CISCO-ACL-MIB Table View

A table of ACL definitions. Each entry in this table defines
a unique IPV4 or IPV6 ACL.

caAclCfgTableEntry row .1.3.6.1.4.1.9.9.808.1.1.1.1

A conceptual row in the caAclTable. Each entry of this table
consists of acl index and the address type. This is so that
the table may contain both IPV4 and IPV6 ACLs.

Indexes

caAclIndex caAclAddressType

Column	Syntax	OID
caAclIndex An arbitrary (system assigned) index for each ACL name. The index is unique for each ACL name in the device, but is further qualified by the address family. For example, consider the following configurati…	CaAclACLIndex Type Constraints: range: 1..4294967295	.1.3.6.1.4.1.9.9.808.1.1.1.1.1
caAclAddressType This object defines the address family of the ACL.	INET-ADDRESS-MIBInetAddressType Type Values: 0 unknown 1 ipv4 2 ipv6 3 ipv4z 4 ipv6z 16 dns 25 l2vpn	.1.3.6.1.4.1.9.9.808.1.1.1.1.2
caAclName A string that identifies the ACL name.	OctetStringr/w Constraints: range: 1-64	.1.3.6.1.4.1.9.9.808.1.1.1.1.3
caAclRowStatus This object is used to create, modify, or delete an entry in the caAclTable. A row can be created using the 'CreateAndGo' option. When the row is successfully created, the RowStatus will be set to active …	SNMPv2-TCRowStatusr/w Type Values: 1 active 2 notInService 3 notReady 4 createAndGo 5 createAndWait 6 destroy Description: The RowStatus textual convention is used to manage the creation and deletion of conceptual rows, and is used as the value of the SYNTAX clause for the status column of a conceptual row (as described in Section 7.7.1 of …	.1.3.6.1.4.1.9.9.808.1.1.1.1.4

A table of IPV4 ACE definitions. The ACE definition controls
whether packets are accepted or rejected. The access control
may be applied before sending the packet to the forwarding
engine, or may be applied after the packet is processed by the
forwarding engine.
          
If two ACE entries with the same sequence number are configured
the latter will overwrite the former.

caAclIPV4ACECfgTableEntry row .1.3.6.1.4.1.9.9.808.1.1.2.1

A conceptual row in the caAclIPV4ACLTable. Each entry of this
table consists of a set of match criteria for a given ACL.

