402 lines
14 KiB
Plaintext
402 lines
14 KiB
Plaintext
-- File Name : ZTE-DSL-DEV-SECURITY-ACL-MIB.mib
|
|
-- Date : 2006-07-25
|
|
-- Author : Wan Guanghua
|
|
|
|
|
|
ZTE-DSL-DEV-SECURITY-ACL-MIB DEFINITIONS ::= BEGIN
|
|
IMPORTS
|
|
zxDsl
|
|
FROM ZTE-DSL-MIB
|
|
MODULE-IDENTITY, OBJECT-TYPE, IpAddress, NOTIFICATION-TYPE, Integer32
|
|
FROM SNMPv2-SMI
|
|
InetAddress,InetAddressPrefixLength,InetAddressType
|
|
FROM INET-ADDRESS-MIB
|
|
RowStatus, MacAddress
|
|
FROM SNMPv2-TC;
|
|
|
|
zxDslDevSecurityAclMib MODULE-IDENTITY
|
|
LAST-UPDATED "200607250000Z"
|
|
ORGANIZATION "ZTE Corporation"
|
|
CONTACT-INFO "Wan Guanghua
|
|
Tel: 021-68896253
|
|
email: wan.guanghua@zte.com.cn"
|
|
|
|
DESCRIPTION
|
|
"This MIB defines the managed objects of ZTE DSLAM
|
|
security access control policy.
|
|
And it is used to configure what kind of packets can
|
|
access the DSLAM."
|
|
::= { zxDsl 24 }
|
|
|
|
zxDslDevSecurityAclObjects OBJECT IDENTIFIER
|
|
::= { zxDslDevSecurityAclMib 1 }
|
|
|
|
zxDslDevSecurityAclEnable OBJECT-TYPE
|
|
SYNTAX INTEGER { enable (1), disable (2) }
|
|
MAX-ACCESS read-write
|
|
STATUS current
|
|
DESCRIPTION
|
|
"Enable or disable the ACL rules for the DSLAM.
|
|
the default value is disable,
|
|
which means all packets are permit to access the DSLAM."
|
|
DEFVAL { disable }
|
|
::= { zxDslDevSecurityAclObjects 1 }
|
|
|
|
zxDslDevSecurityAclTable OBJECT-TYPE
|
|
SYNTAX SEQUENCE OF ZxDslDevSecurityAclEntry
|
|
MAX-ACCESS not-accessible
|
|
STATUS current
|
|
DESCRIPTION
|
|
"This table is used to define what kind of packets should be
|
|
permitted or denied.
|
|
It can help us to prevent our devices from some vicious attackes,
|
|
such as virus. By default, when the packet isn't coincident with any
|
|
rules, it's permitted.
|
|
We can define all other packets to be permitted or denied by
|
|
setting source IP and source mask to 0.0.0.0."
|
|
::= { zxDslDevSecurityAclObjects 2 }
|
|
|
|
zxDslDevSecurityAclEntry OBJECT-TYPE
|
|
SYNTAX ZxDslDevSecurityAclEntry
|
|
MAX-ACCESS not-accessible
|
|
STATUS current
|
|
DESCRIPTION
|
|
"An entry in zxDslDevSecurityAclTable."
|
|
INDEX { zxDslDevSecAclIndex }
|
|
::= { zxDslDevSecurityAclTable 1 }
|
|
|
|
ZxDslDevSecurityAclEntry ::= SEQUENCE {
|
|
zxDslDevSecAclIndex INTEGER,
|
|
zxDslDevSecAclSrcIp IpAddress,
|
|
zxDslDevSecAclSrcMask IpAddress,
|
|
zxDslDevSecAclProtocolType INTEGER,
|
|
zxDslDevSecAclSrcPortStart INTEGER,
|
|
zxDslDevSecAclSrcPortEnd INTEGER,
|
|
zxDslDevSecAclDestPortStart INTEGER,
|
|
zxDslDevSecAclDestPortEnd INTEGER,
|
|
zxDslDevSecAclAccessLevel INTEGER,
|
|
zxDslDevSecAclRuleMatchTimes Integer32,
|
|
zxDslDevSecAclRowStatus RowStatus,
|
|
ZxDslDevSecAclSrcMac MacAddress,
|
|
ZxDslDevSecAclDestMac MacAddress,
|
|
zxDslDevSecAclSrcIpType InetAddressType,
|
|
zxDslDevSecAclSrcIpv6Ip InetAddress,
|
|
zxDslDevSecAclSrcIpv6IpPfxLen InetAddressPrefixLength,
|
|
zxDslDevSecAclDestIpType InetAddressType,
|
|
zxDslDevSecAclDestIp InetAddress,
|
|
zxDslDevSecAclDestIpMask IpAddress,
|
|
zxDslDevSecAclDestIpv6PfxLen InetAddressPrefixLength,
|
|
zxDslDevSecAclEtherType INTEGER,
|
|
zxDslDevSecAclVlan INTEGER,
|
|
zxDslDevSecAclPktRateLimit INTEGER
|
|
}
|
|
|
|
zxDslDevSecAclIndex OBJECT-TYPE
|
|
SYNTAX INTEGER ( 1 .. 16 )
|
|
MAX-ACCESS not-accessible
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The index in the ACL rule table, which is the ACL rule number."
