ZYXEL-AclV2-MIB

All MIBs › ZYXEL-AclV2-MIB

Organization: Enterprise Solution ZyXEL

Last Updated: 2012-07-01

Category: ZyXEL Security and Access Control

Description: Provides extended ZyXEL ACL v2 management for advanced packet filtering with enhanced rule matching capabilities.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is ZYXEL-AclV2-MIB?

ZYXEL-AclV2-MIB provides an extended, second-generation Access Control List (ACL) management interface for ZyXEL managed switches, enabling more advanced packet-filtering rule definitions than the original ACL MIB. It exposes configuration objects for defining ACL rules with enhanced match criteria and the actions applied to matching traffic, along with objects to bind rules to interfaces. Its monitoring value is primarily configuration-state visibility: an administrator can verify which ACL rules and bindings are active on a port and confirm that security policy changes have taken effect as intended, rather than tracking hardware health directly. It builds on the vendor-neutral concept of standards-based packet filtering and is a complement to ZyXEL's original ACL MIB. It is deployed on ZyXEL managed switches in enterprise networks requiring granular traffic filtering and security policy enforcement, and the ZYXEL-AclV2-MIB download is available to administrators who want to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in ZYXEL-AclV2-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

ZyXEL managed switches

Monitoring Examples

No object names were captured in sample_objects, but consistent with its purpose the module would expose an ACL rule table and a rule-to-port binding table. An administrator would poll the rule table to confirm a newly added filtering rule, such as blocking a specific source subnet, is present and correctly bound to the intended port, verifying the security policy was applied as configured.

What Can Be Monitored

ACL rule definitions
rule match criteria
rule actions
rule-to-port bindings

Imported Objects

From INET-ADDRESS-MIB

InetAddress

From P-BRIDGE-MIB

EnabledStatus

From Q-BRIDGE-MIB

PortList

From SNMPv2-SMI

IpAddress
MODULE-IDENTITY
OBJECT-TYPE

From SNMPv2-TC

DisplayString
MacAddress
RowStatus

From ZYXEL-ES-SMI

esMgmt

OBJECT-IDENTITY

How to Use in IPNetwork Monitor

Example using zyAclV2ClassifierMatchCount OID:

Select a ZyXEL managed switch (extended ACL rule/binding config status) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type zyAclV2ClassifierMatchCount into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. It reports match-Count of this classifier rule. It will show the matched packet count of this rule if zyAclV2ClassifierCount is enabled. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter64-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
ENA zyAclV2ClassifierCountState	1.3.6.1.4.1.890.1.15.3.105.1.1.1.4	EnabledStatus	read-only	Enable/disable count on this classifier rule. To Enable counting the matched packet number of this rule.
INT zyAclV2ClassifierEthernet8021pPriority	1.3.6.1.4.1.890.1.15.3.105.1.2.1.4	INTEGER	read-only	802.1p priority for classifier rule. 0~7. The range is 0~7 and value -1 means any priority level.
MAC zyAclV2ClassifierEthernetDestinationMacAddress	1.3.6.1.4.1.890.1.15.3.105.1.2.1.9	MacAddress	read-only	Destination MAC address for classifier rule. 00:00:00:00:00:00 means any destination MAC address.
MAC zyAclV2ClassifierEthernetDestinationMACMask	1.3.6.1.4.1.890.1.15.3.105.1.2.1.10	MacAddress	read-only	Destination MAC Mask for classifier rule.
INT zyAclV2ClassifierEthernetInner8021pPriority	1.3.6.1.4.1.890.1.15.3.105.1.2.1.5	INTEGER	read-only	Inner 802.1p priority for classifier rule, 0~7. Value -1 means any priority level.
INT zyAclV2ClassifierEthernetPacketFormat	1.3.6.1.4.1.890.1.15.3.105.1.2.1.3	INTEGER	read-only	Packet format for classifier rule. A value of 802.3 indicates that the packets are formatted according to the IEEE 802.3 standards. A value of Ethernet II indicates that the packets are formatted according to RFC 894, Ethernet II encapsulation.
MAC zyAclV2ClassifierEthernetSourceMacAddress	1.3.6.1.4.1.890.1.15.3.105.1.2.1.7	MacAddress	read-only	Source MAC address for classifier rule. 00:00:00:00:00:00 means any source MAC address.
MAC zyAclV2ClassifierEthernetSourceMACMask	1.3.6.1.4.1.890.1.15.3.105.1.2.1.8	MacAddress	read-only	Source MAC Mask for classifier rule.
POR zyAclV2ClassifierEthernetSourcePorts	1.3.6.1.4.1.890.1.15.3.105.1.2.1.1	PortList	read-only	Source Port List for classifier rule.
POR zyAclV2ClassifierEthernetSourceTrunks	1.3.6.1.4.1.890.1.15.3.105.1.2.1.2	PortList	read-only	Source Trunk List for classifier rule.
INT zyAclV2ClassifierEthernetType	1.3.6.1.4.1.890.1.15.3.105.1.2.1.6	INTEGER	read-only	Ethernet type for classifier rule. It is represented in decimal expression and value 65535 means any Ethernet type.
OCT zyAclV2ClassifierInnerVlanMap1k	1.3.6.1.4.1.890.1.15.3.105.1.4.1.1	OCTET STRING	read-only	inner VLAN ID List for classifer rule. range : 1~4094.
OCT zyAclV2ClassifierInnerVlanMap2k	1.3.6.1.4.1.890.1.15.3.105.1.4.1.2	OCTET STRING	read-only	inner VLAN ID List for classifer rule. range : 1~4094.
OCT zyAclV2ClassifierInnerVlanMap3k	1.3.6.1.4.1.890.1.15.3.105.1.4.1.3	OCTET STRING	read-only	inner VLAN ID List for classifer rule. range : 1~4094.
OCT zyAclV2ClassifierInnerVlanMap4k	1.3.6.1.4.1.890.1.15.3.105.1.4.1.4	OCTET STRING	read-only	inner VLAN ID List for classifer rule. range : 1~4094.
IP zyAclV2ClassifierIpDestinationIpAddress	1.3.6.1.4.1.890.1.15.3.105.1.5.1.10	IpAddress	read-only	Destination IP address for classifier rule. 0.0.0.0 means any destination IP address.
INT zyAclV2ClassifierIpDestinationIpMaskBits	1.3.6.1.4.1.890.1.15.3.105.1.5.1.11	INTEGER	read-only	Destination IP mask bits for classifier rule.
