Standard view Table view

CISCO-ACL-MIB

        This MIB module defines objects that describe Cisco Access
Control Lists (ACL).
        
This MIB describes different objects that enable the
network administrator to remotely configure ACLs, apply them
to interfaces and monitor their usage statistics.
        
A typical application of this MIB module will facilitate
monitoring of ACL match (sometimes referred as hit) counts.
However, by no means does the definition of this MIB module
prevent other applications from using it.
        
An ACL is an ordered list of statements that deny or permit
packets based on matching fields contained within the packet
header (layer 3 source and destination addresses, layer 4
protocol, layer 4 source and destination port numbers, etc.) In
addition there is an implicit *Deny All* at the end of the ACL.
ACLs are used to perform packet filtering to control
which packets are allowed through the network. Such control
can help limit network traffic, and restrict the access of
applications and devices on the network. Each one of these
statements is referred to as an Access List Control Entry
(ACE).
Here is an example of an ACL configuration.
    ipv4 access-list V4Example
     10 permit tcp any any
    !
    ipv6 access-list V6Example
     10 permit tcp any any
    !
        
The mechanism for monitoring ACL usage is by configuring, in
the desired ACEs a counter label. A counter label is a name
that is given to a counter and is defined in any ACE. ACEs
that share the same Counter label name will have their counters
aggregated into the same label.
Here is an example of how to use counter labels.
    ipv4 access-list V4CounterExample
     10 permit tcp any any counter CountPermits
     20 permit udp any any counter CountPermits
        
The same applies to IPv6 ACLs.
        
This MIB consists of following tables:
    * caAclCfgTable
        Defines the ACLs configured in the device.
    * caAclIPV4ACECfgTable
        Defines the ACEs that make up an IPV4 ACL.
    * caAclIPV6ACECfgTable
        Defines the ACEs that make up an IPV6 ACL.
    * caAclAccessGroupCfgTable
        Defines the Access Control Groups (ACG) applied to
        interfaces on the device.
    * caAclLabelIntfStatsTable
        Defines the statistics for a specific  ACE with counter
        labels attached to interfaces on the device.
Source file
CISCO-ACL-MIB
Last revised
Identity
ciscoACLMIB
Base OID
1.3.6.1.4.1.9.9.808
Imported Objects
CISCO-SMI ciscoMgmt
CISCO-TC CiscoIpProtocol
IF-MIB ifIndex
INET-ADDRESS-MIB InetAddress InetAddressType InetPortNumber
SNMP-FRAMEWORK-MIB SnmpAdminString
SNMPv2-CONF MODULE-COMPLIANCE OBJECT-GROUP
SNMPv2-SMI Counter64 Integer32 MODULE-IDENTITY OBJECT-TYPE Unsigned32
SNMPv2-TC RowStatus TEXTUAL-CONVENTION
Net-SNMP examples using the cisco MIB directory Show commands

These commands use the standard Observium installation path and load the selected MIB variant before the RFC and Net-SNMP directories.

