ZTE-AN-MAC-ANTI-SPOOFING-MIB

All MIBs › ZTE-AN-MAC-ANTI-SPOOFING-MIB

Organization: ZTE Corporation

Last Updated: 2014-03-07

Category: Network Security, ZTE Access Node (ZTE-AN) Management

Description: Covers MAC anti-spoofing security policies on ZTE access nodes, aimed at preventing subscribers from forging MAC addresses.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is ZTE-AN-MAC-ANTI-SPOOFING-MIB?

ZTE-AN-MAC-ANTI-SPOOFING-MIB is a ZTE proprietary MIB for ZTE Access Node (AN) broadband access equipment that manages MAC address anti-spoofing security policy (abbreviated 'Mas' in the object naming). Conceptually it is meant to expose configuration enabling anti-spoofing enforcement and, typically, tables tracking bound/learned MAC addresses or violation events, but the only object names present in this data are the standard conformance nodes (zxAnMasConformance, zxAnMasCompliances, zxAnMasGroups). Its functional purpose is security-fault status monitoring — detecting and blocking subscriber MAC address forgery on access ports — which in the full object tree would surface as port-level enforcement state or violation counters, though those specific leaf objects are not represented in the available sample. It relies on ZTE's private enterprise MIB numbering and complements ZTE's broader Access Node MIB suite for subscriber port management. It's deployed on ZTE broadband access nodes (e.g., GPON/DSLAM access platforms) in service-provider access networks to enforce subscriber-side MAC address integrity. Network engineers evaluating or troubleshooting this functionality can download the ZTE-AN-MAC-ANTI-SPOOFING-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in ZTE-AN-MAC-ANTI-SPOOFING-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

ZTE Access Node (DSLAM/GPON broadband access equipment)

Monitoring Examples

Only the conformance section of the module is represented in the available data (zxAnMasConformance, zxAnMasCompliances, zxAnMasGroups) — this looks like the compliance/conformance portion of the MIB rather than its runtime data objects, so a concrete monitoring scenario referencing real data objects cannot be constructed from what's provided here.

Imported Objects

From IF-MIB

ifIndex

OBJECT-TYPE

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Integer32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE

