The following tables, groups, and variables are supported in this MIB.
| Table/Group | Supported Variables | Comments |
|---|---|---|
| etsysPolicyProfile group | etsysPolicyProfileMaxEntries | The maximum number of entries allowed in the etsysPolicyProfileTable. |
| etsysPolicyProfileNumEntries | The current number of entries in the etsysPolicyProfileTable. | |
| etsysPolicyProfileLastChange | The sysUpTime at which the etsysPolicyProfileTable was last modified. | |
| etsysPolicyProfileTableNextAvailableIndex |
This object indicates the numerically lowest available index within this entity, which may be used for the value of etsysPolicyProfileIndex in the creation of a new entry in the etsysPolicyProfileTable. An index is considered available if the index value falls within the range of 1 to 65535 and is not being used to index an existing entry in the etsysPolicyProfileTable contained within this entity. This value should only be considered a guideline for management creation of etsysPolicyProfileEntries, there is no requirement on management to create entries based upon this index value. |
|
| etsysPolicyProfileTable | A table containing policy profiles. A policy is a group of classification rules which may be applied on a per user basis, to ports or to stations. | |
| etsysPolicyProfileEntry | Conceptually defines a particular entry within the etsysPolicyProfileTable. Entries within this table MUST be considered non-volatile and MUST be maintained across entity resets. | |
| etsysPolicyProfileIndex | A unique arbitrary identifier for this Policy. Since a policy will be applied to a user regardless of his or her location in the network fabric policy names SHOULD be unique within the entire network fabric. Policy IDs and policy names MUST be unique within the scope of a single managed entity. | |
| etsysPolicyProfileName |
Administratively assigned textual description of this Policy. This object MUST NOT be modifiable while this entry's RowStatus is active(1). |
|
| etsysPolicyProfileRowStatus |
This object allows for the dynamic creation and deletion of entries within the etsysPolicyProfileTable as well as the activation and deactivation of these entries. When this object's value is active(1) the corresponding row's etsysPolicyProfilePortVid, etsysPolicyProfilePriority, and all entries within the etsysPolicyClassificationTable indexed by this row's etsysPolicyProfileIndex are available to be applied to network access ports or stations on the managed entity. All ports corresponding to rows within the etsysPortPolicyProfileTable whose etsysPortPolicyProfileOperID is equal to the etsysPolicyProfileIndex, shall have the corresponding policy applied. Likewise, all stations corresponding to rows within the etsysStationPolicyProfileTable whose etsysStationPolicyProfileOperID is equal to the etsysPolicyProfileIndex, shall have the corresponding policy applied. The value of etsysPortPolicyProfileOperID for each such row in the etsysPortPolicyProfileTable will be equal to the etsysPortPolicyProfileAdminID, unless the authorization information from a source such as a RADIUS server indicates to the contrary. Refer to the specific objects within this MIB as well as well as RFC2674, the CTRON-PRIORITY-CLASSIFY-MIB, the CTRON-VLAN-CLASSIFY-MIB, and the CTRON-RATE-POLICING-MIB for a complete explanation of the application and behavior of these objects. When this object's value is set to notInService(2) this policy will not be applied to any rows within the etsysPortPolicyProfileTable. To allow policy profiles to be applied for security implementations, setting this object's value from active(1) to notInService(2) or destroy(6) SHALL fail if one or more instances of etsysPortPolicyProfileOperID or etsysStationPolicyProfileOperID currently reference this entry's associated policy due to a set by an underlying security protocol such as RADIUS. For network functionality and clarity, setting this object to destroy(6) SHALL fail if one or more instances of etsysPortPolicyProfileOperID or etsysStationPolicyProfileOperID currently references this entry's etsysPolicyProfileIndex. Refer to the RowStatus convention for further details on the behavior of this object. |
|
| etsysPolicyProfilePortVidStatus |
This object defines whether a PVID override should be applied to ports which have this profile active. enabled(1) means that any port with this policy active will have this row's etsysPolicyProfilePortVid applied to untagged frames or priority-tagged frames received on this port. disabled(2) means that etsysPolicyProfilePortVid will not be applied. When this object is set to disabled(2) the value of etsysPolicyProfilePortVid has no meaning. |
|
| etsysPolicyProfilePortVid |
This object defines the PVID of this profile. If a port has an active policy and the policy's etsysPolicyProfilePortVidStatus is set to enabled(1), the etsysPolicyProfilePortVid will be applied to all untagged frames arriving on the port that do not match any of the policy classification rules. Note that the 802.1Q PVID will still exist from a management view but will NEVER be applied to traffic arriving on a port that has an active policy and enabled etsysPolicyProfilePortVid defined, since policy is applied to traffic arriving on the port prior to the assignment of a VLAN using the 802.1Q PVID. The behavior of an enabled etsysPolicyProfilePortVid on any associated port SHALL be identical to the behavior of the dot1qPvid upon that port. Note that two special, otherwise illegal, values of the etsysPolicyProfilePortVid are used in defining the default forwarding actions, to be used in conjunction with policy classification rules, and do not result in packet tagging: 0 Indicates that the default forwarding action is to drop all packets that do not match an explicit rule. 4095 Indicates that the default forwarding action is to forward any packets not matching any explicit rules. |