Translate the module identity
/usr/bin/snmptranslate -Pud -Ir -On -m 'CISCO-ACL-MIB' -M '/opt/observium/mibs/cisco:/opt/observium/mibs/rfc:/opt/observium/mibs/net-snmp' 'CISCO-ACL-MIB::ciscoACLMIB'
Walk the MIB subtree
/usr/bin/snmpbulkwalk -v2c -c '<community>' -Pud -Ir -OQUs -m 'CISCO-ACL-MIB' -M '/opt/observium/mibs/cisco:/opt/observium/mibs/rfc:/opt/observium/mibs/net-snmp' 'udp:<hostname>:161' 'CISCO-ACL-MIB::ciscoACLMIB'
How SNMP, Net-SNMP, MIB paths, and variants work
Objects (82)
ciscoACLMIB
.1.3.6.1.4.1.9.9.808
caAclMIBObjects
.1.3.6.1.4.1.9.9.808.1
caAclConfiguration
.1.3.6.1.4.1.9.9.808.1.1
caAclCfgTable
.1.3.6.1.4.1.9.9.808.1.1.1
caAclCfgTableEntry
caAclIndexcaAclAddressType
 .1.3.6.1.4.1.9.9.808.1.1.1.1
caAclIndex
CaAclACLIndex
 .1.3.6.1.4.1.9.9.808.1.1.1.1.1
caAclAddressType
INET-ADDRESS-MIBInetAddressType
 .1.3.6.1.4.1.9.9.808.1.1.1.1.2
caAclName r/w
OctetString
 .1.3.6.1.4.1.9.9.808.1.1.1.1.3
caAclRowStatus r/w
SNMPv2-TCRowStatus
 .1.3.6.1.4.1.9.9.808.1.1.1.1.4
caAclIPV4ACECfgTable
.1.3.6.1.4.1.9.9.808.1.1.2
caAclIPV4ACECfgTableEntry
caAclIndexcaAclAddressTypecaAclIPV4ACESequenceNumber
 .1.3.6.1.4.1.9.9.808.1.1.2.1
caAclIPV4ACESequenceNumber
CaAclSequenceNumber
 .1.3.6.1.4.1.9.9.808.1.1.2.1.1
caAclIPV4ACESourcePortGroup r/w
OctetString
 .1.3.6.1.4.1.9.9.808.1.1.2.1.10
caAclIPV4ACEDestinationAddress r/w
INET-ADDRESS-MIBInetAddress
 .1.3.6.1.4.1.9.9.808.1.1.2.1.11
caAclIPV4ACEDestinationWildCardMask r/w
INET-ADDRESS-MIBInetAddress
 .1.3.6.1.4.1.9.9.808.1.1.2.1.12
caAclIPV4ACEDestinationNetworkGroup r/w
OctetString
 .1.3.6.1.4.1.9.9.808.1.1.2.1.13
caAclIPV4ACEDestinationPortOperator r/w
CaAclPortOperator
 .1.3.6.1.4.1.9.9.808.1.1.2.1.14
caAclIPV4ACEDestinationPort r/w
INET-ADDRESS-MIBInetPortNumber
 .1.3.6.1.4.1.9.9.808.1.1.2.1.15
caAclIPV4ACEDestinationPortUpper r/w
INET-ADDRESS-MIBInetPortNumber
 .1.3.6.1.4.1.9.9.808.1.1.2.1.16
caAclIPV4ACEDestinationPortGroup r/w
OctetString
 .1.3.6.1.4.1.9.9.808.1.1.2.1.17
caAclIPV4ACEDscpValue r/w
Unsigned32
 .1.3.6.1.4.1.9.9.808.1.1.2.1.18
caAclIPV4ACETcpFlagsValue r/w
Unsigned32
 .1.3.6.1.4.1.9.9.808.1.1.2.1.19
caAclIPV4ACEAction r/w
CaAclAction
 .1.3.6.1.4.1.9.9.808.1.1.2.1.2
caAclIPV4ACETcpFlagsMask r/w
Unsigned32
 .1.3.6.1.4.1.9.9.808.1.1.2.1.20
caAclIPV4ACETcpFlagsMatchType r/w
CaAclTcpFlagsMatch
 .1.3.6.1.4.1.9.9.808.1.1.2.1.21
