CISCO-LWAPP-ROGUE-MIB
81 objects
This MIB is intended to be implemented on all those devices operating as Central Controllers, that terminate the Light Weight Access Point Protocol tunnel from Cisco Light-weight LWAPP Access Points. This MIB provides information about the Rogue APs and Clients that are detected by the controller. The relationship between CC and the LWAPP APs can be depicted as follows: +......+ +......+ +......+ + + + + + + + CC + + CC + + CC + + + + + + + +......+ +......+ +......+ .. . . .. . . . . . . . . . . . . . . . . . . +......+ +......+ +......+ +......+ + + + + + + + + + AP + + AP + + AP + + AP + + + + + + + + + +......+ +......+ +......+ +......+ . . . . . . . . . . . . . . . . . . . +......+ +......+ +......+ +......+ + + + + + + + + + MN + + MN + + MN + + MN + + + + + + + + + +......+ +......+ +......+ +......+ The LWAPP tunnel exists between the controller and the APs. The MNs communicate with the APs through the protocol defined by the 802.11 standard. LWAPP APs, upon bootup, discover and join one of the controllers and the controller pushes the configuration, that includes the WLAN parameters, to the LWAPP APs. The APs then encapsulate all the 802.11 frames from wireless clients inside LWAPP frames and forward the LWAPP frames to the controller. GLOSSARY Access Point ( AP ) An entity that contains an 802.11 medium access control ( MAC ) and physical layer ( PHY ) interface and provides access to the distribution services via the wireless medium for associated clients. LWAPP APs encapsulate all the 802.11 frames in LWAPP frames and sends them to the controller to which it is logically connected. Light Weight Access Point Protocol ( LWAPP ) This is a generic protocol that defines the communication between the Access Points and the Central Controller. Mobile Node ( MN ) A roaming 802.11 wireless device in a wireless network associated with an access point. Mobile Node and client are used interchangeably. Rogue Any 802.11 device which is not part of the RF network is a Rogue device. Ad-hoc Network A set of mobile devices within direct communication range establishing a network among themselves for transmitting data, without the use of a Access point is called a ad-hoc network. Rogue Ad-hoc Client Any 802.11 client which is part of that ad-hoc network, but not in the trusted list. Service Set Identifier ( SSID ) SSID is a unique identifier that APs and clients use to identify with each other. SSID is a simple means of access control and is not for security. The SSID can be any alphanumeric entry up to 32 characters. RSSI Received Signal Strength Indication (RSSI), the IEEE 802.11 standard defines a mechanism by which RF energy is to be measured by the circuitry on a wireless NIC. Its value is measured in dBm and ranges from -128 to 0. Rogue Location Detection Protocol (RLDP) RLDP is a protocol to detect and automatically contain rogue devices. When the controller discovers a rogue access point, it uses the Rogue Location Discovery Protocol (RLDP) to determine if the rogue is attached to your network. RLDP can be enabled/disabled per controller level. REFERENCE [1] Wireless LAN Medium Access Control ( MAC ) and Physical Layer ( PHY ) Specifications. [2] Draft-obara-capwap-lwapp-00.txt, IETF Light Weight Access Point Protocol.