Indexes

caAclIndex caAclAddressType caAclIPV4ACESequenceNumber

Column	Syntax	OID
caAclIPV4ACESequenceNumber This object uniquely identifies an ACE within an ACL. Sequence numbers are assigned to each permit/deny statement, causing the system to insert the statement in that numbered position within the ACL. If two ACE entries …	CaAclSequenceNumber Type Constraints: range: 1..4294967295	.1.3.6.1.4.1.9.9.808.1.1.2.1.1
caAclIPV4ACEAction This object indicates the type of action to be taken if the packet matches the given criteria. If it is set to permit(1), all packets matching this ACE will be allowed for further processing. …	CaAclActionr/w Type Values: 1 permit 2 deny	.1.3.6.1.4.1.9.9.808.1.1.2.1.2
caAclIPV4ACEProtocol This object identifies the layer 3 protocol type to be filtered by the ACE. Protocol numbers are defined in the Network Working Group Request For Comment documents.	CISCO-TCCiscoIpProtocolr/w Type Constraints: range: 0..255	.1.3.6.1.4.1.9.9.808.1.1.2.1.3
caAclIPV4ACESourceAddress This object determines the address of the network or host from which the packet is being sent. If this object value is 0.0.0.0 and the value of caAclIPV4ACESourceWildCardMask object in the same entry is 255.255.255.255,…	INET-ADDRESS-MIBInetAddressr/w Type Constraints: range: 0..255	.1.3.6.1.4.1.9.9.808.1.1.2.1.4
caAclIPV4ACESourceWildCardMask This object determines the mask of wild card address bits for caAclIPV4ACESourceAddress. Wild card masking is to indicate to the system whether to check or ignore the corresponding IP address bits when comparing the add…	INET-ADDRESS-MIBInetAddressr/w Type Constraints: range: 0..255	.1.3.6.1.4.1.9.9.808.1.1.2.1.5
caAclIPV4ACESourceNetworkGroup This object defines the Source Network Object Group from which the packet is being sent.	OctetStringr/w Constraints: range: 1-64	.1.3.6.1.4.1.9.9.808.1.1.2.1.6
caAclIPV4ACESourcePortOperator This object defines the operation to be performed to the layer source port field. Source port fields are present only for IGMP, ICMP, SCTP, TCP, and UDP protocols. If caAclIPV4ACEProtocol is none of the o…	CaAclPortOperatorr/w Type Values: 1 lt 2 gt 3 eq 4 neq 5 range	.1.3.6.1.4.1.9.9.808.1.1.2.1.7
caAclIPV4ACESourcePort This object defines the source port number of the layer 4 protocol. This is the field to be matched with the specified source port based on the caAclIPV4ACESourcePortOperator. If caAclIPV4ACESourcePortOperator is range(…	INET-ADDRESS-MIBInetPortNumberr/w Type Constraints: range: 0..65535	.1.3.6.1.4.1.9.9.808.1.1.2.1.8
caAclIPV4ACESourcePortUpper This object defines the inclusive upper bound of the layer 4 source port range that is to be matched.	INET-ADDRESS-MIBInetPortNumberr/w Type Constraints: range: 0..65535	.1.3.6.1.4.1.9.9.808.1.1.2.1.9
caAclIPV4ACESourcePortGroup This object defines the Source Port Object Group from which the packet is being sent.	OctetStringr/w Constraints: range: 1-64	.1.3.6.1.4.1.9.9.808.1.1.2.1.10
caAclIPV4ACEDestinationAddress This object determines the address of the network or host to which the packet is being sent. If this object value is 0.0.0.0 and the value of caAclIPV4ACLDestinationWildCardMask object in the same entry is 255.255.255.2…	INET-ADDRESS-MIBInetAddressr/w Type Constraints: range: 0..255	.1.3.6.1.4.1.9.9.808.1.1.2.1.11
caAclIPV4ACEDestinationWildCardMask This object determines the mask of wild card address bits for caAclIPV4ACLDestinationAddress. Wild card masking is to indicate to the system whether to check or ignore the corresponding IP address bits when comparing th…	INET-ADDRESS-MIBInetAddressr/w Type Constraints: range: 0..255	.1.3.6.1.4.1.9.9.808.1.1.2.1.12
caAclIPV4ACEDestinationNetworkGroup This object defines the Destination Network Object Group to which the packet is being sent.	OctetStringr/w Constraints: range: 1-64	.1.3.6.1.4.1.9.9.808.1.1.2.1.13
