272 lines
9.6 KiB
Plaintext
272 lines
9.6 KiB
Plaintext
-- ==================================================================
|
|
-- Copyright (C) 2004 by HUAWEI 3COM TECHNOLOGIES. All rights reserved.
|
|
--
|
|
-- Description: HUAWEI-3COM Lan Switch DHCP Snooping MIB
|
|
-- Reference:
|
|
-- Version: V1.2
|
|
-- History:
|
|
-- V1.0 The initial version, created by FuJiajia, 2004.12.29
|
|
-- V1.1 2006-03-08 updated by HeHangjun
|
|
-- Added h3cDhcpSnoopVlanTable
|
|
-- V1.2 2007-06-18 updated by qizhenglin
|
|
-- Added h3cDhcpSnoopSpoofServerDetected
|
|
-- h3cDhcpSnoopSpoofServerMac
|
|
-- h3cDhcpSnoopSpoofServerIP
|
|
-- ==================================================================
|
|
-- ==================================================================
|
|
--
|
|
-- Varibles and types be imported
|
|
--
|
|
-- ==================================================================
|
|
A3COM-HUAWEI-DHCPSNOOP-MIB DEFINITIONS ::= BEGIN
|
|
|
|
IMPORTS
|
|
|
|
RowStatus, MacAddress
|
|
FROM SNMPv2-TC
|
|
|
|
MODULE-IDENTITY,OBJECT-TYPE,IpAddress,Integer32
|
|
FROM SNMPv2-SMI
|
|
|
|
ifIndex
|
|
FROM RFC1213-MIB
|
|
|
|
hwdot1qVlanIndex
|
|
FROM A3COM-HUAWEI-LswVLAN-MIB
|
|
|
|
InetAddressType, InetAddress
|
|
FROM INET-ADDRESS-MIB
|
|
|
|
h3cCommon
|
|
FROM A3COM-HUAWEI-OID-MIB
|
|
|
|
TruthValue
|
|
FROM SNMPv2-TC;
|
|
|
|
-- ==================================================================
|
|
--
|
|
-- ======================= definition begin =========================
|
|
--
|
|
-- ==================================================================
|
|
h3cDhcpSnoop MODULE-IDENTITY
|
|
LAST-UPDATED "200501140000Z"
|
|
ORGANIZATION "Huawei-3com Technologies Co.,Ltd."
|
|
CONTACT-INFO
|
|
"Platform Team Beijing Institute Huawei-3com Tech, Inc.
|
|
Http:\\www.huawei-3com.com
|
|
E-mail:support@huawei-3com.com"
|
|
DESCRIPTION
|
|
"The private mib file includes the DHCP Snooping profile."
|
|
::= { h3cCommon 36 }
|
|
|
|
h3cDhcpSnoopMibObject OBJECT IDENTIFIER ::= { h3cDhcpSnoop 1 }
|
|
|
|
h3cDhcpSnoopEnable OBJECT-TYPE
|
|
SYNTAX INTEGER
|
|
{
|
|
enable(1),
|
|
disable(2)
|
|
}
|
|
MAX-ACCESS read-write
|
|
STATUS current
|
|
DESCRIPTION "DHCP Snooping status (enable or disable)."
|
|
DEFVAL { disable }
|
|
::= { h3cDhcpSnoopMibObject 1 }
|
|
|
|
h3cDhcpSnoopTable OBJECT-TYPE
|
|
SYNTAX SEQUENCE OF H3cDhcpSnoopEntry
|
|
MAX-ACCESS not-accessible
|
|
STATUS current
|
|
DESCRIPTION "The table containing information of DHCP clients listened by
|
|
DHCP snooping and it's enabled or disabled by setting
|
|
h3cDhcpSnoopEnable node."
|
|
::= { h3cDhcpSnoopMibObject 2 }
|
|
|
|
|
|
h3cDhcpSnoopEntry OBJECT-TYPE
|
|
SYNTAX H3cDhcpSnoopEntry
|
|
MAX-ACCESS not-accessible
|
|
STATUS current
|
|
DESCRIPTION "An entry containing information of DHCP clients."
