CISCO-ACL-MIB
96 objects
This MIB module defines objects that describe Cisco Access Control Lists (ACL). This MIB describes different objects that enable the network administrator to remotely configure ACLs, apply them to interfaces and monitor their usage statistics. A typical application of this MIB module will facilitate monitoring of ACL match (sometimes referred as hit) counts. However, by no means does the definition of this MIB module prevent other applications from using it. An ACL is an ordered list of statements that deny or permit packets based on matching fields contained within the packet header (layer 3 source and destination addresses, layer 4 protocol, layer 4 source and destination port numbers, etc.) In addition there is an implicit *Deny All* at the end of the ACL. ACLs are used to perform packet filtering to control which packets are allowed through the network. Such control can help limit network traffic, and restrict the access of applications and devices on the network. Each one of these statements is referred to as an Access List Control Entry (ACE). Here is an example of an ACL configuration. ipv4 access-list V4Example 10 permit tcp any any ! ipv6 access-list V6Example 10 permit tcp any any ! The mechanism for monitoring ACL usage is by configuring, in the desired ACEs a counter label. A counter label is a name that is given to a counter and is defined in any ACE. ACEs that share the same Counter label name will have their counters aggregated into the same label. Here is an example of how to use counter labels. ipv4 access-list V4CounterExample 10 permit tcp any any counter CountPermits 20 permit udp any any counter CountPermits The same applies to IPv6 ACLs. This MIB consists of following tables: * caAclCfgTable Defines the ACLs configured in the device. * caAclIPV4ACECfgTable Defines the ACEs that make up an IPV4 ACL. * caAclIPV6ACECfgTable Defines the ACEs that make up an IPV6 ACL. * caAclAccessGroupCfgTable Defines the Access Control Groups (ACG) applied to interfaces on the device. * caAclLabelIntfStatsTable Defines the statistics for a specific ACE with counter labels attached to interfaces on the device.
Imported Objects
| CISCO-SMI | ciscoMgmt |
| CISCO-TC | CiscoIpProtocol |
| IF-MIB | ifIndex |
| INET-ADDRESS-MIB | InetAddress InetAddressType InetPortNumber |
| SNMP-FRAMEWORK-MIB | SnmpAdminString |
| SNMPv2-CONF | MODULE-COMPLIANCE OBJECT-GROUP |
| SNMPv2-SMI | Counter64 Integer32 MODULE-IDENTITY OBJECT-TYPE Unsigned32 |
| SNMPv2-TC | RowStatus TEXTUAL-CONVENTION |
| OID | Name | Access | Status | Description |
|---|---|---|---|---|
| 1.3.6.1.4.1.9.9.808 | IdentityciscoACLMIB | This MIB module defines objects that describe Cisco Access Control Lists (ACL). This MIB describes different objects that enable the network administrator to r… | ||
| 1.3.6.1.4.1.9.9.808.1 | NodecaAclMIBObjects | |||
| 1.3.6.1.4.1.9.9.808.1.1 | NodecaAclConfiguration | |||
| 1.3.6.1.4.1.9.9.808.1.1.1 | TablecaAclCfgTable | not-accessible | current | A table of ACL definitions. Each entry in this table defines a unique IPV4 or IPV6 ACL. |
| 1.3.6.1.4.1.9.9.808.1.1.1.1 | RowcaAclCfgTableEntry | not-accessible | current | A conceptual row in the caAclTable. Each entry of this table consists of acl index and the address type. This is so that the table may contain both IPV4 and IP… |
| 1.3.6.1.4.1.9.9.808.1.1.1.1.1 | ColumncaAclIndex | not-accessible | current | An arbitrary (system assigned) index for each ACL name. The index is unique for each ACL name in the device, but is further qualified by the address family. Fo… |
| 1.3.6.1.4.1.9.9.808.1.1.1.1.2 | ColumncaAclAddressType | not-accessible | current | This object defines the address family of the ACL. |