|
|
::= { zxDslDevSecurityAclEntry 1 }
|
|
|
|
zxDslDevSecAclSrcIp OBJECT-TYPE
|
|
SYNTAX IpAddress
|
|
MAX-ACCESS read-create
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The source Ipv4 IP of the ACL rule.
|
|
0.0.0.0 means not configured."
|
|
::= { zxDslDevSecurityAclEntry 2 }
|
|
|
|
zxDslDevSecAclSrcMask OBJECT-TYPE
|
|
SYNTAX IpAddress
|
|
MAX-ACCESS read-create
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The source IPv4 mask of the ACL rule.
|
|
0.0.0.0 means not configured."
|
|
::= { zxDslDevSecurityAclEntry 3 }
|
|
|
|
zxDslDevSecAclProtocolType OBJECT-TYPE
|
|
SYNTAX INTEGER
|
|
{
|
|
all(0),
|
|
icmp(1),
|
|
tcp(2),
|
|
udp(3)
|
|
}
|
|
MAX-ACCESS read-create
|
|
STATUS current
|
|
DESCRIPTION
|
|
"Protocol type of the packets.
|
|
The default value is ALL (0), which means all protocol types.
|
|
"
|
|
DEFVAL { all }
|
|
::= { zxDslDevSecurityAclEntry 4 }
|
|
|
|
zxDslDevSecAclSrcPortStart OBJECT-TYPE
|
|
SYNTAX INTEGER ( 0 .. 65535 )
|
|
MAX-ACCESS read-create
|
|
STATUS current
|
|
DESCRIPTION
|
|
"Beginning source port of the packets.
|
|
The default value is 0, which means all source ports.
|
|
"
|
|
DEFVAL { 0 }
|
|
::= { zxDslDevSecurityAclEntry 5 }
|
|
|
|
zxDslDevSecAclSrcPortEnd OBJECT-TYPE
|
|
SYNTAX INTEGER ( 0 .. 65535 )
|
|
MAX-ACCESS read-create
|
|
STATUS current
|
|
DESCRIPTION
|
|
"Ending source port of the packets.
|
|
The default value is 0, which means all source ports.
|
|
"
|
|
DEFVAL { 0 }
|
|
::= { zxDslDevSecurityAclEntry 6 }
|
|
|
|
zxDslDevSecAclDestPortStart OBJECT-TYPE
|
|
SYNTAX INTEGER ( 0 .. 65535 )
|
|
MAX-ACCESS read-create
|
|
STATUS current
|
|
DESCRIPTION
|
|
"Beginning destination port of the packets.
|
|
The default value is 0, which means all destination ports.
|
|
"
|
|
DEFVAL { 0 }
|
|
::= { zxDslDevSecurityAclEntry 7 }
|
|
|
|
zxDslDevSecAclDestPortEnd OBJECT-TYPE
|
|
SYNTAX INTEGER ( 0 .. 65535 )
|
|
MAX-ACCESS read-create
|
|
STATUS current
|
|
DESCRIPTION
|
|
"Ending destination port of the packets.
|
|
The default value is 0, which means all destination ports.
|
|
"
|
|
DEFVAL { 0 }
|
|
::= { zxDslDevSecurityAclEntry 8 }
|
|
|
|
zxDslDevSecAclAccessLevel OBJECT-TYPE
|
|
SYNTAX INTEGER { permit (1), deny (2) }
|
|
MAX-ACCESS read-create
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The level of access to DSLAM,
|
|
which means permit or deny this kind of packets.