caAclIPV4ACEDestinationPortOperator This object defines the operation to be performed to the layer destination port field. Source port fields are present only for IGMP, ICMP, SCTP, TCP, and UDP protocols. If caAclIPV4ACLProtocol is none of …	CaAclPortOperatorr/w Type Values: 1 lt 2 gt 3 eq 4 neq 5 range	.1.3.6.1.4.1.9.9.808.1.1.2.1.14
caAclIPV4ACEDestinationPort This object defines the destination port number of the layer 4 protocol. This is the field to be matched with the specified destination port based on the caAclIPV4ACLSourceOperator. If caAclIPV4ACLDestinationOperator is…	INET-ADDRESS-MIBInetPortNumberr/w Type Constraints: range: 0..65535	.1.3.6.1.4.1.9.9.808.1.1.2.1.15
caAclIPV4ACEDestinationPortUpper This object defines the inclusive upper bound of the layer 4 destination port range that is to be matched.	INET-ADDRESS-MIBInetPortNumberr/w Type Constraints: range: 0..65535	.1.3.6.1.4.1.9.9.808.1.1.2.1.16
caAclIPV4ACEDestinationPortGroup This object defines the Source Port Object Group to which the packet is being sent.	OctetStringr/w Constraints: range: 1-64	.1.3.6.1.4.1.9.9.808.1.1.2.1.17
caAclIPV4ACEDscpValue This object defines the dscp value that will be considered in the match criteria against the value in the packet.	Unsigned32r/w Constraints: range: 0-63	.1.3.6.1.4.1.9.9.808.1.1.2.1.18
caAclIPV4ACETcpFlagsValue This object defines the value of the TCP flags which will be considered in the match criteria based on caAclIPV4ACLTcpFlagsMatchType. Users can select any desired combination of the TCP flags on which to filter TCP pack…	Unsigned32r/w Constraints: range: 0-255	.1.3.6.1.4.1.9.9.808.1.1.2.1.19
caAclIPV4ACETcpFlagsMask This object defines the mask value of the TCP flags field.	Unsigned32r/w Constraints: range: 0-255	.1.3.6.1.4.1.9.9.808.1.1.2.1.20
caAclIPV4ACETcpFlagsMatchType This object defines the type of matching to be done on the TCP flags field.	CaAclTcpFlagsMatchr/w Type Values: 1 matchAny 2 matchAll 3 matchNone	.1.3.6.1.4.1.9.9.808.1.1.2.1.21
caAclIPV4ACETosValue This object defines the value of the TOS field to be filtered. Packets can be filtered by the TOS level as specified by a number from 0 to 15. Use the value 16 to indicate that the TOS field should be ignored during mat…	Unsigned32r/w Constraints: range: 0-16	.1.3.6.1.4.1.9.9.808.1.1.2.1.22
caAclIPV4ACEPrecedenceValue This object indicates the value of the precedence field to be filtered.	CaAclPrecedenceValuer/w Type Values: 0 routine 1 priority 2 immediate 3 flash 4 flashOverride 5 critical 6 internet 7 network	.1.3.6.1.4.1.9.9.808.1.1.2.1.23
caAclIPV4ACELogOption This object defines the value of the log option field to be applied to packets that match this ACE entry.	CaAclLogOptionr/w Type Values: 1 log 2 logInput	.1.3.6.1.4.1.9.9.808.1.1.2.1.24
caAclIPV4ACECounterLabel This object defines the counter label name for this ACE. ACEs that share the same counter label name will have their hit counts aggregated into the same counter label name.	OctetStringr/w Constraints: range: 1-64	.1.3.6.1.4.1.9.9.808.1.1.2.1.25
caAclIPV4ACERemark This object defines a comment in the ACL. It helps the user to define some meaningful comment to identify the ACE quickly, or to know the purpose of a set of ACEs. This field is not used during packet matching.	OctetStringr/w Constraints: range: 1-100	.1.3.6.1.4.1.9.9.808.1.1.2.1.26
caAclIPV4ACERowStatus This object is used to create, modify, or delete an entry in the caAclIPV4ACLTable. A row can be created using the 'CreateAndGo' option. When the row is successfully created, the RowStatus will be set to …	SNMPv2-TCRowStatusr/w Type Values: 1 active 2 notInService 3 notReady 4 createAndGo 5 createAndWait 6 destroy Description: The RowStatus textual convention is used to manage the creation and deletion of conceptual rows, and is used as the value of the SYNTAX clause for the status column of a conceptual row (as described in Section 7.7.1 of …	.1.3.6.1.4.1.9.9.808.1.1.2.1.27

