ZYXEL-ACL-MIB

All MIBs › ZYXEL-ACL-MIB

Organization: Enterprise Solution ZyXEL

Last Updated: 2012-07-01

Category: ZyXEL Security and Access Control

Description: Defines ZyXEL access control list rules for filtering network traffic based on packet header fields.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is ZYXEL-ACL-MIB?

ZYXEL-ACL-MIB is a ZyXEL private module defining Access Control List (ACL) configuration objects used to filter network traffic based on packet header fields (e.g., source/destination address, port, protocol) on ZyXEL switches. It exposes configuration data for ACL rule definitions and their match/action criteria rather than runtime traffic statistics. Its monitoring value is mainly confirming the software configuration status of security filtering rules, letting an administrator verify an ACL rule is present and correctly specified, which is important for detecting a rule that failed to apply and could leave traffic unfiltered or, conversely, incorrectly block legitimate traffic. It has no strong dependency on other MIBs beyond standard interface indexing conventions where ACLs are bound to specific ports/VLANs. It is deployed on ZyXEL managed switches wherever port- or VLAN-based traffic filtering/security policy is required. Network engineers evaluating or troubleshooting this functionality can download the ZYXEL-ACL-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in ZYXEL-ACL-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

ZyXEL managed switch

Monitoring Examples

No sample objects were provided for this module, so specific object names cannot be cited; conceptually, an administrator would poll configured ACL rules and their bound interfaces/VLANs to confirm the expected filtering policy is active on each port. An ACL rule missing from its expected interface binding would reveal a security policy gap allowing traffic that should have been blocked.