| 1.3.6.1.4.1.9.9.808.1.1.1.1.3 | ColumncaAclName | read-create | current | A string that identifies the ACL name. |
| 1.3.6.1.4.1.9.9.808.1.1.1.1.4 | ColumncaAclRowStatus | read-create | current | This object is used to create, modify, or delete an entry in the caAclTable. A row can be created using the 'CreateAndGo' option. When the row is successfully … |
| 1.3.6.1.4.1.9.9.808.1.1.2 | TablecaAclIPV4ACECfgTable | not-accessible | current | A table of IPV4 ACE definitions. The ACE definition controls whether packets are accepted or rejected. The access control may be applied before sending the pac… |
| 1.3.6.1.4.1.9.9.808.1.1.2.1 | RowcaAclIPV4ACECfgTableEntry | not-accessible | current | A conceptual row in the caAclIPV4ACLTable. Each entry of this table consists of a set of match criteria for a given ACL. |
| 1.3.6.1.4.1.9.9.808.1.1.2.1.1 | ColumncaAclIPV4ACESequenceNumber | not-accessible | current | This object uniquely identifies an ACE within an ACL. Sequence numbers are assigned to each permit/deny statement, causing the system to insert the statement i… |
| 1.3.6.1.4.1.9.9.808.1.1.2.1.2 | ColumncaAclIPV4ACEAction | read-create | current | This object indicates the type of action to be taken if the packet matches the given criteria. If it is set to permit(1), all packets matching this ACE will be… |
| 1.3.6.1.4.1.9.9.808.1.1.2.1.3 | ColumncaAclIPV4ACEProtocol | read-create | current | This object identifies the layer 3 protocol type to be filtered by the ACE. Protocol numbers are defined in the Network Working Group Request For Comment docum… |
| 1.3.6.1.4.1.9.9.808.1.1.2.1.4 | ColumncaAclIPV4ACESourceAddress | read-create | current | This object determines the address of the network or host from which the packet is being sent. If this object value is 0.0.0.0 and the value of caAclIPV4ACESou… |
| 1.3.6.1.4.1.9.9.808.1.1.2.1.5 | ColumncaAclIPV4ACESourceWildCardMask | read-create | current | This object determines the mask of wild card address bits for caAclIPV4ACESourceAddress. Wild card masking is to indicate to the system whether to check or ign… |
| 1.3.6.1.4.1.9.9.808.1.1.2.1.6 | ColumncaAclIPV4ACESourceNetworkGroup | read-create | current | This object defines the Source Network Object Group from which the packet is being sent. |
| 1.3.6.1.4.1.9.9.808.1.1.2.1.7 | ColumncaAclIPV4ACESourcePortOperator | read-create | current | This object defines the operation to be performed to the layer source port field. Source port fields are present only for IGMP, ICMP, SCTP, TCP, and UDP protoc… |
| 1.3.6.1.4.1.9.9.808.1.1.2.1.8 | ColumncaAclIPV4ACESourcePort | read-create | current | This object defines the source port number of the layer 4 protocol. This is the field to be matched with the specified source port based on the caAclIPV4ACESou… |
| 1.3.6.1.4.1.9.9.808.1.1.2.1.9 | ColumncaAclIPV4ACESourcePortUpper | read-create | current | This object defines the inclusive upper bound of the layer 4 source port range that is to be matched. |
| 1.3.6.1.4.1.9.9.808.1.1.2.1.10 | ColumncaAclIPV4ACESourcePortGroup | read-create | current | This object defines the Source Port Object Group from which the packet is being sent. |
| 1.3.6.1.4.1.9.9.808.1.1.2.1.11 | ColumncaAclIPV4ACEDestinationAddress | read-create | current | This object determines the address of the network or host to which the packet is being sent. If this object value is 0.0.0.0 and the value of caAclIPV4ACLDesti… |
| 1.3.6.1.4.1.9.9.808.1.1.2.1.12 | ColumncaAclIPV4ACEDestinationWildCardMask | read-create | current | This object determines the mask of wild card address bits for caAclIPV4ACLDestinationAddress. Wild card masking is to indicate to the system whether to check o… |
| 1.3.6.1.4.1.9.9.808.1.1.2.1.13 | ColumncaAclIPV4ACEDestinationNetworkGroup | read-create | current | This object defines the Destination Network Object Group to which the packet is being sent. |