|
| etsysPolicyProfilePriorityStatus |
This object defines whether a Class of Service should be applied to ports which have this profile active. enabled(1) means that any port with this policy active will have etsysPolicyProfilePriority applied to this port. disabled(2) means that etsysPolicyProfilePriority will not be applied. When this object is set to disabled(2) the value of etsysPolicyProfilePriority has no meaning. |
|
| etsysPolicyProfilePriority |
This object defines the default ingress Class of Service of this profile. If a port has an active policy and the policy's etsysPolicyProfilePriorityStatus is set to enabled(1), the etsysPolicyProfilePriority will be applied to all packets arriving on the port that do not match any of the policy classification rules. Note that dot1dPortDefaultUserPriority will still exist from a management view but will NEVER be applied to traffic arriving on a port that has an active policy and enabled etsysPolicyProfilePriority defined, since policy is applied to traffic arriving on the port prior to the assignment of a priority using dot1dPortDefaultUserPriority. The behavior of an enabled etsysPolicyProfilePriority on any associated port SHALL be identical to the behavior of the dot1dPortDefaultUserPriority upon that port. |
|
| etsysPolicyProfileEgressVlans | The set of VLANs which are assigned by this policy to egress on ports for which this policy is active. Changes to a bit in this object affect the per-port per-VLAN Registrar control for Registration Fixed for the relevant GVRP state machine on each port for which this policy is active. A VLAN may not be added in this set if it is already a member of the set of VLANs in etsysPolicyProfileForbiddenVlans. This object is superseded on a per-port per-VLAN basis by any 'set' bits in dot1qVlanStaticEgressPorts and dot1qVlanForbiddenEgressPorts. The default value of this object is a string of zeros. | |
| etsysPolicyProfileForbiddenVlans | The set of VLANs which are prohibited by this policy to egress on ports for which this policy is active. Changes to this object that cause a port to be included or excluded affect the per-port per-VLAN Registrar control for Registration Forbidden for the relevant GVRP state machine on each port for which this policy is active. A VLAN may not be added in this set if it is already a member of the set of VLANs in etsysPolicyProfileEgressVlans. This object is superseded on a per-port per-VLAN basis by any 'set' bits in the dot1qVlanStaticEgressPorts and dot1qVlanForbiddenEgressPorts. The default value of this object is a string of zeros. | |
| etsysPolicyProfileUntaggedVlans | The set of VLANs which should transmit egress packets as untagged on ports for which this policy is active. This object is superseded on a per-port per-VLAN basis by any 'set' bits in dot1qVlanStaticUntaggedPorts. | |
| etsysPolicyProfileOverwriteTCI | If set, the information contained within the TCI field of inbound, tagged packets will not be used by the device after the ingress classification stage of packet relay. The net effect will be that the TCI information may be used to classify the packet, but will be overwritten (and ignored) by subsequent stages of packet relay. | |
| etsysPolicyProfileRulePrecedence | Each octet will contain a single value representing the rule type to be matched against, defined by the PolicyClassificationRuleType textual convention. When read, will return the currently operating rule matching precedence, ordered from first consulted (in the first octet) to last consulted (in the last octet). A set of a single octet of 0x00 will result in a reversion to the default precedence ordering. A set of any other values will result in the specified rule types being matched in the order specified, followed by the remaining rules, in default precedence order. | |
| etsysPolicyProfileVlanRFC3580Mappings | The set of VLANs which are currently being mapped onto this policy profile by the etsysPolicyRFC3580MapTable. This only refers to the mapping of vlan-tunnel-attributes returned from RADIUS in an RFC3580 context. | |
| etsysPolicyProfileMirrorIndex |
A reference to a packet mirror destination (defined elsewhere). A value of (-1) indicates no mirror is specified, but a mirror is not explicitly prohibited. A value of (0) indicates that mirroring is explicitly prohibited, unless a higher precedence source (a rule) has specified a mirror. |
|
| etsysPolicyProfileAuditSyslogEnable | Enables the sending of a syslog message if no rule bound to this profile has prohibited it. | |
| etsysPolicyProfileAuditTrapEnable | Enables the sending of a SNMP NOTIFICATION if no rule bound to this profile has prohibited it. | |
| etsysPolicyProfileDisablePort | Will set the ifOperStatus of the port, on which the frame which used this profile was received, to disable, if if no rule bound to this profile has prohibited it. | |
| etsysPolicyProfileUsageList | When read, a set bit indicates that this profile was used to send a syslog or trap message for corresponding port. When set, the native PortList will be bit-wise AND'ed with the set PortList, allowing the agent to clear the usage indication. | |