What Can Be Monitored

ACL rule configuration
ACL match criteria
ACL-to-port/VLAN binding

Imported Objects

From INET-ADDRESS-MIB

InetAddress

From P-BRIDGE-MIB

EnabledStatus

From Q-BRIDGE-MIB

PortList

From SNMPv2-SMI

IpAddress
MODULE-IDENTITY
OBJECT-TYPE

From SNMPv2-TC

DisplayString
MacAddress
RowStatus

From ZYXEL-ES-SMI

esMgmt

OBJECT-IDENTITY

OIDs

OID symbolic	OID numeric	Type	Access	Description
zyxelAcl	1.3.6.1.4.1.890.1.15.3.10			The subtree for access control list (ACL)
zyxelClassifierStatus	1.3.6.1.4.1.890.1.15.3.10.1
zyxelClassifierTable	1.3.6.1.4.1.890.1.15.3.10.1.1		not-accessible	The table contains classifier configuration.
zyxelClassifierEntry	1.3.6.1.4.1.890.1.15.3.10.1.1.1		not-accessible	An entry contains classifier configuration.
STR zyClassifierName	1.3.6.1.4.1.890.1.15.3.10.1.1.1.1	DisplayString	not-accessible	The name of classifier rule is used for identifying purposes.
ENA zyClassifierState	1.3.6.1.4.1.890.1.15.3.10.1.1.1.2	EnabledStatus	read-only	Enable/Disable classifier rule on this switch.
INT zyClassifierPacketFormat	1.3.6.1.4.1.890.1.15.3.10.1.1.1.3	INTEGER	read-only	Packet format for classifier rule. A value of 802.3 indicates that the packets are formatted according to the IEEE 802.3 standards. A value of Ethernet II indicates that the packets are formatted according to RFC 894, Ethernet II encapsulation.
INT zyClassifierVid	1.3.6.1.4.1.890.1.15.3.10.1.1.1.4	INTEGER	read-only	Source VLAN ID for classifier rule. The range is 1~4094 and value 0 means any VLAN.
INT zyClassifier8021pPriority	1.3.6.1.4.1.890.1.15.3.10.1.1.1.5	INTEGER	read-only	802.1p priority for classifier rule. 0~7. The range is 0~7 and value -1 means any priority level.
INT zyClassifierEthernetType	1.3.6.1.4.1.890.1.15.3.10.1.1.1.6	INTEGER	read-only	Ethernet type for classifier rule. It is represented in decimal expression and value 65535 means any Ethernet type.
MAC zyClassifierSourceMacAddress	1.3.6.1.4.1.890.1.15.3.10.1.1.1.7	MacAddress	read-only	Source MAC address for classifier rule. 00:00:00:00:00:00 means any source MAC address.
INT zyClassifierIncomingPort	1.3.6.1.4.1.890.1.15.3.10.1.1.1.8	INTEGER	read-only	Incoming Port for classifier rule. Value 65536 means any port.
MAC zyClassifierDestinationMacAddress	1.3.6.1.4.1.890.1.15.3.10.1.1.1.9	MacAddress	read-only	Destination MAC address for classifier rule. 00:00:00:00:00:00 means any destination MAC address.
INT zyClassifierDSCP	1.3.6.1.4.1.890.1.15.3.10.1.1.1.10	INTEGER	read-only	DSCP (DiffServ Code Point) for classifier rule. The range is 0~63 and value -1 means any DSCP.
INT zyClassifierIpProtocol	1.3.6.1.4.1.890.1.15.3.10.1.1.1.11	INTEGER	read-only	IP Protocol for classifier rule. Value 255 means any IP protocol.
ENA zyClassifierEstablishOnly	1.3.6.1.4.1.890.1.15.3.10.1.1.1.12	EnabledStatus	read-only	Establish Only for TCP protocol type in classifier rule. This means that the switch will pick out the packets that are sent to establish TCP connections.
IP zyClassifierSourceIpAddress	1.3.6.1.4.1.890.1.15.3.10.1.1.1.13	IpAddress	read-only	Source IP address for classifier rule. 0.0.0.0 means any source IP address.
INT zyClassifierSourceIpMaskBits	1.3.6.1.4.1.890.1.15.3.10.1.1.1.14	INTEGER	read-only	Source IP mask bits for classifier rule.
INT zyClassifierSourceSocket	1.3.6.1.4.1.890.1.15.3.10.1.1.1.15	INTEGER	read-only	Source socket number for classifier rule. Value 0 means any socket number.
IP zyClassifierDestinationIpAddress	1.3.6.1.4.1.890.1.15.3.10.1.1.1.16	IpAddress	read-only	Destination IP address for classifier rule. 0.0.0.0 means any destination IP address.
INT zyClassifierDestinationIpMaskBits	1.3.6.1.4.1.890.1.15.3.10.1.1.1.17	INTEGER	read-only	Destination IP mask bits for classifier rule.
INT zyClassifierDestinationSocket	1.3.6.1.4.1.890.1.15.3.10.1.1.1.18	INTEGER	read-only	Destination socket number for classifier rule. Value 0 means any socket number.
INT zyClassifierIPv6DSCP	1.3.6.1.4.1.890.1.15.3.10.1.1.1.19	INTEGER	read-only	DSCP (DiffServ Code Point) for classifier rule. The range is 0~63 and value -1 means any DSCP.
INT zyClassifierIPv6NextHeader	1.3.6.1.4.1.890.1.15.3.10.1.1.1.20	INTEGER	read-only	IPv6 next header protocol type for classifier rule. Value 255 means any protocol type.
ENA zyClassifierIPv6EstablishOnly	1.3.6.1.4.1.890.1.15.3.10.1.1.1.21	EnabledStatus	read-only	Establish Only for TCP protocol type in classifier rule. This means that the switch will pick out the packets that are sent to establish TCP connections.
IP zyClassifierIPv6SourceIpAddress	1.3.6.1.4.1.890.1.15.3.10.1.1.1.22	InetAddress	read-only	IPv6 source address for classifier rule. :: means any IPv6 source ip address.
INT zyClassifierIPv6SourceIpPrefixLength	1.3.6.1.4.1.890.1.15.3.10.1.1.1.23	INTEGER	read-only	IPv6 source address prefix length for classifier rule.
IP zyClassifierIPv6DestinationIpAddress	1.3.6.1.4.1.890.1.15.3.10.1.1.1.24	InetAddress	read-only	IPv6 destination address for classifier rule. :: means any IPv6 destination ip address.