caAclIPV4ACETosValue r/w
Unsigned32
 .1.3.6.1.4.1.9.9.808.1.1.2.1.22
caAclIPV4ACEPrecedenceValue r/w
CaAclPrecedenceValue
 .1.3.6.1.4.1.9.9.808.1.1.2.1.23
caAclIPV4ACELogOption r/w
CaAclLogOption
 .1.3.6.1.4.1.9.9.808.1.1.2.1.24
caAclIPV4ACECounterLabel r/w
OctetString
 .1.3.6.1.4.1.9.9.808.1.1.2.1.25
caAclIPV4ACERemark r/w
OctetString
 .1.3.6.1.4.1.9.9.808.1.1.2.1.26
caAclIPV4ACERowStatus r/w
SNMPv2-TCRowStatus
 .1.3.6.1.4.1.9.9.808.1.1.2.1.27
caAclIPV4ACEProtocol r/w
CISCO-TCCiscoIpProtocol
 .1.3.6.1.4.1.9.9.808.1.1.2.1.3
caAclIPV4ACESourceAddress r/w
INET-ADDRESS-MIBInetAddress
 .1.3.6.1.4.1.9.9.808.1.1.2.1.4
caAclIPV4ACESourceWildCardMask r/w
INET-ADDRESS-MIBInetAddress
 .1.3.6.1.4.1.9.9.808.1.1.2.1.5
caAclIPV4ACESourceNetworkGroup r/w
OctetString
 .1.3.6.1.4.1.9.9.808.1.1.2.1.6
caAclIPV4ACESourcePortOperator r/w
CaAclPortOperator
 .1.3.6.1.4.1.9.9.808.1.1.2.1.7
caAclIPV4ACESourcePort r/w
INET-ADDRESS-MIBInetPortNumber
 .1.3.6.1.4.1.9.9.808.1.1.2.1.8
caAclIPV4ACESourcePortUpper r/w
INET-ADDRESS-MIBInetPortNumber
 .1.3.6.1.4.1.9.9.808.1.1.2.1.9
caAclIPV6ACECfgTable
.1.3.6.1.4.1.9.9.808.1.1.3
caAclIPV6ACECfgTableEntry
caAclIndexcaAclAddressTypecaAclIPV6ACESequenceNumber
 .1.3.6.1.4.1.9.9.808.1.1.3.1
caAclIPV6ACESequenceNumber
CaAclSequenceNumber
 .1.3.6.1.4.1.9.9.808.1.1.3.1.1
caAclIPV6ACESourcePortGroup r/w
OctetString
 .1.3.6.1.4.1.9.9.808.1.1.3.1.10
caAclIPV6ACEDestinationAddress r/w
INET-ADDRESS-MIBInetAddress
 .1.3.6.1.4.1.9.9.808.1.1.3.1.11
caAclIPV6ACEDestinationPrefixLength r/w
Integer32
 .1.3.6.1.4.1.9.9.808.1.1.3.1.12
caAclIPV6ACEDestinationNetworkGroup r/w
OctetString
 .1.3.6.1.4.1.9.9.808.1.1.3.1.13
caAclIPV6ACEDestinationPortOperator r/w
CaAclPortOperator
 .1.3.6.1.4.1.9.9.808.1.1.3.1.14
caAclIPV6ACEDestinationPort r/w
INET-ADDRESS-MIBInetPortNumber
 .1.3.6.1.4.1.9.9.808.1.1.3.1.15
caAclIPV6ACEDestinationPortUpper r/w
INET-ADDRESS-MIBInetPortNumber
 .1.3.6.1.4.1.9.9.808.1.1.3.1.16
caAclIPV6ACEDestinationPortGroup r/w
OctetString
 .1.3.6.1.4.1.9.9.808.1.1.3.1.17
caAclIPV6ACETrafficClassValue r/w
Unsigned32
 .1.3.6.1.4.1.9.9.808.1.1.3.1.18
caAclIPV6ACETcpFlagsValue r/w
Unsigned32
 .1.3.6.1.4.1.9.9.808.1.1.3.1.19
caAclIPV6ACEAction r/w
CaAclAction
 .1.3.6.1.4.1.9.9.808.1.1.3.1.2
caAclIPV6ACETcpFlagsMask r/w
Unsigned32
 .1.3.6.1.4.1.9.9.808.1.1.3.1.20
caAclIPV6ACETcpFlagsMatchType r/w