| 1.3.6.1.4.1.9.9.808.1.1.2.1.14 | ColumncaAclIPV4ACEDestinationPortOperator | read-create | current | This object defines the operation to be performed to the layer destination port field. Source port fields are present only for IGMP, ICMP, SCTP, TCP, and UDP p… |
| 1.3.6.1.4.1.9.9.808.1.1.2.1.15 | ColumncaAclIPV4ACEDestinationPort | read-create | current | This object defines the destination port number of the layer 4 protocol. This is the field to be matched with the specified destination port based on the caAcl… |
| 1.3.6.1.4.1.9.9.808.1.1.2.1.16 | ColumncaAclIPV4ACEDestinationPortUpper | read-create | current | This object defines the inclusive upper bound of the layer 4 destination port range that is to be matched. |
| 1.3.6.1.4.1.9.9.808.1.1.2.1.17 | ColumncaAclIPV4ACEDestinationPortGroup | read-create | current | This object defines the Source Port Object Group to which the packet is being sent. |
| 1.3.6.1.4.1.9.9.808.1.1.2.1.18 | ColumncaAclIPV4ACEDscpValue | read-create | current | This object defines the dscp value that will be considered in the match criteria against the value in the packet. |
| 1.3.6.1.4.1.9.9.808.1.1.2.1.19 | ColumncaAclIPV4ACETcpFlagsValue | read-create | current | This object defines the value of the TCP flags which will be considered in the match criteria based on caAclIPV4ACLTcpFlagsMatchType. Users can select any desi… |
| 1.3.6.1.4.1.9.9.808.1.1.2.1.20 | ColumncaAclIPV4ACETcpFlagsMask | read-create | current | This object defines the mask value of the TCP flags field. |
| 1.3.6.1.4.1.9.9.808.1.1.2.1.21 | ColumncaAclIPV4ACETcpFlagsMatchType | read-create | current | This object defines the type of matching to be done on the TCP flags field. |
| 1.3.6.1.4.1.9.9.808.1.1.2.1.22 | ColumncaAclIPV4ACETosValue | read-create | current | This object defines the value of the TOS field to be filtered. Packets can be filtered by the TOS level as specified by a number from 0 to 15. Use the value 16… |
| 1.3.6.1.4.1.9.9.808.1.1.2.1.23 | ColumncaAclIPV4ACEPrecedenceValue | read-create | current | This object indicates the value of the precedence field to be filtered. |
| 1.3.6.1.4.1.9.9.808.1.1.2.1.24 | ColumncaAclIPV4ACELogOption | read-create | current | This object defines the value of the log option field to be applied to packets that match this ACE entry. |
| 1.3.6.1.4.1.9.9.808.1.1.2.1.25 | ColumncaAclIPV4ACECounterLabel | read-create | current | This object defines the counter label name for this ACE. ACEs that share the same counter label name will have their hit counts aggregated into the same counte… |
| 1.3.6.1.4.1.9.9.808.1.1.2.1.26 | ColumncaAclIPV4ACERemark | read-create | current | This object defines a comment in the ACL. It helps the user to define some meaningful comment to identify the ACE quickly, or to know the purpose of a set of A… |
| 1.3.6.1.4.1.9.9.808.1.1.2.1.27 | ColumncaAclIPV4ACERowStatus | read-create | current | This object is used to create, modify, or delete an entry in the caAclIPV4ACLTable. A row can be created using the 'CreateAndGo' option. When the row is succes… |
| 1.3.6.1.4.1.9.9.808.1.1.3 | TablecaAclIPV6ACECfgTable | not-accessible | current | A table of IPV6 ACE definitions. The ACE definition controls whether packets are accepted or rejected. The access control may be applied before sending the pac… |
| 1.3.6.1.4.1.9.9.808.1.1.3.1 | RowcaAclIPV6ACECfgTableEntry | not-accessible | current | A conceptual row in the caAclIPV6ACLTable. Each entry of this table consists of a set of match criteria for a given ACL. |
| 1.3.6.1.4.1.9.9.808.1.1.3.1.1 | ColumncaAclIPV6ACESequenceNumber | not-accessible | current | This object uniquely identifies an ACE within an ACL. Sequence numbers are assigned to each permit/deny statement, causing the system to insert the statement i… |
