Graham McIntire
b4f8b40b7f
- Remove PVC volume mount from k8s/deployment.yaml - Delete k8s/mib-pvc.yaml (no longer needed) - Update .gitignore to commit MIB files to git - Add mix import_mibs task to copy MIBs from LibreNMS - Add all MIB files from priv/mibs/ to git This fixes the multi-attach volume error in Kubernetes where new pods couldn't start because the RWO (ReadWriteOnce) PVC was attached to the old pod. MIBs are now part of the Docker image and can be used by all pods simultaneously.
393 lines
13 KiB
Text
393 lines
13 KiB
Text
JUNIPER-SECURE-ACCESS-PORT-MIB DEFINITIONS ::= BEGIN
|
|
|
|
IMPORTS
|
|
MODULE-IDENTITY, OBJECT-TYPE, Unsigned32,
|
|
NOTIFICATION-TYPE, Integer32
|
|
FROM SNMPv2-SMI
|
|
|
|
TruthValue, TEXTUAL-CONVENTION, DisplayString
|
|
FROM SNMPv2-TC
|
|
|
|
ifIndex
|
|
FROM IF-MIB
|
|
|
|
jnxExSecureAccessPort
|
|
FROM JUNIPER-EX-SMI;
|
|
|
|
jnxExSecureAccessPortMIB MODULE-IDENTITY
|
|
LAST-UPDATED "200705151000Z"
|
|
ORGANIZATION "Juniper Networks, Inc."
|
|
CONTACT-INFO
|
|
" Juniper Technical Assistance Center
|
|
Juniper Networks, Inc.
|
|
1133 Innovation Way
|
|
Sunnyvale, CA 94089
|
|
E-mail: support@juniper.net"
|
|
|
|
DESCRIPTION
|
|
"This is Juniper Networks' implementation of enterprise specific
|
|
MIB for configuration of Secure Access Port feature. DHCP Snooping
|
|
and Dynamic ARP Inspection are mechanisms to provide per interface
|
|
security capabilities. This MIB Module is also used to control
|
|
some layer 2 functions like MAC limiting. It also supports
|
|
IP Source Guard, Mac Source Guard and Storm Control features."
|
|
::= { jnxExSecureAccessPort 1 }
|
|
|
|
|
|
jnxSecAccessPortMIBNotifications
|
|
OBJECT IDENTIFIER ::= { jnxExSecureAccessPortMIB 0 }
|
|
jnxSecAccessPortMIBObjects
|
|
OBJECT IDENTIFIER ::= { jnxExSecureAccessPortMIB 1 }
|
|
|
|
-- TEXTUAL-CONVENTION
|
|
|
|
JnxMacLimitExceededAction ::= TEXTUAL-CONVENTION
|
|
STATUS current
|
|
DESCRIPTION
|
|
"One of the following action will be taken by the system
|
|
on an interface, when the system detects the current learned
|
|
number of MAC addresses in the forwarding table has exceeded
|
|
the limit number of MAC address.
|
|
|
|
none : No action will be taken. It means Mac limit is not
|
|
enabled in the specified interface.
|
|
|
|
drop : The notification will be generated when MAC limit is
|
|
exceeded and also the MAC limit is enforced for the interface.
|
|
The new address will not be learned in the entity and also the
|
|
traffic with new address will not be flooded in the entity.
|
|
The learning will be re-enabled in the interface if the number
|
|
of MAC addresses falls below the limit.
|
|
|
|
alarm : A notification will be generated if the Mac Limit is
|
|
exceeded.
|
|
|
|
shutdown : The notification will be generated as the Mac Limit is
|
|
exceeded. The interface will be moved to blocked state, no traffic
|
|
will be allowed in the entity. The traffic will be re-enabled in
|
|
the interface if the number of MAC addresses falls below the limit."
|
|
SYNTAX INTEGER {
|
|
none (1),
|
|
drop (2),
|
|
alarm (3),
|
|
shutdown (4)
|
|
}
|
|
|
|
-- The Port Security Table for Vlan
|
|
|
|
jnxSecAccessPortVlanTable OBJECT-TYPE
|
|
SYNTAX SEQUENCE OF JnxSecAccessPortVlanEntry
|
|
MAX-ACCESS not-accessible
|
|
STATUS current
|
|
DESCRIPTION
|
|
"A table provides the mechanism to control DHCP Snooping
|
|
and Dynamic ARP Inspection per VLAN. When a VLAN is created
|
|
in a device supporting this table, a corresponding entry will
|
|
be added to this table."
