP reply agent configuration
proxy ARP behavior

Imported Objects

From IF-MIB

ifIndex

OBJECT-TYPE

From INET-ADDRESS-MIB

InetAddress
InetAddressPrefixLength
InetAddressType

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Integer32
IpAddress
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE

From SNMPv2-TC

MacAddress
RowStatus
TruthValue

From ZTE-AN-IF-MIB

zxAnSubIfIndex

OBJECT-TYPE

From ZTE-AN-SMI

zxAnServiceSecurity

OBJECT-IDENTITY

From ZTE-AN-TC-MIB

VlanId
ZxAnSubIfIndex
zxAccessNode

OIDs

OID symbolic	OID numeric	Type	Access	Description
zxAnArpMib	1.3.6.1.4.1.3902.1082.70.45			The MIB module is for configuration of ARP anti-spoofing and ARP reply agent features. ARP anti-spoofing is a security mechanism which validate ARP packets seen on access ports. ARP reply agent is a mechanism that the device how to respond to ARP queries received from the network and ARP replies from the customer direction.
zxAnArpMibObjects	1.3.6.1.4.1.3902.1082.70.45.2
zxAnArpAntiSpoofingObjects	1.3.6.1.4.1.3902.1082.70.45.2.1
zxAnArpAntiSpoofingGlobalObjects	1.3.6.1.4.1.3902.1082.70.45.2.1.1
I32 zxAnArpAntiSpoofingIfIndex	1.3.6.1.4.1.3902.1082.70.45.2.1.1.1	Integer32	accessible-for-notify	This object indicates the value of the physical interface from which the zxAnArpSpoofingTrap occurs.
ZXA zxAnArpAntiSpoofingSubIfIndex	1.3.6.1.4.1.3902.1082.70.45.2.1.1.2	ZxAnSubIfIndex	accessible-for-notify	This object indicates the value of the sub-interface from which the zxAnArpSpoofingTrap occurs. The sub-interface for which this feature must be applicable is: SubIfType = ONU service port sub-interface(3).
IP zxAnArpAntiSpoofingIpAddr	1.3.6.1.4.1.3902.1082.70.45.2.1.1.3	IpAddress	accessible-for-notify	This object indicates the IP address obtained at this interface through DHCP dynamic configuration or static configuration by IP source guard module.
MAC zxAnArpAntiSpoofingMac	1.3.6.1.4.1.3902.1082.70.45.2.1.1.4	MacAddress	accessible-for-notify	This object indicates the MAC address obtained at this interface through DHCP dynamic configuration or static configuration by IP source guard module.
MAC zxAnArpAntiSpoofingFakedMac	1.3.6.1.4.1.3902.1082.70.45.2.1.1.5	MacAddress	accessible-for-notify	This object indicates the faked MAC address framed by ARP spoofing attacker from user-side interface.
INT zxAnArpAntiSpoofingEnable	1.3.6.1.4.1.3902.1082.70.45.2.1.1.6	INTEGER	read-write	Enable or disable ARP anti-spoofing function.
BIT zxAnArpAntiSpoofingCapabilities	1.3.6.1.4.1.3902.1082.70.45.2.1.1.100	Bits	read-only	The Arp anti-Spoofing capabilities. The bit value 1 means the function represented by this bit is supported by this equipment. bit 0: value 1 means not supporting zxAnArpAntiSpoofingVlanDirection in zxAnArpAntiSpoofingVlanTable. NOTE: No recommended to display it in NMS.
zxAnArpAntiSpoofingVlanTable	1.3.6.1.4.1.3902.1082.70.45.2.1.2		not-accessible	This table provides the mechanism to control ARP anti-spoofing per VLAN. When a VLAN is created in a device supporting this table, a corresponding entry of this table will be added. If the VLAN number on which ARP anti-spoofing at this interface and ARP anti-spoofing at this interface are both enabled,the ARP requests or ARP responses whose IP-MAC assignment is not compliant, and for which there is therefore no matching entry in the DHCP Snooping Table, they must be rejected.
zxAnArpAntiSpoofingVlanEntry	1.3.6.1.4.1.3902.1082.70.45.2.1.2.1		not-accessible	A row instance contains the configuration to enable or disable ARP anti-spoofing at each existing VLAN.
INT zxAnArpAntiSpoofingVid	1.3.6.1.4.1.3902.1082.70.45.2.1.2.1.1	INTEGER	not-accessible	This object indicates the VLAN number on which ARP anti-spoofing feature is configured. If the VLAN number on which ARP anti-spoofing at this interface and ARP anti-spoofing at this interface are both enabled, the ARP requests or ARP responses whose IP-MAC assignment is not compliant, and for which there is therefore no matching entry in the DHCP Snooping Table, they must be rejected.