Imported Objects
| CISCO-LWAPP-AP-MIB | cLApDot11IfType cLApDot11RadioChannelNumber cLApDot11RadioMACAddress cLApIfSmtDot11Bssid cLApName cLApRogueApMacAddress cLApRogueDetectedChannel |
| CISCO-LWAPP-DOT11-CLIENT-MIB | cldcClientMacAddress |
| CISCO-SMI | ciscoMgmt |
| SNMP-FRAMEWORK-MIB | SnmpAdminString |
| SNMPv2-CONF | MODULE-COMPLIANCE NOTIFICATION-GROUP OBJECT-GROUP |
| SNMPv2-SMI | Integer32 MODULE-IDENTITY NOTIFICATION-TYPE OBJECT-TYPE Unsigned32 |
| SNMPv2-TC | MacAddress RowStatus StorageType TEXTUAL-CONVENTION TruthValue |
| OID | Name | Access | Status | Description |
|---|---|---|---|---|
| 1.3.6.1.4.1.9.9.610 | IdentityciscoLwappRogueMIB | This MIB is intended to be implemented on all those devices operating as Central Controllers, that terminate the Light Weight Access Point Protocol tunnel from… | ||
| 1.3.6.1.4.1.9.9.610.0 | NodeciscoLwappRogueMIBNotifs | |||
| 1.3.6.1.4.1.9.9.610.0.1 | NotificationcLRogueAdhocRogueDetected | current | This notification is generated by the controller when a a rogue is detected. The name of the AP that detected this rogue is sent in the notification. | |
| 1.3.6.1.4.1.9.9.610.0.2 | NotificationcLRogueClientExceededThreshold | current | This notification is generated by the controller when a rogue client exceeds its maximum threshold configured. The details of Rogue AP and Rogue Clients is sen… | |
| 1.3.6.1.4.1.9.9.610.0.3 | NotificationcLRogueExceededClientRemovedThreshold | current | This notification is generated by the controller when a rogue client is removed from the rogue AP and still the client count of the rogue AP is greater than th… | |
| 1.3.6.1.4.1.9.9.610.0.4 | NotificationcLRogueApRuleContained | current | This notification is generated by the controller when a rogue AP is contained due to Rogue Rule. | |
| 1.3.6.1.4.1.9.9.610.1 | NodeciscoLwappRogueMIBObjects | |||
| 1.3.6.1.4.1.9.9.610.1.1 | NodecLRogueConfig | |||
| 1.3.6.1.4.1.9.9.610.1.1.1 | NodecLRoguePolicyConfig | |||
| 1.3.6.1.4.1.9.9.610.1.1.1.1 | ScalarcLRogueAdhocRogueReportEnable | read-write | current | This object is used to turn on and off ad-hoc rogue reporting. Setting this object to 'true' will enable ad-hoc rogue reporting. Setting to 'false' will disabl… |
| 1.3.6.1.4.1.9.9.610.1.1.1.2 | ScalarcLRogueReportInterval | read-write | current | This object specifies the rogue report interval, which is the interval that monitor mode APs send rogue detection details to the controller. |
| 1.3.6.1.4.1.9.9.610.1.1.1.3 | ScalarcLRogueMinimumRssi | read-write | current | This object specifies the minimum value of RSSI considered for detection of rogues. |
| 1.3.6.1.4.1.9.9.610.1.1.1.4 | ScalarcLRogueTransientInterval | read-write | current | This object specifies the rogue transient interval. A value of '0' specifies that an AP sends rogue detection details to the controller as soon as it detects a… |
| 1.3.6.1.4.1.9.9.610.1.1.1.5 | ScalarcLRogueClientNumThreshold | read-write | current | This object specifies the number of clients the Rogue AP can have once the limit is reached traps are sent for intimation. Default '0' is to disable the trap. |
| 1.3.6.1.4.1.9.9.610.1.1.1.6 | ScalarcLRogueDetectionSecurityLevel | read-write | current | This object specifies the rogue detection security level. Controller selects rogue detection parameters automatically when set to any other option other than '… |
| 1.3.6.1.4.1.9.9.610.1.1.1.7 | ScalarcLRogueValidateRogueClientsAgainstMSE | read-write | current | This flag should be turned on to allow the controller to validate 'valid' clients which are associating with rogue ap, against MSE. |
| 1.3.6.1.4.1.9.9.610.1.1.2 | ScalarcLRogueAdhocRogueNotifEnabled | read-write | current | The object to control the generation of cLRogueAdhocDetected notification. A value of 'true' indicates that the agent generates cLRogueAdhocDetected notificati… |
| 1.3.6.1.4.1.9.9.610.1.1.3 | NodecLRogueRuleConfig | |||