|
|
"
|
|
::= { zxDslDevSecurityAclEntry 9 }
|
|
|
|
zxDslDevSecAclRuleMatchTimes OBJECT-TYPE
|
|
SYNTAX Integer32
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The number of times that packets match this rule."
|
|
::= { zxDslDevSecurityAclEntry 10 }
|
|
|
|
zxDslDevSecAclRowStatus OBJECT-TYPE
|
|
SYNTAX RowStatus
|
|
MAX-ACCESS read-create
|
|
STATUS current
|
|
DESCRIPTION
|
|
"This object is used to create a new row
|
|
or delete an existing row in this table.
|
|
Set it 4 to add, and 6 to delete the ACL rule.
|
|
"
|
|
::= { zxDslDevSecurityAclEntry 11 }
|
|
|
|
zxDslDevSecAclSrcMac OBJECT-TYPE
|
|
SYNTAX MacAddress
|
|
MAX-ACCESS read-create
|
|
STATUS current
|
|
DESCRIPTION
|
|
"Source MAC of the packets."
|
|
::= { zxDslDevSecurityAclEntry 12 }
|
|
|
|
zxDslDevSecAclDestMac OBJECT-TYPE
|
|
SYNTAX MacAddress
|
|
MAX-ACCESS read-create
|
|
STATUS current
|
|
DESCRIPTION
|
|
"Destination MAC of the packets."
|
|
::= { zxDslDevSecurityAclEntry 13 }
|
|
|
|
zxDslDevSecAclSrcIpType OBJECT-TYPE
|
|
SYNTAX InetAddressType
|
|
MAX-ACCESS read-create
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The type of Source IP address.
|
|
The value is unknown(0) means that source IP address is not
|
|
configured (include IPv4 and IPv6)."
|
|
DEFVAL{ ipv4 }
|
|
::= { zxDslDevSecurityAclEntry 14 }
|
|
|
|
zxDslDevSecAclSrcIpv6Ip OBJECT-TYPE
|
|
SYNTAX InetAddress
|
|
MAX-ACCESS read-create
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The source IPv6 IpAddress of the ACL rule.
|
|
Zero-length string means not configured."
|
|
::= { zxDslDevSecurityAclEntry 15 }
|
|
|
|
zxDslDevSecAclSrcIpv6IpPfxLen OBJECT-TYPE
|
|
SYNTAX InetAddressPrefixLength
|
|
MAX-ACCESS read-create
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The prefix length of the IPv6 IP address.
|
|
0 means not configured."
|
|
::= { zxDslDevSecurityAclEntry 16 }
|
|
|
|
zxDslDevSecAclDestIpType OBJECT-TYPE
|
|
SYNTAX InetAddressType
|
|
MAX-ACCESS read-create
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The type of destination IP address.
|
|
The value is unknown(0) means that destination IP address is not
|
|
configured (include IPv4 and IPv6)."
|
|
DEFVAL{ ipv4 }
|
|
::= { zxDslDevSecurityAclEntry 17 }
|
|
|
|
zxDslDevSecAclDestIp OBJECT-TYPE
|
|
SYNTAX InetAddress
|
|
MAX-ACCESS read-create
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The destination IP address of the ACL rule.
|
|
Zero-length string means not configured.
|
|
"
|
|
::= { zxDslDevSecurityAclEntry 18 }
|
|
|
|
zxDslDevSecAclDestIpMask OBJECT-TYPE
|
|
SYNTAX IpAddress
|
|
MAX-ACCESS read-create
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The destination IPv4 mask of the ACL rult.
|
|
0.0.0.0 means not configured.
|
|
"
|
|
::= { zxDslDevSecurityAclEntry 19 }
|
|
|
|
zxDslDevSecAclDestIpv6PfxLen OBJECT-TYPE
|
|
SYNTAX InetAddressPrefixLength
|
|
MAX-ACCESS read-create
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The prefix length of the destination IPv6 IP address.
|
|
0 means not configured.
|
|
"
|
|
::= { zxDslDevSecurityAclEntry 20 }
|
|
|
|
zxDslDevSecAclEtherType OBJECT-TYPE
|
|
SYNTAX INTEGER
|
|
{
|
|
any(1),
|
|
arp(2),
|
|
ipv4(3),
|
|
ipv6(4)
|
|
}
|
|
MAX-ACCESS read-create
|
|
STATUS current
|
|
DESCRIPTION
|
|
"Ethernet type of the ACL rule.