| 1.3.6.1.4.1.9.9.808.1.1.3.1.2 | ColumncaAclIPV6ACEAction | read-create | current | This object indicates the type of action to be taken if the packet matches the given criteria. If it is set to permit(1), all packets matching this ACE will be… |
| 1.3.6.1.4.1.9.9.808.1.1.3.1.3 | ColumncaAclIPV6ACEProtocol | read-create | current | This object identifies the protocol type to be filtered by the ACE. Protocol numbers are defined in the Network Working Group Request For Comment (RFC) documen… |
| 1.3.6.1.4.1.9.9.808.1.1.3.1.4 | ColumncaAclIPV6ACESourceAddress | read-create | current | This object determines the address of the network or host from which the packet is being sent. If this object value is 0::0 and the value of caAclIPV6ACLSource… |
| 1.3.6.1.4.1.9.9.808.1.1.3.1.5 | ColumncaAclIPV6ACESourcePrefixLength | read-create | current | This object determines the number of bits in the field caAclIPV6ACLSourceAddress to be checked. If the value of this object is 0, then the source address in th… |
| 1.3.6.1.4.1.9.9.808.1.1.3.1.6 | ColumncaAclIPV6ACESourceNetworkGroup | read-create | current | This object defines the Source Network Object Group from which the packet is being sent. |
| 1.3.6.1.4.1.9.9.808.1.1.3.1.7 | ColumncaAclIPV6ACESourcePortOperator | read-create | current | This object defines the operation to be performed to the layer source port field. Source port fields are present only for IGMP, ICMP, SCTP, TCP, and UDP protoc… |
| 1.3.6.1.4.1.9.9.808.1.1.3.1.8 | ColumncaAclIPV6ACESourcePort | read-create | current | This object defines the source port number of the layer 4 protocol. This is the field to be matched with the specified source port based on the caAclIPV6ACLSou… |
| 1.3.6.1.4.1.9.9.808.1.1.3.1.9 | ColumncaAclIPV6ACESourcePortUpper | read-create | current | This object defines the inclusive upper bound of the layer 4 source port range that is to be matched. |
| 1.3.6.1.4.1.9.9.808.1.1.3.1.10 | ColumncaAclIPV6ACESourcePortGroup | read-create | current | This object defines the Source Port Object Group from which the packet is being sent. |
| 1.3.6.1.4.1.9.9.808.1.1.3.1.11 | ColumncaAclIPV6ACEDestinationAddress | read-create | current | This object determines the address of the network or host to which the packet is being sent. If this object value is 0::0 and the value of caAclIPV6ACLSourcePr… |
| 1.3.6.1.4.1.9.9.808.1.1.3.1.12 | ColumncaAclIPV6ACEDestinationPrefixLength | read-create | current | This object determines the number of bits in the field caAclIPV6ACLDestinationAddress to be checked. If the value of this object is 0, then the source address … |
| 1.3.6.1.4.1.9.9.808.1.1.3.1.13 | ColumncaAclIPV6ACEDestinationNetworkGroup | read-create | current | This object defines the Source Network Object Group to which the packet is being sent. |
| 1.3.6.1.4.1.9.9.808.1.1.3.1.14 | ColumncaAclIPV6ACEDestinationPortOperator | read-create | current | This object defines the operation to be performed to the layer destination port field. Source port fields are present only for IGMP, ICMP, SCTP, TCP, and UDP p… |
| 1.3.6.1.4.1.9.9.808.1.1.3.1.15 | ColumncaAclIPV6ACEDestinationPort | read-create | current | This object defines the destination port number of the layer 4 protocol. This is the field to be matched with the specified destination port based on the caAcl… |
| 1.3.6.1.4.1.9.9.808.1.1.3.1.16 | ColumncaAclIPV6ACEDestinationPortUpper | read-create | current | This object defines the inclusive upper bound of the layer 4 destination port range that is to be matched. |
| 1.3.6.1.4.1.9.9.808.1.1.3.1.17 | ColumncaAclIPV6ACEDestinationPortGroup | read-create | current | This object defines the Source Port Object Group to which the packet is being sent. |