CaAclTcpFlagsMatch
 .1.3.6.1.4.1.9.9.808.1.1.3.1.21
caAclIPV6ACELogOption r/w
CaAclLogOption
 .1.3.6.1.4.1.9.9.808.1.1.3.1.22
caAclIPV6ACECounterLabel r/w
OctetString
 .1.3.6.1.4.1.9.9.808.1.1.3.1.23
caAclIPV6ACERemark r/w
OctetString
 .1.3.6.1.4.1.9.9.808.1.1.3.1.24
caAclIPV6ACERowStatus r/w
SNMPv2-TCRowStatus
 .1.3.6.1.4.1.9.9.808.1.1.3.1.25
caAclIPV6ACEProtocol r/w
CISCO-TCCiscoIpProtocol
 .1.3.6.1.4.1.9.9.808.1.1.3.1.3
caAclIPV6ACESourceAddress r/w
INET-ADDRESS-MIBInetAddress
 .1.3.6.1.4.1.9.9.808.1.1.3.1.4
caAclIPV6ACESourcePrefixLength r/w
Integer32
 .1.3.6.1.4.1.9.9.808.1.1.3.1.5
caAclIPV6ACESourceNetworkGroup r/w
OctetString
 .1.3.6.1.4.1.9.9.808.1.1.3.1.6
caAclIPV6ACESourcePortOperator r/w
CaAclPortOperator
 .1.3.6.1.4.1.9.9.808.1.1.3.1.7
caAclIPV6ACESourcePort r/w
INET-ADDRESS-MIBInetPortNumber
 .1.3.6.1.4.1.9.9.808.1.1.3.1.8
caAclIPV6ACESourcePortUpper r/w
INET-ADDRESS-MIBInetPortNumber
 .1.3.6.1.4.1.9.9.808.1.1.3.1.9
caAclAccessGroupCfgTable
.1.3.6.1.4.1.9.9.808.1.1.4
caAclAccessGroupCfgEntry
IF-MIBifIndexcaAclAccessGroupCfgAddressTypecaAclAccessGroupDirectioncaAclAccessGroupSequenceNumber
 .1.3.6.1.4.1.9.9.808.1.1.4.1
caAclAccessGroupACL r/w
CaAclACLIndex
 .1.3.6.1.4.1.9.9.808.1.1.4.1.1
caAclAccessGroupCfgAddressType
INET-ADDRESS-MIBInetAddressType
 .1.3.6.1.4.1.9.9.808.1.1.4.1.2
caAclAccessGroupDirection
CaAclTrafficDirection
 .1.3.6.1.4.1.9.9.808.1.1.4.1.3
caAclAccessGroupSequenceNumber
CaAclSequenceNumber
 .1.3.6.1.4.1.9.9.808.1.1.4.1.4
caAclAccessGroupRowStatus r/w
SNMPv2-TCRowStatus
 .1.3.6.1.4.1.9.9.808.1.1.4.1.5
caAclStats
.1.3.6.1.4.1.9.9.808.1.2
caAclLabelIntfStatsTable
.1.3.6.1.4.1.9.9.808.1.2.1
caAclLabelIntfStatsEntry
IF-MIBifIndexcaAclAccessGroupCfgAddressTypecaAclAccessGroupDirectioncaAclIntfStatsCounterLabelName
 .1.3.6.1.4.1.9.9.808.1.2.1.1
caAclIntfStatsCounterLabelName
OctetString
 .1.3.6.1.4.1.9.9.808.1.2.1.1.1
caAclIntfStatsPackets
packetsSNMPv2-SMICounter64
 .1.3.6.1.4.1.9.9.808.1.2.1.1.2
caAclIntfStatsOctets
bytesSNMPv2-SMICounter64
 .1.3.6.1.4.1.9.9.808.1.2.1.1.3
caAclMIBConformance
.1.3.6.1.4.1.9.9.808.2
caAclMIBACEConform
.1.3.6.1.4.1.9.9.808.2.1
caAclMIBACECompliances
.1.3.6.1.4.1.9.9.808.2.1.1
caAclMIBCfgGroups
.1.3.6.1.4.1.9.9.808.2.1.2
Dependencies (10) 8 direct · 2 transitive Show tree and compile order Hide dependency details