From SNMPv2-TC

MacAddress

From ZTE-AN-IF-MIB

zxAnSubIfIndex

OBJECT-TYPE

From ZTE-AN-SMI

zxAnServiceSecurity

OBJECT-IDENTITY

From ZTE-AN-TC-MIB

ZxAnSubIfIndex

OIDs

OID symbolic	OID numeric	Type	Access	Description
zxAnMasMib	1.3.6.1.4.1.3902.1082.70.20			This MIB defines mac-anti-spoofing objects of zte Access Node, Mas means mac-anti-spoofing.
zxAnMasGlobalObjects	1.3.6.1.4.1.3902.1082.70.20.1
INT zxAnMasEnable	1.3.6.1.4.1.3902.1082.70.20.1.1	INTEGER	read-write	Enable or disable MAC-anti-spoofing(Mas).
INT zxAnMasUplinkProtectEnable	1.3.6.1.4.1.3902.1082.70.20.1.2	INTEGER	read-write	Enable or disable global uplink-protect status.When zxAnMasEnable is enable, this value is valid. As follows are the combination of zxAnMasEnable and zxAnMasUplinkProtectEnable: 1) zxAnMasEnable is disabled, then MAC move can happen and won't be forbidden by the system. 2) zxAnMasEnable is enable and zxAnMasUplinkProtectEnable is enabled, then MAC move between user-port is forbidden, MAC can move from user-port to uplink-port and MAC can move between two uplink-port, can't move from uplink-port to user-port. This combination is the recommended configure. 3) zxAnMasEnable is enable and zxAnMasUplinkProtectEnable is disabled, then any MAC move will be forbidden by the system. 4)Only supports C3XX, not supports C6XX.
INT zxAnMasUserSideMacMoveEnable	1.3.6.1.4.1.3902.1082.70.20.1.3	INTEGER	read-write	Enable or disable user-side MAC address moving function. When zxAnMasEnable and zxAnMasUplinkProtectEnable are all enabled, zxAnMasUserSideMacMoveEnable is activated. enabled(1) - MAC address can move between user ports, but can't move from uplink port to user port. disabled(2) - MAC address can't move between user ports. Only supports C3XX, not supports C6XX.
OCT zxAnMasMacMovePermitVlanList	1.3.6.1.4.1.3902.1082.70.20.1.4	OCTET STRING	read-write	MAC-anti-spoofing(Mas) VLAN ID list for permitting MAC address moving. \| Byte 0 \| Byte 1 \| Byte 2 \| Byte 3 ... Byte 512 \| +-----------+-----------+-----------+-----------...--------------+ \| BitMap \| BitMap \| BitMap \| BitMap ... BitMap \| \| VLAN 0-7 \| VLAN8-15 \| VLAN16-23 \| VLAN24-31 ...VLAN4088-4095 \| +-----------+-----------+-----------+-----------...--------------+ If one bit is set to '1', the corresponding VLAN ID is configured to permit MAC address moving. VLAN 0 and VLAN 4095 are invalid, so bit 0 and bit 4095 must be always '0'. This object is effective only when zxAnMasEnable is enabled.
zxAnMasObjects	1.3.6.1.4.1.3902.1082.70.20.2
zxAnMasMacMoveObjects	1.3.6.1.4.1.3902.1082.70.20.2.1
zxAnMasMacMoveGlbObjects	1.3.6.1.4.1.3902.1082.70.20.2.1.1
INT zxAnMasMacMoveReportEnable	1.3.6.1.4.1.3902.1082.70.20.2.1.1.1	INTEGER	read-write	Enable or disable MAC move notification report control. The related notification group is zxAnMasMacMoving and zxAnMasMacMoveForbidden. When zxAnMasMacMoveReportEnable is disabled, the system can't detect any MAC move. When zxAnMasMacMoveReportEnable is enabled, the system can detect MAC move.A MAC move can be detected by main-card or user-card and will be recorded as a MAC move log. Based on the MAC move log, a MAC move notification will be reported to NMS.
I32 zxAnMasMacMoveReportInterval	1.3.6.1.4.1.3902.1082.70.20.2.1.1.2	Integer32	read-write	The report interval of the same MAC move notification.When zxAnMasMacMoveReportEnable is enable and a MAC move is detected by system, the system will record a MAC move log. The first time this MAC move log will be reported to NMS in 5 seconds,later this same MAC move log will be reported to NMS after the defined zxAnMasMacMoveReportInterval.
zxAnMasMacMoveLogTable	1.3.6.1.4.1.3902.1082.70.20.2.1.2		not-accessible	A table that contains the MAC move information.
zxAnMasMacMoveLogEntry	1.3.6.1.4.1.3902.1082.70.20.2.1.2.1		not-accessible	This table contains information about a specific MAC move log. When a MAC move is detected by the system, it will be recorded as a MAC move log.
I32 zxAnMasMacMoveLogIndex	1.3.6.1.4.1.3902.1082.70.20.2.1.2.1.1	Integer32	not-accessible	The index of a specific MAC move log.The system will store at most 256 different MAC move logs in current.
MAC zxAnMasMacMoveLogMacAddr	1.3.6.1.4.1.3902.1082.70.20.2.1.2.1.2	MacAddress	read-only	This value indicates the MAC address that move between zxAnMasMacMoveLogFromIfIndex and zxAnMasMacMoveLogToIfIndex on zxAnMasMacMoveLogVid. This object is instantiated only when zxAnMasMacMoveReportEnable value is set to enable(1) and a MAC move is detected by the MAC move notification feature.