| 1.3.6.1.4.1.9.9.610.1.1.3.1 | TablecLRuleConfigTable | not-accessible | current | This table provides the configuration needed by the controller for classifying rogue APs. The user defines the custom rules which are used to classify the APs … |
| 1.3.6.1.4.1.9.9.610.1.1.3.1.1 | RowcLRuleConfigEntry | not-accessible | current | Each entry represents a conceptual row (as identified by a rule name)in cLRuleConfigTable. |
| 1.3.6.1.4.1.9.9.610.1.1.3.1.1.1 | ColumncLRuleName | not-accessible | current | This object represents the rule name to identify this entry. |
| 1.3.6.1.4.1.9.9.610.1.1.3.1.1.2 | ColumncLRuleRogueType | read-create | current | This object determines the classification applied to the rogue AP that matches this rule. friendly - known and acknowledged rogue AP malicious - unknown AP tha… |
| 1.3.6.1.4.1.9.9.610.1.1.3.1.1.3 | ColumncLRuleConditionsMatch | read-create | current | This object represents how the conditions defined by corresponding instances of cLConditionType, are matched under each rule. all - all the conditions defined … |
| 1.3.6.1.4.1.9.9.610.1.1.3.1.1.4 | ColumncLRulePriority | read-create | current | This object is used to define the order in which the rules will be applied. The rules will be applied from lowest to highest and gaps are allowed. Each rule mu… |
| 1.3.6.1.4.1.9.9.610.1.1.3.1.1.5 | ColumncLRuleEnable | read-create | current | This object specifies whether this rule is enabled or not. A value of 'true' specifies this rule is enabled. A value of 'false' specifies this rule is disabled. |
| 1.3.6.1.4.1.9.9.610.1.1.3.1.1.6 | ColumncLRuleStorageType | read-create | current | This object represents the storage type for this conceptual row. |
| 1.3.6.1.4.1.9.9.610.1.1.3.1.1.7 | ColumncLRuleRowStatus | read-create | current | This object represents the status column for a conceptual row in this table. All writable objects in this row may be modified when the row is active. |
| 1.3.6.1.4.1.9.9.610.1.1.3.1.1.8 | ColumncLRuleSeverityScore | read-create | current | This object is used to define the custom classification severity score of the rules. This object is applicable when cLRuleRogueType is configured as 'custom'. |
| 1.3.6.1.4.1.9.9.610.1.1.3.1.1.9 | ColumncLRuleClassificationName | read-write | current | This object represents the rule classification name. This object is applicable when cLRuleRogueType is configured as 'custom'. |
| 1.3.6.1.4.1.9.9.610.1.1.3.1.1.10 | ColumncLRuleNotifyType | read-create | current | This object represents how the notification is defined for the rogue rule. global - Configure notification to trap receiver only. local - Configure notificatio… |
| 1.3.6.1.4.1.9.9.610.1.1.3.1.1.11 | ColumncLRuleStateType | read-create | current | This object represents the rule to configure state of the rogue. alert - Configure alert state on rogue ap. contain - Configure contain state on rogue ap. inte… |
| 1.3.6.1.4.1.9.9.610.1.1.3.2 | TablecLConditionConfigTable | not-accessible | current | This table represents the configuration of conditions that can be applied to a rule. |
| 1.3.6.1.4.1.9.9.610.1.1.3.2.1 | RowcLConditionConfigEntry | not-accessible | current | Each entry represents a conceptual row in cLConditionConfigTable, as identified by a specific condition name to be applied on a specific rule name. |
| 1.3.6.1.4.1.9.9.610.1.1.3.2.1.1 | ColumncLConditionName | not-accessible | current | This object represents the condition name. |
| 1.3.6.1.4.1.9.9.610.1.1.3.2.1.2 | ColumncLConditionType | read-create | current | This object represents the condition type for this condition associated with a rule. managedSsid - matches managed SSID rssi - required minimum RSSI duration -… |
| 1.3.6.1.4.1.9.9.610.1.1.3.2.1.3 | ColumncLConditionValue | read-create | current | This object represents the value associated with the condition type as specified by the corresponding cLConditionType instance. If cLConditionType is 'userConf… |
| 1.3.6.1.4.1.9.9.610.1.1.3.2.1.4 | ColumncLConditionEnable | read-create | current | This object indicates whether matching against this condition is enabled or not. A value of 'true' indicates matching against this condition is enabled. A valu… |