Each imported module is resolved in the importing module's source directory first, then through the normal default-variant rules.

Dependency tree
Dependency-first compile order
  1. SNMPv2-SMIrfc
  2. CISCO-SMIcisco
  3. SNMPv2-TCrfc
  4. CISCO-TCcisco
  5. IANAifType-MIBrfc
  6. SNMPv2-CONFrfc
  7. SNMPv2-MIBrfc
  8. IF-MIBrfc
  9. INET-ADDRESS-MIBrfc
  10. SNMP-FRAMEWORK-MIBrfc
  11. CISCO-ACL-MIBciscoselected
Type Definitions (8)
CaAclACLIndex
Unsigned32 range: 1..4294967295
CaAclAction
Enumeration
permit(1)
deny(2)
CaAclLogOption
Enumeration
log(1)
logInput(2)
CaAclPortOperator
Enumeration
lt(1)
gt(2)
eq(3)
neq(4)
range(5)
CaAclPrecedenceValue
Enumeration
routine(0)
priority(1)
immediate(2)
flash(3)
flashOverride(4)
critical(5)
internet(6)
network(7)
CaAclSequenceNumber
Unsigned32 range: 1..4294967295
CaAclTcpFlagsMatch
Enumeration
matchAny(1)
matchAll(2)
matchNone(3)
CaAclTrafficDirection
Enumeration
ingress(1)
egress(2)
Conformance Groups (5)
caAclMIBCfgGroup
caAclName caAclRowStatus
This group contains objects describing ACLs.
 .1.3.6.1.4.1.9.9.808.2.1.2.1
caAclIPV4ACLMIBACEGroup
caAclIPV4ACEAction caAclIPV4ACEProtocol caAclIPV4ACESourceAddress caAclIPV4ACESourceWildCardMask caAclIPV4ACESourceNetworkGroup caAclIPV4ACESourcePortOperator caAclIPV4ACESourcePort caAclIPV4ACESourcePortUpper caAclIPV4ACESourcePortGroup caAclIPV4ACEDestinationAddress caAclIPV4ACEDestinationWildCardMask caAclIPV4ACEDestinationNetworkGroup caAclIPV4ACEDestinationPortOperator caAclIPV4ACEDestinationPort caAclIPV4ACEDestinationPortUpper caAclIPV4ACEDestinationPortGroup caAclIPV4ACEDscpValue caAclIPV4ACETcpFlagsValue caAclIPV4ACETcpFlagsMask caAclIPV4ACETcpFlagsMatchType caAclIPV4ACETosValue caAclIPV4ACEPrecedenceValue caAclIPV4ACELogOption caAclIPV4ACECounterLabel caAclIPV4ACERemark caAclIPV4ACERowStatus
This group is a collection of objects providing IPV4 ACE
feature.
 .1.3.6.1.4.1.9.9.808.2.1.2.2
caAclIPV6ACLMIBACEGroup
caAclIPV6ACEAction caAclIPV6ACEProtocol caAclIPV6ACESourceAddress caAclIPV6ACESourcePrefixLength caAclIPV6ACESourceNetworkGroup caAclIPV6ACESourcePortOperator caAclIPV6ACESourcePort caAclIPV6ACESourcePortUpper caAclIPV6ACESourcePortGroup caAclIPV6ACEDestinationAddress caAclIPV6ACEDestinationPrefixLength caAclIPV6ACEDestinationNetworkGroup caAclIPV6ACEDestinationPortOperator caAclIPV6ACEDestinationPort caAclIPV6ACEDestinationPortUpper caAclIPV6ACEDestinationPortGroup caAclIPV6ACETcpFlagsValue caAclIPV6ACETcpFlagsMask caAclIPV6ACETcpFlagsMatchType caAclIPV6ACETrafficClassValue caAclIPV6ACELogOption caAclIPV6ACECounterLabel caAclIPV6ACERemark caAclIPV6ACERowStatus
This group is a collection of objects providing IPV6 ACE
feature.
 .1.3.6.1.4.1.9.9.808.2.1.2.3
caAclMIBAccessGroupCfgGroup
caAclAccessGroupACL caAclAccessGroupRowStatus
This group contains the objects describing the access group
configuration.
 .1.3.6.1.4.1.9.9.808.2.1.2.4
caAclMIBCounterGroup
caAclIntfStatsPackets caAclIntfStatsOctets
This group contains the objects describing the ACE
counter label.
 .1.3.6.1.4.1.9.9.808.2.1.2.5
Compliance Statements (1)