INT zyAclV2ClassifierIpDestinationSocketRangeEnd	1.3.6.1.4.1.890.1.15.3.105.1.5.1.15	INTEGER	read-only	Destination Socket Number range end for classifier rule. This object is not necessary.
INT zyAclV2ClassifierIpDestinationSocketRangeStart	1.3.6.1.4.1.890.1.15.3.105.1.5.1.14	INTEGER	read-only	Source Socket Number range start for classifier rule, 0~65535. If not qualifying a range of socket numbers, the zyAclV2ClassifierDestinationSocketRangeEnd is no need to configure.
INT zyAclV2ClassifierIpDSCP	1.3.6.1.4.1.890.1.15.3.105.1.5.1.3	INTEGER	read-only	DSCP (DiffServ Code Point) for classifier rule. The range is 0~63 and value -1 means any DSCP.
ENA zyAclV2ClassifierIpEstablishOnly	1.3.6.1.4.1.890.1.15.3.105.1.5.1.7	EnabledStatus	read-only	Establish Only for TCP protocol type in classifier rule. This means that the switch will pick out the packets that are sent to establish TCP connections.
INT zyAclV2ClassifierIpPacketLenRangeEnd	1.3.6.1.4.1.890.1.15.3.105.1.5.1.2	INTEGER	read-only	The End value of IP packet length range, 0~65535. And it must larger then the zyAclV2ClassifierIpPacketLenRangeStart. Value -1 means any start value.
INT zyAclV2ClassifierIpPacketLenRangeStart	1.3.6.1.4.1.890.1.15.3.105.1.5.1.1	INTEGER	read-only	The Start value of IP packet length range, 0~65535. And it must smaller then the zyAclV2ClassifierIpPacketLenRangeEnd. Value -1 means any start value.
INT zyAclV2ClassifierIpPrecedence	1.3.6.1.4.1.890.1.15.3.105.1.5.1.4	INTEGER	read-only	Precedence for calssifier rule, 0~7. Value -1 means any Precedence.
INT zyAclV2ClassifierIpProtocol	1.3.6.1.4.1.890.1.15.3.105.1.5.1.6	INTEGER	read-only	IP Protocol for classifier rule. Value 255 means any IP protocol.
IP zyAclV2ClassifierIpSourceIpAddress	1.3.6.1.4.1.890.1.15.3.105.1.5.1.8	IpAddress	read-only	Source IP address for classifier rule. 0.0.0.0 means any source IP address.
INT zyAclV2ClassifierIpSourceIpMaskBits	1.3.6.1.4.1.890.1.15.3.105.1.5.1.9	INTEGER	read-only	Source IP mask bits for classifier rule.
INT zyAclV2ClassifierIpSourceSocketRangeEnd	1.3.6.1.4.1.890.1.15.3.105.1.5.1.13	INTEGER	read-only	Destination Socket Number range end for classifier rule. This object is not necessary.
INT zyAclV2ClassifierIpSourceSocketRangeStart	1.3.6.1.4.1.890.1.15.3.105.1.5.1.12	INTEGER	read-only	Source Socket Number range start for classifier rule, 0~65535. If not qualifying a range of socket numbers, the zyAclV2ClassifierSourceSocketRangeEnd is no need to configure.
INT zyAclV2ClassifierIpToS	1.3.6.1.4.1.890.1.15.3.105.1.5.1.5	INTEGER	read-only	ToS for calssifier rule, 0~127. Value -1 means any ToS.
IP zyAclV2ClassifierIPv6DestinationIpAddress	1.3.6.1.4.1.890.1.15.3.105.1.6.1.6	InetAddress	read-only	IPv6 destination address for classifier rule. :: means any IPv6 destination ip address.
INT zyAclV2ClassifierIPv6DestinationIpPrefixLength	1.3.6.1.4.1.890.1.15.3.105.1.6.1.7	INTEGER	read-only	IPv6 destination address prefix length for classifier rule.
INT zyAclV2ClassifierIPv6DSCP	1.3.6.1.4.1.890.1.15.3.105.1.6.1.1	INTEGER	read-only	DSCP (DiffServ Code Point) for classifier rule. The range is 0~63 and value -1 means any DSCP.
ENA zyAclV2ClassifierIPv6EstablishOnly	1.3.6.1.4.1.890.1.15.3.105.1.6.1.3	EnabledStatus	read-only	Establish Only for TCP protocol type in classifier rule. This means that the switch will pick out the packets that are sent to establish TCP connections.