| 1.3.6.1.4.1.9.9.808.1.1.3.1.18 | ColumncaAclIPV6ACETrafficClassValue | read-create | current | This object defines the traffic class value that will be considered in the match criteria against the value in the packet. |
| 1.3.6.1.4.1.9.9.808.1.1.3.1.19 | ColumncaAclIPV6ACETcpFlagsValue | read-create | current | This object defines the value of the TCP flags which will be considered in the match criteria based on caAclIPV6ACLTcpFlagsMatchType. Users can select any desi… |
| 1.3.6.1.4.1.9.9.808.1.1.3.1.20 | ColumncaAclIPV6ACETcpFlagsMask | read-create | current | This object defines the mask value of the TCP flags field. |
| 1.3.6.1.4.1.9.9.808.1.1.3.1.21 | ColumncaAclIPV6ACETcpFlagsMatchType | read-create | current | This object defines the type of matching to be done on the TCP flags field. |
| 1.3.6.1.4.1.9.9.808.1.1.3.1.22 | ColumncaAclIPV6ACELogOption | read-create | current | This object defines the value of the log option field to be applied to packets that match this ACE entry. |
| 1.3.6.1.4.1.9.9.808.1.1.3.1.23 | ColumncaAclIPV6ACECounterLabel | read-create | current | This object defines the counter label name for this ACE. ACEs that share the same counter label name will have their hit counts aggregated into the same counte… |
| 1.3.6.1.4.1.9.9.808.1.1.3.1.24 | ColumncaAclIPV6ACERemark | read-create | current | This object defines a comment in the ACL. It helps the user to define some meaningful comment to identify the ACE quickly, or to know the purpose of a set of A… |
| 1.3.6.1.4.1.9.9.808.1.1.3.1.25 | ColumncaAclIPV6ACERowStatus | read-create | current | This object is used to create, modify, or delete an entry in the caAclIPV6ACLTable. A row can be created using the 'CreateAndGo' option. When the row is succes… |
| 1.3.6.1.4.1.9.9.808.1.1.4 | TablecaAclAccessGroupCfgTable | not-accessible | current | This table lists the ACLs configured on the device and applied on an interface in the ingress or egress direction. |
| 1.3.6.1.4.1.9.9.808.1.1.4.1 | RowcaAclAccessGroupCfgEntry | not-accessible | current | This entry describes an ACL configured on the device and applied to an interface. |
| 1.3.6.1.4.1.9.9.808.1.1.4.1.1 | ColumncaAclAccessGroupACL | read-create | current | The name of the ACL associated with this entry. |
| 1.3.6.1.4.1.9.9.808.1.1.4.1.2 | ColumncaAclAccessGroupCfgAddressType | not-accessible | current | This entry describes the address family of the access group being applied on the interface. |
| 1.3.6.1.4.1.9.9.808.1.1.4.1.3 | ColumncaAclAccessGroupDirection | not-accessible | current | This object defines the direction in which the ACL is applied. |
| 1.3.6.1.4.1.9.9.808.1.1.4.1.4 | ColumncaAclAccessGroupSequenceNumber | not-accessible | current | This object uniquely identifies the order that Access Group applied to a interface. It can be used by platforms that support applying more than one Access List… |
| 1.3.6.1.4.1.9.9.808.1.1.4.1.5 | ColumncaAclAccessGroupRowStatus | read-create | current | This object is used to create, modify, or delete an entry in the caAclAccessGroupCfgTable. A row can be created using the 'CreateAndGo' option. When the row is… |
| 1.3.6.1.4.1.9.9.808.1.2 | NodecaAclStats | |||
| 1.3.6.1.4.1.9.9.808.1.2.1 | TablecaAclLabelIntfStatsTable | not-accessible | current | This table describes the statistics for all ACEs with assigned counter labels, attached to interfaces on the device. An entry in this table is created when an … |
| 1.3.6.1.4.1.9.9.808.1.2.1.1 | RowcaAclLabelIntfStatsEntry | not-accessible | current | Each entry in this table provides the aggregated counters for all ACEs applied on the given interface/direction that have been assigned the same counter label. |