INT zxAnArpAntiSpoofingVlanDirection	1.3.6.1.4.1.3902.1082.70.45.2.1.2.1.2	INTEGER	read-create	Direction of ARP anti-Spoofing.
ROW zxAnArpAntiSpoofingVlanRowStatus	1.3.6.1.4.1.3902.1082.70.45.2.1.2.1.50	RowStatus	read-create	This object is used to manage the creation and deletion of rows in this table. It only supports 'active(1)','createAndGo(4)'and 'destroy(6)' value. If this object is set to 'createAndGo(4)', the vlan number on which ARP anti-spoofing is active(1).Setting this object value to destroy(6),the vlan number on which ARP anti-spoofing is inactive.
zxAnArpReplyAgentObjects	1.3.6.1.4.1.3902.1082.70.45.2.2
zxAnArpReplyAgentVlanTable	1.3.6.1.4.1.3902.1082.70.45.2.2.2		not-accessible	This table provides the mechanism to control ARP reply agent per VLAN. When a VLAN is created in a device supporting this table, a corresponding entry of this table will be added. If the VLAN number on which ARP reply agent at this interface and ARP reply agent at this interface are both enabled, The ARP Reply Agent must respond to ARP queries received from the network.
zxAnArpReplyAgentVlanEntry	1.3.6.1.4.1.3902.1082.70.45.2.2.2.1		not-accessible	A row instance contains the configuration to enable or disable ARP reply agent at each existing VLAN.
INT zxAnArpReplyAgentVid	1.3.6.1.4.1.3902.1082.70.45.2.2.2.1.1	INTEGER	not-accessible	This object indicates the VLAN number on which ARP reply agent feature is configured. If the VLAN number on which ARP reply agent at this interface and ARP reply agent at this interface are both enabled, The ARP Reply Agent must respond to ARP queries received from the network.
ROW zxAnArpReplyAgentVlanRowStatus	1.3.6.1.4.1.3902.1082.70.45.2.2.2.1.50	RowStatus	read-create	This object is used to manage the creation and deletion of rows in this table. It only supports 'active(1)','createAndGo(4)'and 'destroy(6)' value. If this object is set to 'createAndGo(4)', the vlan number on which ARP reply agent is active(1).Setting this object value to destroy(6),the vlan number on which ARP reply agent is inactive.
zxAnArpMacForcedForwardObjects	1.3.6.1.4.1.3902.1082.70.45.2.3
zxAnArpMffGlobalObjects	1.3.6.1.4.1.3902.1082.70.45.2.3.1
INT zxAnArpMffEnable	1.3.6.1.4.1.3902.1082.70.45.2.3.1.1	INTEGER	read-write	Enable or disable MFF function.
INT zxAnArpMffGwTransparentEnable	1.3.6.1.4.1.3902.1082.70.45.2.3.1.2	INTEGER	read-write	Enable or disable gateway transparent function when MFF function is enabled. This object is effective only when zxAnArpMffEnable is enabled.
zxAnArpMffTable	1.3.6.1.4.1.3902.1082.70.45.2.3.2		not-accessible	This table indicates MFF configuration.MFF is MAC-Forced Forwarding.This table supports 32 VLAN's configuration of the MFF gateway,and 8 gateway configuration per vlan.In a same VLAN, IP or MAC of the gateway should not be duplicated.
zxAnArpMffEntry	1.3.6.1.4.1.3902.1082.70.45.2.3.2.1		not-accessible	A row instance contains the configuration to enable or disable MFF at each existing VLAN.
I32 zxAnArpMffVid	1.3.6.1.4.1.3902.1082.70.45.2.3.2.1.1	Integer32	not-accessible	An index for zxAnArpMffTable.
IP zxAnArpMffGatewayIpAddr	1.3.6.1.4.1.3902.1082.70.45.2.3.2.1.2	IpAddress	not-accessible	MFF gateway IP address.
IP zxAnArpMffGatewayIpMask	1.3.6.1.4.1.3902.1082.70.45.2.3.2.1.3	IpAddress	read-create	MFF gateway IP mask.
MAC zxAnArpMffGatewayMac	1.3.6.1.4.1.3902.1082.70.45.2.3.2.1.4	MacAddress	read-create	MFF gateway MAC address. A 0 value of this variable indicates no configure.
INT zxAnArpMffGatewayMacConfMode	1.3.6.1.4.1.3902.1082.70.45.2.3.2.1.5	INTEGER	read-only	MFF gateway MAC address configuration mode. If zxAnArpMffGatewayMac has been configured, the mode should be manual when doing a request, otherwise, the mode should be automatic.