INT zyAclV2ClassifierIPv6NextHeader	1.3.6.1.4.1.890.1.15.3.105.1.6.1.2	INTEGER	read-only	IPv6 next header protocol type for classifier rule. Value 255 means any protocol type.
IP zyAclV2ClassifierIPv6SourceIpAddress	1.3.6.1.4.1.890.1.15.3.105.1.6.1.4	InetAddress	read-only	IPv6 source address for classifier rule. :: means any IPv6 source ip address.
INT zyAclV2ClassifierIPv6SourceIpPrefixLength	1.3.6.1.4.1.890.1.15.3.105.1.6.1.5	INTEGER	read-only	IPv6 source address prefix length for classifier rule.
NTF zyAclV2ClassifierLogNotification	1.3.6.1.4.1.890.1.15.3.105.4.1			classifier log information.
ENA zyAclV2ClassifierLogState	1.3.6.1.4.1.890.1.15.3.105.1.1.1.5	EnabledStatus	read-only	Enable/disable log on this classifier rule. To Enable recording the matched packet number of this rule in a configurable time interval.
C64 zyAclV2ClassifierMatchCountEx	1.3.6.1.4.1.890.1.15.3.105.1.1.1.7	Counter64	read-only	Match-Count of this classifier rule. It will show the matched packet count of this rule if zyAclV2ClassifierCount is enabled.
STR zyAclV2ClassifierName	1.3.6.1.4.1.890.1.15.3.105.1.1.1.1	DisplayString	not-accessible	The name of classifier rule is used for identifying purposes.
ENA zyAclV2ClassifierState	1.3.6.1.4.1.890.1.15.3.105.1.1.1.2	EnabledStatus	read-only	Enable/Disable classifier rule on this switch.
STR zyAclV2ClassifierTimeRange	1.3.6.1.4.1.890.1.15.3.105.1.1.1.6	DisplayString	read-only	Time Range Name for classifier rule. Bind a time range profile with this rule to active this rule in specific time.
OCT zyAclV2ClassifierVlanMap1k	1.3.6.1.4.1.890.1.15.3.105.1.3.1.1	OCTET STRING	read-only	VLAN ID List for classifer rule. range : 1~4094.
OCT zyAclV2ClassifierVlanMap2k	1.3.6.1.4.1.890.1.15.3.105.1.3.1.2	OCTET STRING	read-only	VLAN ID List for classifer rule. range : 1~4094.
OCT zyAclV2ClassifierVlanMap3k	1.3.6.1.4.1.890.1.15.3.105.1.3.1.3	OCTET STRING	read-only	VLAN ID List for classifer rule. range : 1~4094.
OCT zyAclV2ClassifierVlanMap4k	1.3.6.1.4.1.890.1.15.3.105.1.3.1.4	OCTET STRING	read-only	VLAN ID List for classifer rule. range : 1~4094.
INT zyAclV2ClassifierWeight	1.3.6.1.4.1.890.1.15.3.105.1.1.1.3	INTEGER	read-only	Weght value for classifier rule, 0~65535. Default 32767. When the match order is manual, the higher weight the higher priorit When the match order is auto, the priority depends on the depth of qualifier.
INT zyAclV2Policy8021pPriority	1.3.6.1.4.1.890.1.15.3.105.2.1.1.6	INTEGER	read-only	Specify a 802.1p priority level for policy rule. The value of 802.1p is between 0 and 7.
INT zyAclV2PolicyBandwidth	1.3.6.1.4.1.890.1.15.3.105.2.1.1.9	INTEGER	read-only	Specify the bandwidth for policy rule in kilobit per second (Kbps).
STR zyAclV2PolicyClassifier	1.3.6.1.4.1.890.1.15.3.105.2.1.1.3	DisplayString	read-only	The classifier(s) applies in this policy rule.
INT zyAclV2PolicyDiffServAction	1.3.6.1.4.1.890.1.15.3.105.2.1.1.13	INTEGER	read-only	There are four DiffServ actions for policy rule. 'No change' is keeping the TOS and/or DSCP fields in the packets. 'Set the packet's TOS field' is set the TOS field with the value you configure in the TOS field. 'Replace the IP TOS with the 802.1 priority value' is replace the TOS field with the value you configure in the Priority field. 'Set the Diffserv Codepoint field in the frame' to set the DSCP field with the value you configure in the DSCP field.