A table of IPV6 ACE definitions. The ACE definition controls
whether packets are accepted or rejected. The access control
may be applied before sending the packet to the forwarding
engine, or may be applied after the packet is processed by the
forwarding engine.

caAclIPV6ACECfgTableEntry row .1.3.6.1.4.1.9.9.808.1.1.3.1

A conceptual row in the caAclIPV6ACLTable. Each entry of this
table consists of a set of match criteria for a given ACL.

Indexes

caAclIndex caAclAddressType caAclIPV6ACESequenceNumber

Column	Syntax	OID
caAclIPV6ACESequenceNumber This object uniquely identifies an ACE within an ACL. Sequence numbers are assigned to each permit/deny statement, causing the system to insert the statement in that numbered position within the ACL.	CaAclSequenceNumber Type Constraints: range: 1..4294967295	.1.3.6.1.4.1.9.9.808.1.1.3.1.1
caAclIPV6ACEAction This object indicates the type of action to be taken if the packet matches the given criteria. If it is set to permit(1), all packets matching this ACE will be allowed for further processing. …	CaAclActionr/w Type Values: 1 permit 2 deny	.1.3.6.1.4.1.9.9.808.1.1.3.1.2
caAclIPV6ACEProtocol This object identifies the protocol type to be filtered by the ACE. Protocol numbers are defined in the Network Working Group Request For Comment (RFC) documents.	CISCO-TCCiscoIpProtocolr/w Type Constraints: range: 0..255	.1.3.6.1.4.1.9.9.808.1.1.3.1.3
caAclIPV6ACESourceAddress This object determines the address of the network or host from which the packet is being sent. If this object value is 0::0 and the value of caAclIPV6ACLSourcePrefixLength is 0 then this matches any source address. …	INET-ADDRESS-MIBInetAddressr/w Type Constraints: range: 0..255	.1.3.6.1.4.1.9.9.808.1.1.3.1.4
caAclIPV6ACESourcePrefixLength This object determines the number of bits in the field caAclIPV6ACLSourceAddress to be checked. If the value of this object is 0, then the source address in the packet must match caAclIPV6ACESourceAddress…	Integer32r/w Constraints: range: 0-128	.1.3.6.1.4.1.9.9.808.1.1.3.1.5
caAclIPV6ACESourceNetworkGroup This object defines the Source Network Object Group from which the packet is being sent.	OctetStringr/w Constraints: range: 1-64	.1.3.6.1.4.1.9.9.808.1.1.3.1.6
caAclIPV6ACESourcePortOperator This object defines the operation to be performed to the layer source port field. Source port fields are present only for IGMP, ICMP, SCTP, TCP, and UDP protocols. If caAclIPV6ACLProtocol is none of the o…	CaAclPortOperatorr/w Type Values: 1 lt 2 gt 3 eq 4 neq 5 range	.1.3.6.1.4.1.9.9.808.1.1.3.1.7
caAclIPV6ACESourcePort This object defines the source port number of the layer 4 protocol. This is the field to be matched with the specified source port based on the caAclIPV6ACLSourceOperator. If caAclIPV6ACLSourceOperator is range(5) then …	INET-ADDRESS-MIBInetPortNumberr/w Type Constraints: range: 0..65535	.1.3.6.1.4.1.9.9.808.1.1.3.1.8
caAclIPV6ACESourcePortUpper This object defines the inclusive upper bound of the layer 4 source port range that is to be matched.	INET-ADDRESS-MIBInetPortNumberr/w Type Constraints: range: 0..65535	.1.3.6.1.4.1.9.9.808.1.1.3.1.9
caAclIPV6ACESourcePortGroup This object defines the Source Port Object Group from which the packet is being sent.	OctetStringr/w Constraints: range: 1-64	.1.3.6.1.4.1.9.9.808.1.1.3.1.10
caAclIPV6ACEDestinationAddress This object determines the address of the network or host to which the packet is being sent. If this object value is 0::0 and the value of caAclIPV6ACLSourcePrefixLength is 0 then this matches any source address. …	INET-ADDRESS-MIBInetAddressr/w Type Constraints: range: 0..255	.1.3.6.1.4.1.9.9.808.1.1.3.1.11