|
|
INDEX { h3cDhcpSnoopClientIpAddressType, h3cDhcpSnoopClientIpAddress }
|
|
::= { h3cDhcpSnoopTable 1}
|
|
|
|
H3cDhcpSnoopEntry ::=
|
|
SEQUENCE {
|
|
h3cDhcpSnoopClientIpAddressType InetAddressType,
|
|
h3cDhcpSnoopClientIpAddress InetAddress,
|
|
h3cDhcpSnoopClientMacAddress MacAddress,
|
|
h3cDhcpSnoopClientProperty INTEGER ,
|
|
h3cDhcpSnoopClientUnitNum INTEGER
|
|
}
|
|
|
|
h3cDhcpSnoopClientIpAddressType OBJECT-TYPE
|
|
SYNTAX InetAddressType
|
|
MAX-ACCESS not-accessible
|
|
STATUS current
|
|
DESCRIPTION "DHCP clients' IP addresses type (IPv4 or IPv6)."
|
|
DEFVAL { ipv4 }
|
|
::= { h3cDhcpSnoopEntry 1 }
|
|
|
|
h3cDhcpSnoopClientIpAddress OBJECT-TYPE
|
|
SYNTAX InetAddress
|
|
MAX-ACCESS not-accessible
|
|
STATUS current
|
|
DESCRIPTION "DHCP clients' IP addresses collected by DHCP snooping."
|
|
::= { h3cDhcpSnoopEntry 2 }
|
|
|
|
h3cDhcpSnoopClientMacAddress OBJECT-TYPE
|
|
SYNTAX MacAddress
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION "DHCP clients' MAC addresses collected by DHCP snooping."
|
|
::= { h3cDhcpSnoopEntry 3 }
|
|
|
|
h3cDhcpSnoopClientProperty OBJECT-TYPE
|
|
SYNTAX INTEGER
|
|
{
|
|
static(1),
|
|
dynamic(2)
|
|
}
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION "Method of getting IP addresses collected by DHCP snooping."
|
|
::= { h3cDhcpSnoopEntry 4 }
|
|
|
|
h3cDhcpSnoopClientUnitNum OBJECT-TYPE
|
|
SYNTAX INTEGER
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION "IRF (Intelligent Resilient Fabric) unit number via whom the clients
|
|
get their IP addresses. The value 0 means this device does not support IRF."
|
|
::= { h3cDhcpSnoopEntry 5 }
|
|
|
|
h3cDhcpSnoopTrustTable OBJECT-TYPE
|
|
SYNTAX SEQUENCE OF H3cDhcpSnoopTrustEntry
|
|
MAX-ACCESS not-accessible
|
|
STATUS current
|
|
DESCRIPTION "A table is used to configure and monitor port trusted status."
|
|
::= { h3cDhcpSnoopMibObject 3 }
|
|
|
|
h3cDhcpSnoopTrustEntry OBJECT-TYPE
|
|
SYNTAX H3cDhcpSnoopTrustEntry
|
|
MAX-ACCESS not-accessible
|
|
STATUS current
|
|
DESCRIPTION "An entry containing information about trusted status of ports."
|
|
INDEX { ifIndex }
|
|
::= { h3cDhcpSnoopTrustTable 1}
|
|
|
|
H3cDhcpSnoopTrustEntry ::=
|
|
SEQUENCE {
|
|
h3cDhcpSnoopTrustStatus INTEGER
|
|
}
|
|
|
|
h3cDhcpSnoopTrustStatus OBJECT-TYPE
|
|
SYNTAX INTEGER
|
|
{
|
|
untrusted(0),
|
|
trusted(1)
|
|
}
|
|
MAX-ACCESS read-write
|
|
STATUS current
|
|
DESCRIPTION "Trusted status of current port which supports both get and
|
|
set operation."
|
|
DEFVAL { untrusted }
|
|
::= { h3cDhcpSnoopTrustEntry 1 }
|
|
|
|
h3cDhcpSnoopVlanTable OBJECT-TYPE
|
|
SYNTAX SEQUENCE OF H3cDhcpSnoopVlanEntry
|
|
MAX-ACCESS not-accessible
|
|
STATUS current
|
|
DESCRIPTION "A table is used to configure and monitor DHCP Snooping
|
|
status of VLANs."