| 1.3.6.1.4.1.9.9.808.1.2.1.1.1 | ColumncaAclIntfStatsCounterLabelName | not-accessible | current | The counter label index associated with this set of statistics. |
| 1.3.6.1.4.1.9.9.808.1.2.1.1.2 | ColumncaAclIntfStatsPackets | read-only | current | The total number of packets that match this counter label. |
| 1.3.6.1.4.1.9.9.808.1.2.1.1.3 | ColumncaAclIntfStatsOctets | read-only | current | The total number of octets that match this counter label. |
| 1.3.6.1.4.1.9.9.808.2 | NodecaAclMIBConformance | |||
| 1.3.6.1.4.1.9.9.808.2.1 | NodecaAclMIBACEConform | |||
| 1.3.6.1.4.1.9.9.808.2.1.1 | NodecaAclMIBACECompliances | |||
| 1.3.6.1.4.1.9.9.808.2.1.1.1 | CompliancecaAclMIBCompliance | read-only | current | This compliance statement specifies the minimal requirements that an implementation must meet in order to claim full compliance with the definitions of the C-A… |
| 1.3.6.1.4.1.9.9.808.2.1.2 | NodecaAclMIBCfgGroups | |||
| 1.3.6.1.4.1.9.9.808.2.1.2.1 | GroupcaAclMIBCfgGroup | current | This group contains objects describing ACLs. | |
| 1.3.6.1.4.1.9.9.808.2.1.2.2 | GroupcaAclIPV4ACLMIBACEGroup | current | This group is a collection of objects providing IPV4 ACE feature. | |
| 1.3.6.1.4.1.9.9.808.2.1.2.3 | GroupcaAclIPV6ACLMIBACEGroup | current | This group is a collection of objects providing IPV6 ACE feature. | |
| 1.3.6.1.4.1.9.9.808.2.1.2.4 | GroupcaAclMIBAccessGroupCfgGroup | current | This group contains the objects describing the access group configuration. | |
| 1.3.6.1.4.1.9.9.808.2.1.2.5 | GroupcaAclMIBCounterGroup | current | This group contains the objects describing the ACE counter label. |
Type Definitions
| Name | Syntax | Status | Description |
|---|---|---|---|
| CaAclACLIndex | Unsigned32 (1..4294967295) | current | A unique value, greater than zero, for each ACL name in the managed system. It is recommended that these values be assigned contiguously starting from 1. The value for each ACL name must remains constant at least from o… |
| CaAclAction | INTEGER { permit(1), deny(2) } | current | Enumeration value indicating the action to be taken on packets that match the ACE. permit(1) the packet will be considered for further processing. deny(2) the packet will be dropped without any further processing. |
| CaAclLogOption | INTEGER { log(1), logInput(2) } | current | Enumeration value indicating the log option that is to be applied to an ACE. Currently the options are log-input and log. The difference between log and logInput is that logInput logs all the information as in log, with… |
| CaAclPortOperator | INTEGER { lt(1), gt(2), eq(3), neq(4), range(5) } | current | This textual convention represents the operator that will be applied on the transport layer source/destination ports. The port in packets to be filtered and the port (or port range in case of range(5)). lt(1) - match po… |
| CaAclPrecedenceValue | INTEGER { routine(0), priority(1), immediate(2), flash(3), flashOverride(4), critical(5), internet(6), network(7) } | current | An enumeration value indicating the value of the precedence field. It is specified as a number between 0 and 7, as defined in RFC-791. |
| CaAclSequenceNumber | Unsigned32 (1..4294967295) | current | A unsigned 32-bit integer value. |
| CaAclTcpFlagsMatch | INTEGER { matchAny(1), matchAll(2), matchNone(3) } | current | An enumeration value indicating the type of matching that is to be done on the TCP flags field of the packet, providing that the packet being filtered is a TCP packet. matchAny(1) - take caAclAction if any of TCP flags … |
| CaAclTrafficDirection | INTEGER { ingress(1), egress(2) } | current | Enumeration value indicating the direction of the ACL ingress - in the ingress (input) direction, egress - in the egress (output) direction. |