I32 zxAnMasMacMoveLogVid	1.3.6.1.4.1.3902.1082.70.20.2.1.2.1.3	Integer32	read-only	This value indicates the VLAN on which the zxAnMasMacMoveLogMacAddr is moving.This object is instantiated only when zxAnMasMacMoveReportEnable value is set to enable(1) and a MAC move is detected by the MAC move notification feature.
I32 zxAnMasMacMoveLogFromIfIndex	1.3.6.1.4.1.3902.1082.70.20.2.1.2.1.4	Integer32	read-only	The value of the port from which the zxAnMasMacMoveLogMacAddr is moving on zxAnMasMacMoveLogVid. This object is instantiated only when zxAnMasEnable and zxAnMasMacMoveReportEnable value is set to enable(1) and a MAC move is detected by the MAC move notification feature.
ZXA zxAnMasMacMoveLogFromSubIfIndex	1.3.6.1.4.1.3902.1082.70.20.2.1.2.1.5	ZxAnSubIfIndex	read-only	The value of the sub-port from which the zxAnMasMacMoveLogMacAddr is moving on zxAnMasMacMoveLogVid.This object is instantiated only when zxAnMasMacMoveReportEnable value is set to enable(1) and a MAC move is detected by the MAC move notification feature.
I32 zxAnMasMacMoveLogToIfIndex	1.3.6.1.4.1.3902.1082.70.20.2.1.2.1.6	Integer32	read-only	The value of the port to which the zxAnMasMacMoveLogMacAddr is moving on zxAnMasMacMoveLogVid.This object is instantiated only when zxAnMasMacMoveReportEnable value is set to enable(1) and a MAC move is detected by the MAC move notification feature.
ZXA zxAnMasMacMoveLogToSubIfIndex	1.3.6.1.4.1.3902.1082.70.20.2.1.2.1.7	ZxAnSubIfIndex	read-only	The value of the sub-port to which the zxAnMasMacMoveLogMacAddr is moving on zxAnMasMacMoveLogVid. This object is instantiated only when zxAnMasMacMoveReportEnable value is set to enable(1) and a MAC move is detected by the MAC move notification feature.
zxAnMasIfObjects	1.3.6.1.4.1.3902.1082.70.20.2.2
zxAnMasIfConfTable	1.3.6.1.4.1.3902.1082.70.20.2.2.2		not-accessible	MAC-anti-spoofing(Mas) trust configuration for permitting MAC address moving based on interface table.
zxAnMasIfConfEntry	1.3.6.1.4.1.3902.1082.70.20.2.2.2.1		not-accessible	An entry in zxAnMasIfConfTable.
INT zxAnMasIfTrustEnable	1.3.6.1.4.1.3902.1082.70.20.2.2.2.1.1	INTEGER	read-write	Enable or disable MAC-anti-spoofing(Mas) trust enabling on uplink interface.
zxAnMasNotifications	1.3.6.1.4.1.3902.1082.70.20.3
zxAnMasMacMoveTraps	1.3.6.1.4.1.3902.1082.70.20.3.1
NTF zxAnMasMacMoving	1.3.6.1.4.1.3902.1082.70.20.3.1.1			zxAnMasMacMoving means the mac move is generated and successful. If zxAnMasMacMoveReportEnable is enable, zxAnMasMacMoving may be generated when a MAC entry is moving between two interfaces.
NTF zxAnMasMacMoveForbidden	1.3.6.1.4.1.3902.1082.70.20.3.1.2			zxAnMasMacMoveForbidden means the mac move is forbbiden by system.If both zxAnMasEnable and zxAnMasMacMoveReportEnable is enable,zxAnMasMacMoveForbidden may be generated when a MAC entry attempts to move between two interfaces.
zxAnMasConformance	1.3.6.1.4.1.3902.1082.70.20.4
zxAnMasCompliances	1.3.6.1.4.1.3902.1082.70.20.4.1
zxAnMasCompliance	1.3.6.1.4.1.3902.1082.70.20.4.1.1			The compliance statement for entities which implement the ZTE-AN-MAC-ANTI-SPOOFING-MIB.OnlyC3XX support,C6XX not support anymore
zxAnMasGroups	1.3.6.1.4.1.3902.1082.70.20.4.2
zxAnMasGlobalGroup	1.3.6.1.4.1.3902.1082.70.20.4.2.1			A collection of objects providing MAC-anti-spoofing global information.
zxAnMasMacMoveGlbGroup	1.3.6.1.4.1.3902.1082.70.20.4.2.2			A collection of objects providing MAC move notification report-control information.
zxAnMasMacMoveLogGroup	1.3.6.1.4.1.3902.1082.70.20.4.2.3			A collection of objects providing MAC move log information.
zxAnMasIfConfGroup	1.3.6.1.4.1.3902.1082.70.20.4.2.4			A collection of objects providing MAC port configuration.
zxAnMasMacMoveTrapsGroup	1.3.6.1.4.1.3902.1082.70.20.4.2.50			A collection of objects providing MAC move notification information.

RFC description

Manages ZTE access node MAC anti-spoofing security policies to prevent subscriber MAC address forgery.

Start monitoring ZTE Access Node (DSLAM/GPON broadband access equipment) (MAC anti-spoofing enforcement/conformance status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download ZTE-AN-MAC-ANTI-SPOOFING-MIB

What Is ZTE-AN-MAC-ANTI-SPOOFING-MIB?

Supported Devices

Monitoring Examples

This MIB depends on

Related MIBs

RFC description