HUAWEI-IPDSLAM-SECURITY-MIB Table View

Describes the MAC address filtering function. With this function, the system checks the source
MAC address of the user packet based on the configured MAC address entry.
If the source MAC address of the user packet is the same as the MAC address configured in this
table, the packet is discarded.
The index of this table is hwIpDslamSrcMacFilteringIndex, which uniquely identifies the MAC address
entry to be filtered by the system.

It is the table for the dynamic binding between the MAC address and the service port and is used
for querying the entry of the dynamic binding between the MAC address and the service port.
After anti-MAC-spoofing is enabled, the MAC address of the user is bound to the corresponding
service port. If the MAC address of the user packet is not the MAC address bound to the service port,
the packet is discarded.
The indexes of this table are hwIpDslamMacAddrDynamicBindingFlowId and hwIpDslamMacAddrDynamicBindingMacIndex.
The service port corresponding to this index must already be created in hwExtSrvFlowEntry.
hwIpDslamMacAddrDynamicBindingMacIndex is the index of the MAC address bound to the service port.

It is the table for the dynamic binding between the IP address and the service port
and is used for querying the entry of the dynamic binding between the IP address and
the service port.
After anti-IP-spoofing is enabled and the user goes online, the IP address obtained
by the user is bound to the corresponding service port. The packet can be transmitted
upstream through the device only when the source IP address of the packet is the same
as the bound IP address. Otherwise, the packet is discarded.
The indexes of this table are hwIpDslamIpAddrDynamicBindingFlowId and
hwIpDslamIpAddrDynamicBindingIpIndex.
The service port corresponding to this index must already be created in hwExtSrvFlowEntry.
hwIpDslamIpAddrDynamicBindingIpIndex is the index of the IP address bound to the service
port.

Used for querying or deleting the entry of the current blacklist in the system.
The index of this table is hwIpDslamDosBlackListIndex, which uniquely identifies
an entry of the blacklist.

Describes the destination MAC address filtering function. With this function, the system checks
the destination MAC address of the user packet based on the configured MAC address entry.
If the destination MAC address of the user packet is the same as the MAC address configured in
this table, the packet is discarded.
The index of this table is hwIpDslamDesMacFilteringIndex, which uniquely identifies the MAC address
entry to be filtered by the system.

Used for querying the dynamically learned MAC address on the network side. The system checks the source
MAC address of the user packet based on this MAC address entry.
If the source MAC address of the user packet is the same as the MAC address in this table, the packet is
discarded.
The index of this table is hwIpDslamDynSrcMacFilteringIndex, which uniquely identifies the MAC address
entry to be filtered by the system.

Used for enabling or disabling anti-IP-spoofing of the service port. Anti-IP-spoofing
on a service port takes effect only when it is enabled globally and is enabled on this
service port.
The index of this table is hwIpDslamAntiIpServicePortIndex, indicating the index of the
service port. The service port corresponding to this index must already be created in
hwExtSrvFlowEntry.

The table used to configure the IP-spoofing based on VLAN.
The index of this table is hwIpDslamSecurityVlanCtrlIndex.

Used for setting or querying the threshold for the port-based packet rate in anti-DoS-attack.
The traffic exceeding this threshold is discarded.
The indexes of this table are hwIpDslamAntiDosPacketLimitIfIndex, hwIpDslamAntiDosPacketLimitSecondIndex,
and hwIpDslamAntiDosPacketLimitThirdIndex.
hwIpDslamAntiDosPacketLimitIfIndex is the port index and its meaning is the same as that of
ifIndex in ifTable of rfc1213 IF_MIB.
hwIpDslamAntiDosPacketLimitSecondIndex is the second index of the table. The meaning varies with
the port type. It must be 0xFFFFFFFF for the DSL or ETH port, and is the ONT ID or 0xFFFFFFFF for the xPON port.
hwIpDslamAntiDosPacketLimitThirdIndex is the third index of the table. The meaning varies with
the port type. It must be 0xFFFFFFFF for the DSL, ETH, or EPON port, and its value is gemindex
or gemport ID for the GPON port.
When hwIpDslamAntiDosPacketLimitIfIndex is 0xFFFFFFFD, hwIpDslamAntiDosPacketLimitSecondIndex indicates
the GPON end to end service flow index and hwIpDslamAntiDosPacketLimitThirdIndex is invalid value 0xFFFFFFFF.

Used for querying the IP/MAC conflict logs of the DHCP, PPPOE, SLAAC and DHCPv6 packets when the
anti-IP-spoofing or anti-MAC-spoofing is enabled.
The index of this table is hwIpDslamSecurityConflictLogIndex, which is the index of the control
module of the system conflict logs.

Used for querying the statistics of the packets with IP/MAC conflict and illegal arp packets.
The index of this table is hwIpDslamSecurityConflictStatIfindex, which is the
index of the port. The meaning of hwIpDslamSecurityConflictStatIfindex is the
same as that of ifIndex in ifTable of rfc1213 IF_MIB.