|
|
::= { jnxSecAccessPortMIBObjects 1 }
|
|
|
|
jnxSecAccessPortVlanEntry OBJECT-TYPE
|
|
SYNTAX JnxSecAccessPortVlanEntry
|
|
MAX-ACCESS not-accessible
|
|
STATUS current
|
|
DESCRIPTION
|
|
"A row instance contains whether DHCP Snooping and Dynamic
|
|
ARP Inspection at each existing VLAN is enabled or disabled."
|
|
INDEX { jnxSecAccessVlanName }
|
|
::= { jnxSecAccessPortVlanTable 1 }
|
|
|
|
JnxSecAccessPortVlanEntry ::= SEQUENCE {
|
|
jnxSecAccessVlanName DisplayString,
|
|
jnxSecAccessVlanDhcpSnoopStatus TruthValue,
|
|
jnxSecAccessVlanDAIStatus TruthValue
|
|
}
|
|
|
|
jnxSecAccessVlanName OBJECT-TYPE
|
|
SYNTAX DisplayString (SIZE(0..255))
|
|
MAX-ACCESS not-accessible
|
|
STATUS current
|
|
DESCRIPTION
|
|
"This object indicates the VLAN name on which Dhcp Snooping
|
|
feature and Dynamic ARP Inspection is enabled."
|
|
::= { jnxSecAccessPortVlanEntry 1 }
|
|
|
|
jnxSecAccessVlanDhcpSnoopStatus OBJECT-TYPE
|
|
SYNTAX TruthValue
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"This object indicates whether Dhcp Snooping is
|
|
enabled in this VLAN.
|
|
|
|
If this object is 'true', Dhcp Snooping is enabled in the
|
|
specified VLAN.
|
|
|
|
If this object is 'false', Dhcp Snooping is disabled in the
|
|
specified VLAN."
|
|
::= { jnxSecAccessPortVlanEntry 2 }
|
|
|
|
jnxSecAccessVlanDAIStatus OBJECT-TYPE
|
|
SYNTAX TruthValue
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"This object indicates whether Dynamic ARP Inspection is
|
|
enabled in this VLAN.
|
|
|
|
If this object is 'true', Dynamic ARP Inspection is enabled.
|
|
|
|
If this object is 'false', Dynamic ARP Inspection is disabled."
|
|
::= { jnxSecAccessPortVlanEntry 3 }
|
|
|
|
|
|
-- The Port Security Table for Interface
|
|
|
|
jnxSecAccessPortIfTable OBJECT-TYPE
|
|
SYNTAX SEQUENCE OF JnxSecAccessPortIfEntry
|
|
MAX-ACCESS not-accessible
|
|
STATUS current
|
|
DESCRIPTION
|
|
"The table contains the trust state and rate limit of each interface
|
|
for DHCP Snooping purpose. The table also contains information on MAC
|
|
address limit feature for each interface capable of this feature.
|
|
This table also specifies whether IP source guard and MAC source
|
|
guard are enabled on each interface."
|
|
::= { jnxSecAccessPortMIBObjects 2 }
|
|
|
|
jnxSecAccessPortIfEntry OBJECT-TYPE
|
|
SYNTAX JnxSecAccessPortIfEntry
|
|
MAX-ACCESS not-accessible
|
|
STATUS current
|
|
DESCRIPTION
|
|
"A table entry contains the trust state and rate limit of an
|
|
interface, MAC address limit for that Interface. It also contains
|
|
the action to be undertaken if MAC address limit is exceeded. A table
|
|
entry specifies whether IP source guard and MAC source guard are enabled
|
|
on the specified interface."
|
|
INDEX { ifIndex }
|
|
::= { jnxSecAccessPortIfTable 1 }
|
|
|
|
JnxSecAccessPortIfEntry ::=
|
|
SEQUENCE {
|
|
jnxSecAccessdsIfTrustState TruthValue,
|
|
jnxSecAccessdsIfRateLimit Unsigned32,
|
|
jnxSecAccessIfMacLimit Unsigned32,
|
|
jnxSecAccessIfMacLimitExceed JnxMacLimitExceededAction,
|
|
jnxSecAccessIfIpSrcGuardStatus TruthValue,
|
|
jnxSecAccessIfMacSrcGuardStatus TruthValue
|
|
}
|
|
|
|
|
|
jnxSecAccessdsIfTrustState OBJECT-TYPE
|
|
SYNTAX TruthValue
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"This object indicates whether the interface is trusted for
|
|
DHCP Snooping purpose.