INT zyAclV2PolicyDSCP	1.3.6.1.4.1.890.1.15.3.105.2.1.1.7	INTEGER	read-only	Specify a DSCP (DiffServ Code Point) for policy rule. DSCP number is between 0 and 63.
INT zyAclV2PolicyEgressPort	1.3.6.1.4.1.890.1.15.3.105.2.1.1.5	INTEGER	read-only	The outgoing port number in this policy rule.
INT zyAclV2PolicyForwardingAction	1.3.6.1.4.1.890.1.15.3.105.2.1.1.11	INTEGER	read-only	There are three forwarding actions for policy rule. 'No change' is forward the packets. 'Discard the packet' is drop the packets. 'Do not drop the matching frame previously marked for dropping' is retain the frames that were marked to be dropped before.
INT zyAclV2PolicyMeteringState	1.3.6.1.4.1.890.1.15.3.105.2.1.1.15	INTEGER	read-only	Enable/Disable bandwidth limitation on the traffic flow(s) then set the actions to be taken on out-of-profile packets.
STR zyAclV2PolicyName	1.3.6.1.4.1.890.1.15.3.105.2.1.1.1	DisplayString	not-accessible	The name of policy rule is used for identifying purposes.
BIT zyAclV2PolicyOutgoingAction	1.3.6.1.4.1.890.1.15.3.105.2.1.1.14	Bits	read-only	There are four outgoing actions for policy rule. 'Send the packet to the mirror port' is sent the packet to the mirror port. 'Send the packet to the egress port' is sent the packet to the egress port. 'Send the matching frames to the egress port' is sent the matching policy rule frames to the egress port. 'Set the packets VLAN ID' is set packet with tag.
BIT zyAclV2PolicyOutOfProfileAction	1.3.6.1.4.1.890.1.15.3.105.2.1.1.16	Bits	read-only	There are four out of profile actions for policy rule. 'Drop the packet' is discard the out-of-profile traffic. 'Change the DSCP value' is replace the DSCP field with the value specified in the Out of profile DSCP field. 'Set Out-Drop Precedence' is mark out-of-profile traffic and drop it when network is congested. 'Do not drop the matching frame previously marked for dropping' to queue the frames that are marked to be dropped.
INT zyAclV2PolicyOutOfProfileDSCP	1.3.6.1.4.1.890.1.15.3.105.2.1.1.10	INTEGER	read-only	Specify a new DSCP number (between 0 and 63) for policy rule if you want to replace or remark the DSCP number for out-of-profile traffic.
INT zyAclV2PolicyPriorityAction	1.3.6.1.4.1.890.1.15.3.105.2.1.1.12	INTEGER	read-only	There are four priority actions for policy rule. 'No change' is keep the priority setting of the frames. 'Set the packet's 802.1 priority' is replace the packet's 802.1 priority field with the value you set in the Priority field. 'Send the packet to priority queue' is put the packets in the designated queue. 'Replace the 802.1 priority field with the IP TOS value' to replace the packet's 802.1 priority field with the value you set in the TOS field. 'Replace the 802.1p priority by inner 802.1p priority' to replace 802.1p priority by inner 802.1p priority if there is an inner vlan tag.
INT zyAclV2PolicyQueueAction	1.3.6.1.4.1.890.1.15.3.105.2.1.1.18	INTEGER	read-only	There are two queue actions for policy rule. 'No change' is keep the priority setting of the frames. 'Send the packet to priority queue' is put the packets in the designated queue.
ROW zyAclV2PolicyRowstatus	1.3.6.1.4.1.890.1.15.3.105.2.1.1.17	RowStatus	read-only	This object shows the entry of policy rule status.
ENA zyAclV2PolicyState	1.3.6.1.4.1.890.1.15.3.105.2.1.1.2	EnabledStatus	read-only	Enable/Disable policy rule on this switch.