It is the table for querying the dynamic binding item between the IPv6 address and the service port.
If anti-IPv6-spoofing is enabled, the IPv6 address obtained by the user is bound to the corresponding
service port when a user goes online.
The packet can be transmitted upstream through the device only when the source IPv6 address of the
packet is the same as the bound IPv6 address. Otherwise, the packet is discarded.
At most two IPv6 addresses are supported for one user. If only one IPv6 address is allocated, the results
of nodes hwIpDslamIpv6DynamicBindingIpv6Address2, hwIpDslamIpv6DynamicBindingPrefixLength2 and
hwIpDslamIpv6DynamicBindingLeaseTime2 are invalid.
The indexes of this table are hwIpDslamIpAddrDynamicBindingFlowId and hwIpDslamIpv6DynamicBindingItemIndex.
The service port corresponding to this index must already be created in hwExtSrvFlowEntry.
The node hwIpDslamIpv6DynamicBindingItemIndex is the index of the IPv6 address bound to the service port.

It is the table for deleting the dynamic binding table.
If anti-IP-spoofing function is enabled, the dynamic binding table can be deleted by the service port
and IP address. If anti-IPv6-spoofing function is enabled, the dynamic binding table can be deleted by
the service port and IPv6 address. If anti-MAC-spoofing function is enabled, the dynamic binding table
can be deleted by the service port and MAC address.
The index of this table is hwIpDslamDynamicBindingFlowId.
The service port corresponding to this index must already be created in hwExtSrvFlowEntry.

Used for querying the statistics of the packets with IP,IPv6,MAC conflict and illegal arp packets.
The indexes of this table are hwIpDslamSecurityExConflictStatIfindex, hwIpDslamSecurityExConflictStatSecondIndex
and hwIpDslamSecurityExConflictStatThirdIndex. hwIpDslamSecurityExConflictStatIfindex is the
index of the port and its meaning is the same as that of ifIndex in ifTable of rfc1213 IF_MIB.
hwIpDslamSecurityExConflictStatSecondIndex is the second index of the table, the meaning varies with the port type.
It must be 0x7FFFFFFF for the DSL or P2P port and the value is ONT ID for the GPON port.
hwIpDslamAntiDosPacketLimitThirdIndex is the third index of the table, the meaning varies with
the port type. It must be 0x7FFFFFFF for the DSL or P2P port, its value is gemindex for
the GPON port.

It is used to config the ACL rules of appointed interface. The number of ACL rule added or deleted is hwFirewallPacketFilterAclNumber.
There are two directions in one interface, and at most eight ACL rules in every direction. The number of a ACL rule must be different from the others.
The indexes of this table are hwFirewallPacketFilterIfIndex,hwFirewallPacketFilterDirection,hwFirewallPacketFilterAclNumber.

It is used to count the number of the packet which is permitted or denied by the ACL rules,
if there are not ACL rules in the interface,it will not be counted and displayed.
The indexes of this table are hwFirewallPacketFilterStatisticsIfIndex,hwFirewallPacketFilterStatisticsDirection,hwFirewallPacketFilterStatisticsAclIndex.

It is used to count the number of the packet which is permitted or denied by default operation,
if there are not ACL rules in the interface,it will not be counted and displayed.
The indexes of this table are hwFirewallPacketFilterDefaultStatisticsIfIndex,hwFirewallPacketFilterDefaultStatisticsDirection.

It is used to set two access features about Ipv6 on vlanif interface.
The features are denying the packet which target ip is link local address
and limiting the nerghbor entry number that our equipment can learn.
The index of this table is hwIpv6IfAccessIfIndex.

Indicates the information of the ONT, which occurred the broadcast-attack.
The indexes of this table are hwIpDslamAntiBcAttackOntQueryIfIndex and hwIpDslamAntiBcAttackOntQueryOntId.

This table is used for querying dynamic bound MAC address entries of all service ports on a CM.
After MAC anti-spoofing is enabled, the user's MAC address is bound to a corresponding
service port. Up to eight MAC addresses can be bound to a service port. The table lists all MAC address bound to all service ports
on a CM.
The indexes of this table are hwIpDslamCmtsMacAddrDynamicBindingCmIndex and hwIpDslamCmtsMacAddrDynamicBindingMacIndex.
hwIpDslamCmtsMacAddrDynamicBindingCmIndex is the index of the CM, defined in docsIf3CmtsCmRegStatusId.
hwIpDslamMacAddrDynamicBindingMacIndex is the index of the MAC address bound to all service ports on a CM.

Indicates the broadcast packet rate threshold of the port.
The index of this table is hwIpDslamAntiBcAttackPortRateIfIndex.

Indicates the broadcast packet rate threshold of the ONT.
The indexes of this table are hwIpDslamAntiBcAttackOntRateIfIndex and hwIpDslamAntiBcAttackOntRateOntId.

Used for enabling or disabling anti-MAC-spoofing of the service port. Anti-MAC-spoofing
on a service port takes effect only when it is enabled globally and is enabled on the 
VLAN corresponding to this service port and is enabled on this service port.
The index of this table is hwIpDslamAntiMacServicePortIndex, indicating the index of the
service port. The service port corresponding to this index must already be created in
hwExtSrvFlowEntry.

This table is used to create static entries for network-side ARP broadcast-to-unicast conversion. 
To transmit an ARP request packet with a specified target IP address received on the network side to the user on a specified service port, use this table. 
With ARP broadcast-to-unicast conversion enabled on the network side, when static IP address binding entries are created successfully for ARP broadcast-to-unicast conversion, 
the device transmits the ARP request packet with a specified target IP address received on the network side to the user on a specified service port.
The indexes of this table are hwIpDslamArpUnicastIndex and hwIpDslamArpUnicastSubIndex.