ROW zxAnArpMffRowStatus	1.3.6.1.4.1.3902.1082.70.45.2.3.2.1.50	RowStatus	read-create	This object is used to manage the creation and deletion of rows in this table. It only supports 'active(1)','createAndGo(4)'and 'destroy(6)' value. If this object is set to 'createAndGo(4)', the VLAN on which MFF is active(1).Setting this object value to destroy(6),the VLAN on which MFF is inactive.
zxAnArpFilterObjects	1.3.6.1.4.1.3902.1082.70.45.2.4
zxAnArpFilterVlanConfTable	1.3.6.1.4.1.3902.1082.70.45.2.4.2		not-accessible	ARP filter table based on VLAN. If the VLAN item is set, the NE will dispatch the ARP packets downward by check the out port strictly.
zxAnArpFilterVlanConfEntry	1.3.6.1.4.1.3902.1082.70.45.2.4.2.1		not-accessible	An entry in zxAnArpFilterVlanConfTable.
I32 zxAnArpFilterVlanConfVid	1.3.6.1.4.1.3902.1082.70.45.2.4.2.1.1	Integer32	not-accessible	This object indicates the VLAN ID on which ARP filter feature is configured.
ROW zxAnArpFilterVlanConfRowStatus	1.3.6.1.4.1.3902.1082.70.45.2.4.2.1.50	RowStatus	read-create	The status of this conceptual row. The supported actions of this conceptual row only include: 'createAndGo' and 'destroy'. To create a row in this table, a manager must set this object to createAndGo(4), and must comply with the multi-variables binding rule described in zxAnArpFilterVlanConfEntry. To delete a row in this table, a manager must set this object to destroy(6). To get this object, the agent always returns active(1). And the entry just supports createAndGo(4) and destroy(6) operation.
zxAnArpConformance	1.3.6.1.4.1.3902.1082.70.45.4
zxAnArpCompliances	1.3.6.1.4.1.3902.1082.70.45.4.1
zxAnArpAntiSpoofingCompliances	1.3.6.1.4.1.3902.1082.70.45.4.1.1			The compliance statement for implementing Arp Anti-Spoofing MIB. Only supports C3XX, not supports C6XX.
zxAnArpReplyAgentCompliances	1.3.6.1.4.1.3902.1082.70.45.4.1.2			The compliance statement for implementing Arp Reply Agent MIB.
zxAnArpMFFCompliances	1.3.6.1.4.1.3902.1082.70.45.4.1.3			The compliance statement for implementing Arp Mff MIB.
zxAnArpFilterCompliances	1.3.6.1.4.1.3902.1082.70.45.4.1.4			The compliance statement for implementing Arp Filter MIB.
zxAnArpGroups	1.3.6.1.4.1.3902.1082.70.45.4.2
zxAnArpAntiSpoofingVlanGroup	1.3.6.1.4.1.3902.1082.70.45.4.2.1			A collection of object which are used to configure as well as show information regarding the Arp Anti-Spoofing feature per VLAN.
zxAnArpReplyAgentVlanGroup	1.3.6.1.4.1.3902.1082.70.45.4.2.4			A collection of object which are used to configure as well as show information regarding the Arp Reply Agent feature per VLAN.
zxAnArpSpoofingGlobalGroup	1.3.6.1.4.1.3902.1082.70.45.4.2.7			A collection of object which are used to configure as well as show information regarding the Arp Anti-Spoofing Global Objects feature per user interface.
zxAnArpMffGlobalObjectsGroup	1.3.6.1.4.1.3902.1082.70.45.4.2.8			A collection of object which are used to configure as well as show information regarding the Arp Mff Global Objects feature per user interface.
zxAnArpMffTableConfigGroup	1.3.6.1.4.1.3902.1082.70.45.4.2.9			A collection of object which are used to configure as well as show information regarding the Arp Mff Table feature per user interface.
zxAnArpFilterVlanConfGroup	1.3.6.1.4.1.3902.1082.70.45.4.2.10			A collection of object which are used to configure as well as show information regarding the Arp Filter Table feature per user interface.

RFC description

Manages ARP anti-spoofing, ARP reply agent, and MAC forced forwarding security features on access nodes.

Start monitoring ZTE access node, broadband access aggregation device (ARP anti-spoofing/reply-agent config status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download ZTE-AN-ARP-MIB

What Is ZTE-AN-ARP-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description