| 1.3.6.1.4.1.9.9.610.1.1.3.2.1.5 | ColumncLConditionStorageType | read-create | current | This object represents the storage type for this conceptual row. |
| 1.3.6.1.4.1.9.9.610.1.1.3.2.1.6 | ColumncLConditionRowStatus | read-create | current | This object represents the status column for a conceptual row in this table. All writable objects except cLConditionType in this row may be modified when the r… |
| 1.3.6.1.4.1.9.9.610.1.1.3.3 | TablecLConditionSsidConfigTable | not-accessible | current | This table represents the configuration of SSID for a rule. This is applicable to conditions within a rule which has the corresponding cLConditionType taking o… |
| 1.3.6.1.4.1.9.9.610.1.1.3.3.1 | RowcLConditionSsidConfigEntry | not-accessible | current | Each entry represents a conceptual row in cLConditionSsidConfigTable. |
| 1.3.6.1.4.1.9.9.610.1.1.3.3.1.1 | ColumncLConditionSsidValue | not-accessible | current | This object represents the SSID value for this condition associated with a rule. |
| 1.3.6.1.4.1.9.9.610.1.1.3.3.1.2 | ColumncLConditionSsidStorageType | read-create | current | This object represents the storage type for this conceptual row. |
| 1.3.6.1.4.1.9.9.610.1.1.3.3.1.3 | ColumncLConditionSsidRowStatus | read-create | current | This object represents the status column for a conceptual row in this table. All writable objects in this row may not be modified when the row is active. |
| 1.3.6.1.4.1.9.9.610.1.1.3.3.1.4 | ColumncLConditionSsidType | read-create | current | This object represents the storage type for this conceptual row. |
| 1.3.6.1.4.1.9.9.610.1.1.4 | NodecLRogueIgnoreListConfig | |||
| 1.3.6.1.4.1.9.9.610.1.1.4.1 | TablecLRogueIgnoreListTable | not-accessible | current | The table lists the APs, as identified by the AP's mac address, which should not be treated as rogue by the controller. These APs are the autonomous access poi… |
| 1.3.6.1.4.1.9.9.610.1.1.4.1.1 | RowcLRogueIgnoreListEntry | not-accessible | current | Each entry represents a conceptual row in this table. There will be a row for each entry of the autonomous APs which are manually added to WCS. When the autono… |
| 1.3.6.1.4.1.9.9.610.1.1.4.1.1.1 | ColumncLRogueIgnoreListMACAddress | not-accessible | current | This is the MAC Address of the AP to be put in the rogue ignore list. |
| 1.3.6.1.4.1.9.9.610.1.1.4.1.1.2 | ColumncLRogueIgnoreListStorageType | read-create | current | This object represents the storage type for this conceptual row. |
| 1.3.6.1.4.1.9.9.610.1.1.4.1.1.3 | ColumncLRogueIgnoreListRowStatus | read-create | current | This is the status of the conceptual row. All writable objects in this row may not be modified when the row is active. |
| 1.3.6.1.4.1.9.9.610.1.1.5 | NodecLRldpAutoContainConfig | |||
| 1.3.6.1.4.1.9.9.610.1.1.5.1 | ScalarcLRldpAutoContainFeatureOnWiredNetwork | read-write | current | This object represents the RLDP Auto contain feature status. disable - automatic containment of rogues on wired network is disabled enable - automatic containm… |
| 1.3.6.1.4.1.9.9.610.1.1.5.2 | ScalarcLRldpAutoContainRoguesAdvertisingSsid | read-write | current | This is the action with respect to auto containment feature, that should be taken when switch detects rogues that are advertising our SSID. NOTE: Using this fe… |
| 1.3.6.1.4.1.9.9.610.1.1.5.3 | ScalarcLRldpAutoContainAdhocNetworks | read-write | current | This is the action with respect to auto containment feature, that should be taken when adhoc networks are detected by the switch. NOTE: Using this feature may … |
| 1.3.6.1.4.1.9.9.610.1.1.5.4 | ScalarcLRldpAutoContainTrustedClientsOnRogueAps | read-write | current | This is the action with respect to auto containment feature, that should be taken when trusted clients that are associated to rogue APs are detected by the swi… |
| 1.3.6.1.4.1.9.9.610.1.1.5.5 | ScalarcLRldpAutoContainLevel | read-write | current | This object is used to specify the level of auto containment. The level actually denotes the number of APs that should be used by the controller for auto conta… |