INT zyAclV2PolicyTOS	1.3.6.1.4.1.890.1.15.3.105.2.1.1.8	INTEGER	read-only	Specify the type of service (TOS) priority level for policy rule. The value of TOS is between 0 and 7.
INT zyAclV2PolicyVid	1.3.6.1.4.1.890.1.15.3.105.2.1.1.4	INTEGER	read-only	VLAN ID for policy rule.
INT zyAclV2TrapClassifierLogMatchCount	1.3.6.1.4.1.890.1.15.3.105.3.1	INTEGER	not-accessible	display log match count of specific classifier rule.
zyxelAclV2	1.3.6.1.4.1.890.1.15.3.105			The subtree for access control list (ACL) version 2
zyxelAclV2ClassifierEntry	1.3.6.1.4.1.890.1.15.3.105.1.1.1		not-accessible	An entry contains classifier general configuration and information.
zyxelAclV2ClassifierEthernetEntry	1.3.6.1.4.1.890.1.15.3.105.1.2.1		not-accessible	An entry contains classifier ethernet configuration.
zyxelAclV2ClassifierEthernetTable	1.3.6.1.4.1.890.1.15.3.105.1.2		not-accessible	The table contains classifier ethernet configuration.
zyxelAclV2ClassifierInnerVlanEntry	1.3.6.1.4.1.890.1.15.3.105.1.4.1		not-accessible	An entry contains classifier inner VLAN configuration.
zyxelAclV2ClassifierInnerVlanTable	1.3.6.1.4.1.890.1.15.3.105.1.4		not-accessible	An entry contains classifier inner VLAN configuration.
zyxelAclV2ClassifierIpEntry	1.3.6.1.4.1.890.1.15.3.105.1.5.1		not-accessible	An entry contains classifier IP configuration.
zyxelAclV2ClassifierIpTable	1.3.6.1.4.1.890.1.15.3.105.1.5		not-accessible	The table contains classifier IP configuration.
zyxelAclV2ClassifierIpv6Entry	1.3.6.1.4.1.890.1.15.3.105.1.6.1		not-accessible	An entry contains classifier IPv6 configuration.
zyxelAclV2ClassifierIpv6Table	1.3.6.1.4.1.890.1.15.3.105.1.6		not-accessible	The table contains classifier IPv6 configuration.
INT zyxelAclV2ClassifierLoggingInterval	1.3.6.1.4.1.890.1.15.3.105.1.9	INTEGER	read-only	Logging Interval for classifier, 0~65535.
ENA zyxelAclV2ClassifierLoggingState	1.3.6.1.4.1.890.1.15.3.105.1.8	EnabledStatus	read-only	Enable/disable Logging for classifier.
INT zyxelAclV2ClassifierMatchOrder	1.3.6.1.4.1.890.1.15.3.105.1.7	INTEGER	read-only	Manual or Auto to determine the rule ordering. When the match order is manual, the higher weight the higher priority. When the match order is auto, the priority is depended on the depth of the qualifier.
zyxelAclV2ClassifierStatus	1.3.6.1.4.1.890.1.15.3.105.1
zyxelAclV2ClassifierTable	1.3.6.1.4.1.890.1.15.3.105.1.1		not-accessible	The table contains classifier general configuration and information.
zyxelAclV2ClassifierVlanEntry	1.3.6.1.4.1.890.1.15.3.105.1.3.1		not-accessible	An entry contains classifier VLAN configuration.
zyxelAclV2ClassifierVlanTable	1.3.6.1.4.1.890.1.15.3.105.1.3		not-accessible	An entry contains classifier VLAN configuration.
zyxelAclV2Notifications	1.3.6.1.4.1.890.1.15.3.105.4
zyxelAclV2PolicyEntry	1.3.6.1.4.1.890.1.15.3.105.2.1.1		not-accessible	An entry contains policy configuration.
zyxelAclV2PolicyStatus	1.3.6.1.4.1.890.1.15.3.105.2
zyxelAclV2PolicyTable	1.3.6.1.4.1.890.1.15.3.105.2.1		not-accessible	The table contains policy configuration.
zyxelAclV2TrapInfoObjects	1.3.6.1.4.1.890.1.15.3.105.3

RFC description

Vendor-private MIB for Zyxel networking devices; defines version 2 ACL (access control list) management objects.

Start monitoring ZyXEL managed switches (extended ACL rule/binding config status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download ZYXEL-AclV2-MIB