|
|
any(1) means that the acl rule filters all packets that ethernet
|
|
type is ARP, IPv4 or IPv6.
|
|
arp(2) means that the acl rule filters all packets that ethernet
|
|
type is ARP.
|
|
ipv4(3) means that the acl rule filters all packets that ethernet
|
|
type is IPv4.
|
|
ipv6(4) means that the acl rule filters all packets that ethernet
|
|
type is IPv6.
|
|
"
|
|
DEFVAL { any }
|
|
::= { zxDslDevSecurityAclEntry 21 }
|
|
|
|
zxDslDevSecAclVlan OBJECT-TYPE
|
|
SYNTAX INTEGER (0..4094)
|
|
MAX-ACCESS read-create
|
|
STATUS current
|
|
DESCRIPTION
|
|
"VLAN ID of the ACL rule.
|
|
0 means not configured.
|
|
"
|
|
DEFVAL { 0 }
|
|
::= { zxDslDevSecurityAclEntry 22 }
|
|
|
|
zxDslDevSecAclPktRateLimit OBJECT-TYPE
|
|
SYNTAX INTEGER(0..2048)
|
|
UNITS "pps"
|
|
MAX-ACCESS read-create
|
|
STATUS current
|
|
DESCRIPTION
|
|
"This object indicates the rate limit of the packet filtered by
|
|
the ACL rule.
|
|
0 means the packet rate is unlimited.
|
|
"
|
|
DEFVAL { 0 }
|
|
::= { zxDslDevSecurityAclEntry 23 }
|
|
|
|
zxDslDevSecurityAclGlobalObjects OBJECT IDENTIFIER
|
|
::= { zxDslDevSecurityAclObjects 3 }
|
|
|
|
zxDslDevSecurityAclActionScope OBJECT-TYPE
|
|
SYNTAX INTEGER {
|
|
allMgmtPacket(1),
|
|
onlyPacketToMgmtIp(2)
|
|
}
|
|
MAX-ACCESS read-write
|
|
STATUS current
|
|
DEFVAL { allMgmtPacket }
|
|
DESCRIPTION
|
|
"The effect scope of device security acl.
|
|
Possible values are:
|
|
allMgmtPacket(1) - all packet received will be filter by
|
|
ACL list.
|
|
onlyPacketToMgmtIp(2)- only packet to managment IP will be
|
|
filter by ACL list.
|
|
"
|
|
::= { zxDslDevSecurityAclGlobalObjects 1 }
|
|
|
|
zxDslAclPktRateLimitTrapEnable OBJECT-TYPE
|
|
SYNTAX INTEGER
|
|
{
|
|
enable(1),
|
|
disable(2)
|
|
}
|
|
MAX-ACCESS read-write
|
|
STATUS current
|
|
DESCRIPTION
|
|
"Enables or disables the zxDslDevAclPktOverRateLimitTrap and
|
|
zxDslDevAclPktUnderRateLimitTrap.
|
|
"
|
|
DEFVAL { disable }
|
|
::= { zxDslDevSecurityAclGlobalObjects 2 }
|
|
|
|
zxDslDevSecurityAclTrapObjects OBJECT IDENTIFIER
|
|
::= { zxDslDevSecurityAclMib 2 }
|
|
|
|
zxDslDevAclPktOverRateLimitTrap NOTIFICATION-TYPE
|
|
OBJECTS { zxDslDevSecAclPktRateLimit }
|
|
STATUS current
|
|
DESCRIPTION
|
|
"ACL packet rate is over zxDslDevSecAclPktRateLimit and the
|
|
zxDslDevAclPktOverRateLimitTrap will be sent.
|
|
"
|
|
::= { zxDslDevSecurityAclTrapObjects 1 }
|
|
|
|
zxDslDevAclPktUnderRateLimitTrap NOTIFICATION-TYPE
|
|
OBJECTS { zxDslDevSecAclPktRateLimit }
|
|
STATUS current
|
|
DESCRIPTION
|
|
"ACL packet rate is lower than zxDslDevSecAclPktRateLimit and the
|
|
zxDslDevAclPktOverRateLimitTrap will be restored.
|
|
"
|
|
::= { zxDslDevSecurityAclTrapObjects 2 }
|
|
|
|
END
|