| 1.3.6.1.4.1.9.9.610.1.1.5.6 | ScalarcLRldpAutoContainOnlyforMonitorModeAps | read-write | current | This object is used to specify if auto containment should be done only using monitor mode APs or not. disable - auto containment will be done using all APs irr… |
| 1.3.6.1.4.1.9.9.610.1.1.5.7 | ScalarcLRldpAutoContainFlexStandaloneAp | read-write | current | This object is used to specify if auto containment should be done on FlexConnect standalone APs. disable - auto containment will not be done on FlexConnect sta… |
| 1.3.6.1.4.1.9.9.610.1.1.6 | NodecLRogueApConfig | |||
| 1.3.6.1.4.1.9.9.610.1.1.6.1 | TablecLRogueApTable | not-accessible | current | Rogue Table. This table lists all the Rogue APs detected by Airespace APs. |
| 1.3.6.1.4.1.9.9.610.1.1.6.1.1 | RowcLRogueApEntry | not-accessible | current | An Entry in cLRogueApTable. |
| 1.3.6.1.4.1.9.9.610.1.1.6.1.1.1 | ColumncLRogueApMacAddress | not-accessible | current | MAC Address of the rogue AP Interface. |
| 1.3.6.1.4.1.9.9.610.1.1.6.1.1.2 | ColumncLRogueApSeverityScore | read-only | current | The severity score of the AP Interface. |
| 1.3.6.1.4.1.9.9.610.1.1.6.1.1.3 | ColumncLRogueApRuleName | read-only | current | This object represents the rule name that is applied. |
| 1.3.6.1.4.1.9.9.610.1.1.6.1.1.4 | ColumncLRogueApClassName | read-only | current | This object represents the class name that is applied. |
| 1.3.6.1.4.1.9.9.610.2 | NodeciscoLwappRogueMIBConform | |||
| 1.3.6.1.4.1.9.9.610.2.1 | NodeciscoLwappRogueMIBCompliances | |||
| 1.3.6.1.4.1.9.9.610.2.1.1 | ComplianceciscoLwappRogueMIBCompliance | deprecated | The compliance statement for the SNMP entities that implement the ciscoLwappRogueMIB module. | |
| 1.3.6.1.4.1.9.9.610.2.1.2 | ComplianceciscoLwappRogueMIBComplianceRev1 | read-only | deprecated | The compliance statement for the SNMP entities that implement the ciscoLwappRogueMIB module. |
| 1.3.6.1.4.1.9.9.610.2.1.3 | ComplianceciscoLwappRogueMIBComplianceRev2 | read-only | deprecated | The compliance statement for the SNMP entities that implement the ciscoLwappRogueMIB module. |
| 1.3.6.1.4.1.9.9.610.2.1.4 | ComplianceciscoLwappRogueMIBComplianceRev3 | read-only | current | The compliance statement for the SNMP entities that implement the ciscoLwappRogueMIB module. |
| 1.3.6.1.4.1.9.9.610.2.2 | NodeciscoLwappRogueMIBGroups | |||
| 1.3.6.1.4.1.9.9.610.2.2.1 | GroupciscoLwappRogueConfigGroup | current | This collection of objects represent the rogue configuration on the controller. | |
| 1.3.6.1.4.1.9.9.610.2.2.2 | GroupciscoLwappRogueNotifsGroup | current | This collection of objects specifies the notifications for rogue detection. | |
| 1.3.6.1.4.1.9.9.610.2.2.3 | GroupciscoLwappRogueConfigSup1Group | deprecated | This collection of objects represent the rogue configuration on the controller. ciscoLwappRogueConfigSup1Group object is superseded by ciscoLwappRogueConfigSup… | |
| 1.3.6.1.4.1.9.9.610.2.2.4 | GroupciscoLwappRogueConfigSup2Group | deprecated | This collection of objects represent the rogue configuration on the controller. ciscoLwappRogueConfigSup2Group object is superseded by ciscoLwappRogueConfigSup… | |
| 1.3.6.1.4.1.9.9.610.2.2.5 | GroupciscoLwappRogueConfigSup3Group | current | This collection of objects represent the rogue configuration on the controller. | |
| 1.3.6.1.4.1.9.9.610.3 | NodeciscoLwappRogueMIBNotifObjects | |||
| 1.3.6.1.4.1.9.9.610.3.1 | ScalarcLRogueApContainmentLevel | accessible-for-notify | current | This object specifies the state of the rogue contained, Higher the level of containment, more the number of detecting APs that are used to contain it. Value be… |
Type Definitions
| Name | Syntax | Status | Description |
|---|---|---|---|
| CLAutoContainActions | INTEGER { alarmOnly(1), contain(2) } | current | This textual convention represents the action that should be taken with respect to auto containment feature when any of the following are detected by the switch: rogue adhoc network rogues APs that are advertising our S… |