caAclIPV6ACEDestinationPrefixLength This object determines the number of bits in the field caAclIPV6ACLDestinationAddress to be checked. If the value of this object is 0, then the source address in the packet must match caAclIPV6ACEDestinat…	Integer32r/w Constraints: range: 0-128	.1.3.6.1.4.1.9.9.808.1.1.3.1.12
caAclIPV6ACEDestinationNetworkGroup This object defines the Source Network Object Group to which the packet is being sent.	OctetStringr/w Constraints: range: 1-64	.1.3.6.1.4.1.9.9.808.1.1.3.1.13
caAclIPV6ACEDestinationPortOperator This object defines the operation to be performed to the layer destination port field. Source port fields are present only for IGMP, ICMP, SCTP, TCP, and UDP protocols. If caAclIPV6ACLProtocol is none of …	CaAclPortOperatorr/w Type Values: 1 lt 2 gt 3 eq 4 neq 5 range	.1.3.6.1.4.1.9.9.808.1.1.3.1.14
caAclIPV6ACEDestinationPort This object defines the destination port number of the layer 4 protocol. This is the field to be matched with the specified destination port based on the caAclIPV6ACLSourceOperator. If caAclIPV6ACLDestinationOperator is…	INET-ADDRESS-MIBInetPortNumberr/w Type Constraints: range: 0..65535	.1.3.6.1.4.1.9.9.808.1.1.3.1.15
caAclIPV6ACEDestinationPortUpper This object defines the inclusive upper bound of the layer 4 destination port range that is to be matched.	INET-ADDRESS-MIBInetPortNumberr/w Type Constraints: range: 0..65535	.1.3.6.1.4.1.9.9.808.1.1.3.1.16
caAclIPV6ACEDestinationPortGroup This object defines the Source Port Object Group to which the packet is being sent.	OctetStringr/w Constraints: range: 1-64	.1.3.6.1.4.1.9.9.808.1.1.3.1.17
caAclIPV6ACETrafficClassValue This object defines the traffic class value that will be considered in the match criteria against the value in the packet.	Unsigned32r/w Constraints: range: 0-255	.1.3.6.1.4.1.9.9.808.1.1.3.1.18
caAclIPV6ACETcpFlagsValue This object defines the value of the TCP flags which will be considered in the match criteria based on caAclIPV6ACLTcpFlagsMatchType. Users can select any desired combination of the TCP flags on which to filter TCP pack…	Unsigned32r/w Constraints: range: 0-255	.1.3.6.1.4.1.9.9.808.1.1.3.1.19
caAclIPV6ACETcpFlagsMask This object defines the mask value of the TCP flags field.	Unsigned32r/w Constraints: range: 0-255	.1.3.6.1.4.1.9.9.808.1.1.3.1.20
caAclIPV6ACETcpFlagsMatchType This object defines the type of matching to be done on the TCP flags field.	CaAclTcpFlagsMatchr/w Type Values: 1 matchAny 2 matchAll 3 matchNone	.1.3.6.1.4.1.9.9.808.1.1.3.1.21
caAclIPV6ACELogOption This object defines the value of the log option field to be applied to packets that match this ACE entry.	CaAclLogOptionr/w Type Values: 1 log 2 logInput	.1.3.6.1.4.1.9.9.808.1.1.3.1.22
caAclIPV6ACECounterLabel This object defines the counter label name for this ACE. ACEs that share the same counter label name will have their hit counts aggregated into the same counter label name.	OctetStringr/w Constraints: range: 1-64	.1.3.6.1.4.1.9.9.808.1.1.3.1.23
caAclIPV6ACERemark This object defines a comment in the ACL. It helps the user to define some meaningful comment to identify the ACE quickly, or to know the purpose of a set of ACEs. This field is not used during packet matching.	OctetStringr/w Constraints: range: 1-100	.1.3.6.1.4.1.9.9.808.1.1.3.1.24
caAclIPV6ACERowStatus This object is used to create, modify, or delete an entry in the caAclIPV6ACLTable. A row can be created using the 'CreateAndGo' option. When the row is successfully created, the RowStatus will be set to …	SNMPv2-TCRowStatusr/w Type Values: 1 active 2 notInService 3 notReady 4 createAndGo 5 createAndWait 6 destroy Description: The RowStatus textual convention is used to manage the creation and deletion of conceptual rows, and is used as the value of the SYNTAX clause for the status column of a conceptual row (as described in Section 7.7.1 of …	.1.3.6.1.4.1.9.9.808.1.1.3.1.25