|
|
::= { h3cDhcpSnoopMibObject 4 }
|
|
|
|
h3cDhcpSnoopVlanEntry OBJECT-TYPE
|
|
SYNTAX H3cDhcpSnoopVlanEntry
|
|
MAX-ACCESS not-accessible
|
|
STATUS current
|
|
DESCRIPTION "The entry information about h3cDhcpSnoopVlanTable."
|
|
INDEX
|
|
{
|
|
h3cDhcpSnoopVlanIndex
|
|
}
|
|
::= { h3cDhcpSnoopVlanTable 1 }
|
|
|
|
H3cDhcpSnoopVlanEntry ::=
|
|
SEQUENCE
|
|
{
|
|
h3cDhcpSnoopVlanIndex Integer32,
|
|
h3cDhcpSnoopVlanEnable TruthValue
|
|
}
|
|
|
|
h3cDhcpSnoopVlanIndex OBJECT-TYPE
|
|
SYNTAX Integer32(0..2147483647)
|
|
MAX-ACCESS not-accessible
|
|
STATUS current
|
|
DESCRIPTION "Current VLAN index."
|
|
::= { h3cDhcpSnoopVlanEntry 1 }
|
|
|
|
h3cDhcpSnoopVlanEnable OBJECT-TYPE
|
|
SYNTAX TruthValue
|
|
MAX-ACCESS read-write
|
|
STATUS current
|
|
DESCRIPTION "DHCP Snooping status of current VLAN."
|
|
DEFVAL { false }
|
|
::= { h3cDhcpSnoopVlanEntry 2 }
|
|
|
|
-- ==================================================================
|
|
--
|
|
-- ======================= trap definition begin ====================
|
|
--
|
|
-- ==================================================================
|
|
h3cDhcpSnoopTraps OBJECT IDENTIFIER ::= { h3cDhcpSnoop 2 }
|
|
h3cDhcpSnoopTrapsPrefix OBJECT IDENTIFIER ::= { h3cDhcpSnoopTraps 0 }
|
|
h3cDhcpSnoopTrapsObject OBJECT IDENTIFIER ::= { h3cDhcpSnoopTraps 1 }
|
|
|
|
h3cDhcpSnoopSpoofServerMac OBJECT-TYPE
|
|
SYNTAX MacAddress
|
|
MAX-ACCESS accessible-for-notify
|
|
STATUS current
|
|
DESCRIPTION "MAC address of the spoofing server and it is derived from
|
|
link-layer header of offer packet. If the offer packet is relayed
|
|
by dhcp relay entity, it may be the MAC address of relay entity.
|
|
"
|
|
::= { h3cDhcpSnoopTrapsObject 1 }
|
|
|
|
h3cDhcpSnoopSpoofServerIP OBJECT-TYPE
|
|
SYNTAX IpAddress
|
|
MAX-ACCESS accessible-for-notify
|
|
STATUS current
|
|
DESCRIPTION "IP address of the spoofing server and it is derived from
|
|
IP header of offer packet. A tricksy host may send offer packet use
|
|
other host's address, so this address can not always be trust.
|
|
"
|
|
::= { h3cDhcpSnoopTrapsObject 2 }
|
|
|
|
h3cDhcpSnoopSpoofServerDetected NOTIFICATION-TYPE
|
|
OBJECTS
|
|
{
|
|
ifIndex, -- The interface from which an
|
|
-- illegal dhcp server accessed
|
|
hwdot1qVlanIndex, -- The vlan from which an illegal
|
|
-- dhcp server accessed
|
|
h3cDhcpSnoopSpoofServerMac,
|
|
h3cDhcpSnoopSpoofServerIP
|
|
}
|
|
STATUS current
|
|
DESCRIPTION
|
|
"To detect unauthorized DHCP servers on a network, the DHCP snooping
|
|
device sends DHCP-DISCOVER messages through its downstream port
|
|
(which is connected to the DHCP clients).
|
|
If any response (DHCP-OFFER message) is received from the downstream port,
|
|
an unauthorized DHCP server is considered present, and then the device
|
|
sends a trap.
|
|
With unauthorized DHCP server detection enabled, the interface sends a
|
|
DHCP-DISCOVER message to detect unauthorized DHCP servers on the network.
|
|
If this interface receives a DHCP-OFFER message, the DHCP server which
|
|
sent it is considered unauthorized. "
|
|
::= { h3cDhcpSnoopTrapsPrefix 1 }
|
|
|
|
END
|