|
|
|
|
If this object is 'true', the interface is trusted.
|
|
DHCP packets coming to this interface will be forwarded without
|
|
checking.
|
|
|
|
If this object is 'false', the interface is not trusted. DHCP
|
|
packets coming to this interface will be subjected to DHCP checks."
|
|
::= { jnxSecAccessPortIfEntry 1 }
|
|
|
|
jnxSecAccessdsIfRateLimit OBJECT-TYPE
|
|
SYNTAX Unsigned32
|
|
UNITS "packets per second"
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"This object indicates rate limit value for DHCP Snooping purpose.
|
|
If the value of this object is 0, no rate limit is applied for DHCP
|
|
traffic at this interface."
|
|
::= { jnxSecAccessPortIfEntry 2 }
|
|
|
|
jnxSecAccessIfMacLimit OBJECT-TYPE
|
|
SYNTAX Unsigned32
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"This object specifies the threshold limit for the number of
|
|
MAC address entries on this interface.
|
|
|
|
When the instance value of this object is set to 0, no threshold
|
|
limit will be applied for this interfacew and the
|
|
corresponding instance value of jnxIfMacLimitExceedAction
|
|
of the same row has no effect."
|
|
DEFVAL { 5 }
|
|
::= { jnxSecAccessPortIfEntry 3 }
|
|
|
|
jnxSecAccessIfMacLimitExceed OBJECT-TYPE
|
|
SYNTAX JnxMacLimitExceededAction
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"This object specifies the action to be taken by the system for this
|
|
interface while the number of MAC addresses has exceeded the value
|
|
of jnxIfMacLimit.
|
|
|
|
This object value is only effective when the corresponding instance
|
|
value of jnxIfMacLimit is not set to 0."
|
|
::= { jnxSecAccessPortIfEntry 4 }
|
|
|
|
jnxSecAccessIfIpSrcGuardStatus OBJECT-TYPE
|
|
SYNTAX TruthValue
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"This object indicates whether IP Source Guard is enabled on
|
|
the specified interface.
|
|
|
|
If this object is 'true', then IP Source Guard is enabled on the
|
|
specified interface.
|
|
|
|
If this object is 'false', then IP Source Guard is disabled on
|
|
the specified interface."
|
|
::= { jnxSecAccessPortIfEntry 5 }
|
|
|
|
jnxSecAccessIfMacSrcGuardStatus OBJECT-TYPE
|
|
SYNTAX TruthValue
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"This object indicates whether Mac Source Guard is enabled on
|
|
the specified interface.
|
|
|
|
If this object is 'true', then Mac Source Guard is enabled on the
|
|
specified interface.
|
|
|
|
If this object is 'false', then IP Source Guard is disabled on
|
|
the specified interface."
|
|
::= { jnxSecAccessPortIfEntry 6 }
|
|
|
|
|
|
-- Storm Control Table
|
|
|
|
jnxStormCtlTable OBJECT-TYPE
|
|
SYNTAX SEQUENCE OF JnxStormCtlEntry
|
|
MAX-ACCESS not-accessible
|
|
STATUS current
|
|
DESCRIPTION
|
|
"Storm control monitors each type of traffic level on an interface.
|
|
If traffic level exceeds the threshold value(rising threshold),
|
|
switch will drop all packets of that type until traffic level drops
|
|
to the threshold level (falling threshold). If traffic rate for a
|
|
particular type exceeds the rising threshold, action will be taken
|
|
to shutdown or add configured filter on the port.
|
|
|
|
This table describes the traffic type for each interface, the rising
|
|
threshold, falling threshold and the action to be taken if the traffic
|
|
exceeds the rising threshold."
|
|
::= { jnxSecAccessPortMIBObjects 3 }
|
|
|
|
jnxStormCtlEntry OBJECT-TYPE
|
|
SYNTAX JnxStormCtlEntry
|
|
MAX-ACCESS not-accessible
|
|
STATUS current
|
|
DESCRIPTION
|
|
"An entry contains the interface index,traffic type for the interface,
|
|
the rising threshold, falling threshold and the action to be taken
|
|
if the traffic exceeds the rising threshold."