OID .1.3.6.1.4.1.9.9.808.2.1.1.1
This compliance statement specifies the minimal requirements
that an implementation must meet in order to claim full
compliance with the definitions of the C-ACL-MIB.
Required groups
mandatory caAclMIBCfgGroup
optional caAclMIBAccessGroupCfgGroup This group is mandatory except for systems that do not
support filtering IPV4 and or IPV6 packets.
optional caAclIPV4ACLMIBACEGroup This group is mandatory except for systems that do not
support IPV4 ACLs.
optional caAclIPV6ACLMIBACEGroup This group is mandatory except for systems that do not
support IPV6 ACLs.
optional caAclMIBCounterGroup This group is mandatory except for systems that do not
support ACL counter gathering statistics.
Object refinements
ObjectAccessSyntaxDescription
caAclName readonly
Write-access is not required.
caAclRowStatus readonly
Write-access is not required.
caAclIPV4ACEAction readonly
Write-access is not required.
caAclIPV4ACEProtocol readonly
Write-access is not required.
caAclIPV4ACESourceAddress readonly
Write-access is not required.
caAclIPV4ACESourceWildCardMask readonly
Write-access is not required.
caAclIPV4ACESourceNetworkGroup readonly
Write-access is not required.
caAclIPV4ACESourcePortOperator readonly
Write-access is not required.
caAclIPV4ACESourcePort readonly
Write-access is not required.
caAclIPV4ACESourcePortUpper readonly
Write-access is not required.
caAclIPV4ACESourcePortGroup readonly
Write-access is not required.
caAclIPV4ACEDestinationAddress readonly
Write-access is not required.
caAclIPV4ACEDestinationWildCardMask readonly
Write-access is not required.
caAclIPV4ACEDestinationNetworkGroup readonly
Write-access is not required.
caAclIPV4ACEDestinationPortOperator readonly
Write-access is not required.
caAclIPV4ACEDestinationPort readonly
Write-access is not required.
caAclIPV4ACEDestinationPortUpper readonly
Write-access is not required.
caAclIPV4ACEDestinationPortGroup readonly
Write-access is not required.
caAclIPV4ACEDscpValue readonly
Write-access is not required.
caAclIPV4ACETcpFlagsValue readonly
Write-access is not required.
caAclIPV4ACETcpFlagsMask readonly
Write-access is not required.
caAclIPV4ACETcpFlagsMatchType readonly
Write-access is not required.
caAclIPV4ACETosValue readonly
Write-access is not required.
caAclIPV4ACEPrecedenceValue readonly
Write-access is not required.
caAclIPV4ACELogOption readonly
Write-access is not required.
caAclIPV4ACECounterLabel readonly
Write-access is not required.
caAclIPV4ACERemark readonly
Write-access is not required.
caAclIPV4ACERowStatus readonly
Write-access is not required.
caAclIPV6ACEAction readonly
Write-access is not required.
caAclIPV6ACEProtocol readonly
Write-access is not required.
caAclIPV6ACESourceAddress readonly
Write-access is not required.
caAclIPV6ACESourcePrefixLength readonly
Write-access is not required.
caAclIPV6ACESourceNetworkGroup readonly
Write-access is not required.
caAclIPV6ACESourcePortOperator readonly
Write-access is not required.
caAclIPV6ACESourcePort readonly
Write-access is not required.
caAclIPV6ACESourcePortUpper readonly
Write-access is not required.
caAclIPV6ACESourcePortGroup readonly
Write-access is not required.
caAclIPV6ACEDestinationAddress readonly
Write-access is not required.
caAclIPV6ACEDestinationPrefixLength readonly
Write-access is not required.
caAclIPV6ACEDestinationNetworkGroup readonly
Write-access is not required.
caAclIPV6ACEDestinationPortOperator readonly
Write-access is not required.
caAclIPV6ACEDestinationPort readonly
Write-access is not required.
caAclIPV6ACEDestinationPortUpper readonly
Write-access is not required.
caAclIPV6ACEDestinationPortGroup readonly
Write-access is not required.
caAclIPV6ACETrafficClassValue readonly
Write-access is not required.
caAclIPV6ACETcpFlagsValue readonly
Write-access is not required.
caAclIPV6ACETcpFlagsMask readonly
Write-access is not required.
caAclIPV6ACETcpFlagsMatchType readonly
Write-access is not required.
caAclIPV6ACELogOption readonly
Write-access is not required.
caAclIPV6ACECounterLabel readonly
Write-access is not required.
caAclIPV6ACERemark readonly
Write-access is not required.
caAclIPV6ACERowStatus readonly
Write-access is not required.
caAclAccessGroupACL readonly
Write-access is not required.
caAclAccessGroupRowStatus readonly
Write-access is not required.