INT zyClassifierIPv6DestinationIpPrefixLength	1.3.6.1.4.1.890.1.15.3.10.1.1.1.25	INTEGER	read-only	IPv6 destination address prefix length for classifier rule.
ROW zyClassifierRowstatus	1.3.6.1.4.1.890.1.15.3.10.1.1.1.26	RowStatus	read-only	This object shows the entry of classifier rule status.
zyxelPolicyStatus	1.3.6.1.4.1.890.1.15.3.10.2
zyxelPolicyTable	1.3.6.1.4.1.890.1.15.3.10.2.1		not-accessible	The table contains policy configuration.
zyxelPolicyEntry	1.3.6.1.4.1.890.1.15.3.10.2.1.1		not-accessible	An entry contains policy configuration.
STR zyPolicyName	1.3.6.1.4.1.890.1.15.3.10.2.1.1.1	DisplayString	not-accessible	The name of policy rule is used for identifying purposes.
ENA zyPolicyState	1.3.6.1.4.1.890.1.15.3.10.2.1.1.2	EnabledStatus	read-only	Enable/Disable policy rule on this switch.
STR zyPolicyClassifier	1.3.6.1.4.1.890.1.15.3.10.2.1.1.3	DisplayString	read-only	The classifier(s) applies in this policy rule.
INT zyPolicyVid	1.3.6.1.4.1.890.1.15.3.10.2.1.1.4	INTEGER	read-only	VLAN ID for policy rule.
INT zyPolicyEgressPort	1.3.6.1.4.1.890.1.15.3.10.2.1.1.5	INTEGER	read-only	The outgoing port number in this policy rule.
INT zyPolicy8021pPriority	1.3.6.1.4.1.890.1.15.3.10.2.1.1.6	INTEGER	read-only	Specify a 802.1p priority level for policy rule. The value of 802.1p is between 0 and 7.
INT zyPolicyDSCP	1.3.6.1.4.1.890.1.15.3.10.2.1.1.7	INTEGER	read-only	Specify a DSCP (DiffServ Code Point) for policy rule. DSCP number is between 0 and 63.
INT zyPolicyTOS	1.3.6.1.4.1.890.1.15.3.10.2.1.1.8	INTEGER	read-only	Specify the type of service (TOS) priority level for policy rule. The value of TOS is between 0 and 7.
INT zyPolicyBandwidth	1.3.6.1.4.1.890.1.15.3.10.2.1.1.9	INTEGER	read-only	Specify the bandwidth for policy rule in kilobit per second (Kbps).
INT zyPolicyOutOfProfileDSCP	1.3.6.1.4.1.890.1.15.3.10.2.1.1.10	INTEGER	read-only	Specify a new DSCP number (between 0 and 63) for policy rule if you want to replace or remark the DSCP number for out-of-profile traffic.
INT zyPolicyForwardingAction	1.3.6.1.4.1.890.1.15.3.10.2.1.1.11	INTEGER	read-only	There are three forwarding actions for policy rule. 'No change' is forward the packets. 'Discard the packet' is drop the packets. 'Do not drop the matching frame previously marked for dropping' is retain the frames that were marked to be dropped before.
INT zyPolicyPriorityAction	1.3.6.1.4.1.890.1.15.3.10.2.1.1.12	INTEGER	read-only	There are four priority actions for policy rule. 'No change' is keep the priority setting of the frames. 'Set the packet's 802.1 priority' is replace the packet's 802.1 priority field with the value you set in the Priority field. 'Send the packet to priority queue' is put the packets in the designated queue. 'Replace the 802.1 priority field with the IP TOS value' to replace the packet's 802.1 priority field with the value you set in the TOS field.
INT zyPolicyDiffServAction	1.3.6.1.4.1.890.1.15.3.10.2.1.1.13	INTEGER	read-only	There are four DiffServ actions for policy rule. 'No change' is keeping the TOS and/or DSCP fields in the packets. 'Set the packet's TOS field' is set the TOS field with the value you configure in the TOS field. 'Replace the IP TOS with the 802.1 priority value' is replace the TOS field with the value you configure in the Priority field. 'Set the Diffserv Codepoint field in the frame' to set the DSCP field with the value you configure in the DSCP field.
BIT zyPolicyOutgoingAction	1.3.6.1.4.1.890.1.15.3.10.2.1.1.14	Bits	read-only	There are four outgoing actions for policy rule. 'Send the packet to the mirror port' is sent the packet to the mirror port. 'Send the packet to the egress port' is sent the packet to the egress port. 'Send the matching frames to the egress port' is sent the matching policy rule frames to the egress port. 'Set the packets VLAN ID' is set packet with tag.
INT zyPolicyMeteringState	1.3.6.1.4.1.890.1.15.3.10.2.1.1.15	INTEGER	read-only	Enable/Disable bandwidth limitation on the traffic flow(s) then set the actions to be taken on out-of-profile packets.
BIT zyPolicyOutOfProfileAction	1.3.6.1.4.1.890.1.15.3.10.2.1.1.16	Bits	read-only	There are four out of profile actions for policy rule. 'Drop the packet' is discard the out-of-profile traffic. 'Change the DSCP value' is replace the DSCP field with the value specified in the Out of profile DSCP field. 'Set Out-Drop Precedence' is mark out-of-profile traffic and drop it when network is congested. 'Do not drop the matching frame previously marked for dropping' to queue the frames that are marked to be dropped.
ROW zyPolicyRowstatus	1.3.6.1.4.1.890.1.15.3.10.2.1.1.17	RowStatus	read-only	This object shows the entry of policy rule status.

RFC description

ZyXEL Communications vendor-private MIB for Access Control List (ACL) management on network devices.

Start monitoring ZyXEL managed switch (ACL rule-definition/match-action config status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download ZYXEL-ACL-MIB

What Is ZYXEL-ACL-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description