|
|
INDEX {ifIndex, jnxStormCtlIfTrafficType }
|
|
::= { jnxStormCtlTable 1 }
|
|
|
|
JnxStormCtlEntry ::= SEQUENCE {
|
|
jnxStormCtlIfTrafficType INTEGER,
|
|
jnxStormCtlRisingThreshold Integer32,
|
|
jnxStormCtlFallingThreshold Integer32,
|
|
jnxStormCtlAction INTEGER
|
|
}
|
|
|
|
jnxStormCtlIfTrafficType OBJECT-TYPE
|
|
SYNTAX INTEGER {
|
|
broadcast(1),
|
|
multicast(2),
|
|
unicast (3)
|
|
}
|
|
MAX-ACCESS not-accessible
|
|
STATUS current
|
|
DESCRIPTION
|
|
"This object specifies the traffic type on the particular
|
|
interface. Value 1 specifies that it is broadcast traffic,
|
|
value 2 specifies that it is multicast traffic and
|
|
value 3 specifies that it is unicast traffic."
|
|
::= { jnxStormCtlEntry 1 }
|
|
|
|
jnxStormCtlRisingThreshold OBJECT-TYPE
|
|
SYNTAX Integer32
|
|
UNITS "packets per second"
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"This object specifies the rising threshold value in packets
|
|
per second. The storm control action is occurs when the traffic
|
|
exceeds this threshold value."
|
|
::= { jnxStormCtlEntry 2 }
|
|
|
|
jnxStormCtlFallingThreshold OBJECT-TYPE
|
|
SYNTAX Integer32
|
|
UNITS "packets per second"
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"This object specifies the falling threshold value in packets
|
|
per second. The storm control action ceases when the traffic
|
|
drops to this threshold value."
|
|
::= { jnxStormCtlEntry 3 }
|
|
|
|
jnxStormCtlAction OBJECT-TYPE
|
|
SYNTAX INTEGER {
|
|
shutdown(1),
|
|
filter (2)
|
|
}
|
|
MAX-ACCESS read-only
|
|
STATUS current
|
|
DESCRIPTION
|
|
"This object specifies the action to be taken, when traffic exceeds
|
|
rising threshold value. Value 1 specifies that the action taken is
|
|
to shutdown the port. Value 2 specifies that the action taken is to
|
|
apply a policy filter on the interface for the given packet type.
|
|
Default is to shutdown(1) the port."
|
|
DEFVAL { 1 }
|
|
::= { jnxStormCtlEntry 4 }
|
|
|
|
|
|
-- Definition of DHCP Snooping notifications
|
|
|
|
jnxSecAccessdsRateLimitCrossed NOTIFICATION-TYPE
|
|
OBJECTS { jnxSecAccessdsIfRateLimit }
|
|
STATUS current
|
|
DESCRIPTION
|
|
"A jnxdsRateLimitCrossed notification is generated when
|
|
the number of DHCP packets from an untrusted interface exceeds
|
|
jnxSecAccessdsIfRateLimit."
|
|
::= { jnxSecAccessPortMIBNotifications 1 }
|
|
|
|
-- Definition of MAC Limit Exceeded Notification
|
|
|
|
jnxSecAccessIfMacLimitExceeded NOTIFICATION-TYPE
|
|
OBJECTS { jnxSecAccessIfMacLimit, jnxSecAccessIfMacLimitExceed }
|
|
STATUS current
|
|
DESCRIPTION
|
|
"Notification is sent when the number of MAC addresses learnt by
|
|
the interface has crossed the limit of MAC addresses(jnxSecAccessIfMacLimit)
|
|
and if MAC Limit Exceeded Action(jnxSecAccessIfMacLimitExceed) is
|
|
drop or alarm or shutdown."
|
|
::= { jnxSecAccessPortMIBNotifications 2 }
|
|
|
|
-- Definition of Storm Event Notification
|
|
|
|
jnxStormEventNotification NOTIFICATION-TYPE
|
|
OBJECTS { jnxStormCtlRisingThreshold }
|
|
STATUS current
|
|
DESCRIPTION
|
|
"Notification is sent when the traffic in the interface exceeds
|
|
rising threshold(jnxStormCtlRisingThreshold)."
|
|
::= { jnxSecAccessPortMIBNotifications 3 }
|
|
END
|
|
|
|
|
|
|