This table lists the ACLs configured on the device and
applied on an interface in the ingress or egress direction.

caAclAccessGroupCfgEntry row .1.3.6.1.4.1.9.9.808.1.1.4.1

This entry describes an ACL configured on the device and
applied to an interface.

Indexes

IF-MIBifIndex caAclAccessGroupCfgAddressType caAclAccessGroupDirection caAclAccessGroupSequenceNumber

Column	Syntax	OID
caAclAccessGroupACL The name of the ACL associated with this entry.	CaAclACLIndexr/w Type Constraints: range: 1..4294967295	.1.3.6.1.4.1.9.9.808.1.1.4.1.1
caAclAccessGroupCfgAddressType This entry describes the address family of the access group being applied on the interface.	INET-ADDRESS-MIBInetAddressType Type Values: 0 unknown 1 ipv4 2 ipv6 3 ipv4z 4 ipv6z 16 dns 25 l2vpn	.1.3.6.1.4.1.9.9.808.1.1.4.1.2
caAclAccessGroupDirection This object defines the direction in which the ACL is applied.	CaAclTrafficDirection Type Values: 1 ingress 2 egress	.1.3.6.1.4.1.9.9.808.1.1.4.1.3
caAclAccessGroupSequenceNumber This object uniquely identifies the order that Access Group applied to a interface. It can be used by platforms that support applying more than one Access List per address family per direction. For example: interfac…	CaAclSequenceNumber Type Constraints: range: 1..4294967295	.1.3.6.1.4.1.9.9.808.1.1.4.1.4
caAclAccessGroupRowStatus This object is used to create, modify, or delete an entry in the caAclAccessGroupCfgTable. A row can be created using the 'CreateAndGo' option. When the row is successfully created, the RowStatus will be set to active b…	SNMPv2-TCRowStatusr/w Type Values: 1 active 2 notInService 3 notReady 4 createAndGo 5 createAndWait 6 destroy Description: The RowStatus textual convention is used to manage the creation and deletion of conceptual rows, and is used as the value of the SYNTAX clause for the status column of a conceptual row (as described in Section 7.7.1 of …	.1.3.6.1.4.1.9.9.808.1.1.4.1.5

This table describes the statistics for all ACEs with assigned
counter labels, attached to interfaces on the device.
          
An entry in this table is created when an ACL containing an ACE
that references the specified counter label name is applied to
an interface.
          
An entry in this table is deleted when an ACL containing an ACE
that references the specified counter lable name is removed
from an interface.

caAclLabelIntfStatsEntry row .1.3.6.1.4.1.9.9.808.1.2.1.1

Each entry in this table provides the aggregated counters for
all ACEs applied on the given interface/direction that have
been assigned the same counter label.

Indexes

IF-MIBifIndex caAclAccessGroupCfgAddressType caAclAccessGroupDirection caAclIntfStatsCounterLabelName

Column	Syntax	OID
caAclIntfStatsCounterLabelName The counter label index associated with this set of statistics.	OctetString Constraints: range: 1-64	.1.3.6.1.4.1.9.9.808.1.2.1.1.1
caAclIntfStatsPackets The total number of packets that match this counter label.	packetsSNMPv2-SMICounter64 Type Constraints: range: 0..18446744073709551615	.1.3.6.1.4.1.9.9.808.1.2.1.1.2
caAclIntfStatsOctets The total number of octets that match this counter label.	bytesSNMPv2-SMICounter64 Type Constraints: range: 0..18446744073709551615	.1.3.6.1.4.1.9.9.808.1.2.1.1.3