| etsysPolicyProfileFstIndex |
A reference to a Flow Setup Throttling (FST) class as defined by the etsysFlowLimitingClassType object. A value of (0) indicates no FST class is specified. |
|
| etsysPolicyProfileHttpRedirectIndex |
A reference to a HTTP Redirect server group as specified by the etsysPolicyHttpRedirectGroupIndex object. A value of (0) indicates no HTTP Redirect group is specified for this profile. |
|
| etsysPolicyProfilePortAuthOverride | If a port has an active policy and that policy's etsysPolicyProfilePortAuthOverride is set to enabled(1), all frames arriving on the port will have that policy applied. In addition, any pre-existing entries with matching port values in the etsysMultiAuthSessionStationTable tables will change their authorization status to authTerminated(5). No further authentication will occur on this port. If disabled(2), the actions described above will not occur. | |
| etsysPolicyClassification group | etsysPolicyClassificationMaxEntries | The maximum number of entries allowed in the etsysPolicyClassificationTable. |
| etsysPolicyClassificationNumEntries | The current number of entries in the etsysPolicyClassificationTable. | |
| etsysPolicyClassificationLastChange | The sysUpTime at which the etsysPolicyClassificationTable was last modified. | |
| etsysPolicyClassificationTable |
A table containing reference OIDs to entries within the classification tables. These classification tables include but may not be limited to: ctPriClassifyTable ctVlanClassifyTable ctRatePolicyingConfigTable This table is used to map a list of classification rules to an instance of the etsysPolicyProfileTable. |
|
| etsysPolicyClassificationEntry | Describes a particular entry within the etsysPolicyClassificationTable. Entries within this table MUST be considered non-volatile and MUST be maintained across entity resets. | |
| etsysPolicyClassificationIndex | Administratively assigned unique value, greater than zero. Each etsysPolicyClassificationIndex instance MUST be unique within the scope of its associated etsysPolicyProfileIndex. | |
| etsysPolicyClassificationOID |
This object follows the RowPointer textual convention and is an OID reference to a classification rule. This object MUST NOT be modifiable while this entry's etsysPolicyClassificationStatus object has a value of active(1). |
|
| etsysPolicyClassificationRowStatus |
The status of this row. When set to active(1) this entry's classification rule, as referenced by etsysPolicyClassificationOID, becomes one of its associated policy's set of rules. When this entry's associated policy, as defined by etsysPolicyProfileIndex, is active and assigned to a port through the etsysPortPolicyProfileTable or to a station through the etsysStationPolicyProfileTabbe, this classification rule will be applied to the port or station. The exact behavior of this application depends upon the classification rule. When this object is set to notInService(2) or notReady(3) this entry is not considered one of its associated policy's set of rules and this classification rule will not be applied. An entry MAY NOT be set to active(1) unless this row's etsysPolicyClassificationOID is set to a valid classification rule. |
|
| etsysPolicyClassificationIngressList | The ports on which an active policy profile has defined this classification rule applies. | |
| etsysPortPolicyProfile group | etsysPortPolicyProfileLastChange | sysUpTime at which the etsysPortPolicyProfileTable was last modified. |
| etsysPortPolicyProfileEntry | Describes a particular entry within the etsysPortPolicyProfileTable. Entries within this table MUST be considered non-volatile and MUST be maintained across entity resets. | |
| etsysPortPolicyProfileIndexType | This object defines the specific type of port this entry represents. | |
| etsysPortPolicyProfileIndex | An index value which represents a unique port of the type defined by this entry's etsysPortPolicyProfileIndexType. | |
| etsysPortPolicyProfileAdminID |
This object represents the desired Policy Profile for this dot1dBasePort or this ifIndex. Setting this object to any value besides zero (0) should, if possible, immediately place this entry's dot1dBasePort or ifIndex into the given Policy Profile. This object and etsysPortPolicyProfileOperID may not be the same if this object is set to a Policy (i.e. an instance of the etsysPolicyProfileTable) which is not in an active state or if the etsysPortPolicyProfileOperID has been set by an underlying security protocol such as RADIUS. |
|
| etsysPortPolicyProfileOperID |
This object is the current policy which is being applied to this entry's dot1dBasePort. A value of zero(0) indicates there is no policy being applied to this dot1dBasePort or this ifIndex. If the value of this object has been set by an underlying security protocol such as RADIUS, sets to this entry's etsysPortPolicyProfileAdminID MUST NOT change the value of this object until such time as the security protocol releases this object by setting it to a value of zero (0). |
|
| etsysPortPolicyProfileSummaryTable | his table provides aggregate port information on a per policy, per port type basis. | |
| etsysPortPolicyProfileSummaryEntry | Conceptually defines a particular entry within the etsysPortPolicyProfileSummaryTable. | |
| EtsysPortPolicyProfileSummaryEntry | This object defines the specific type of port this entry represents. | |
| etsysPortPolicyProfileSummaryAdminID | An aggregate list of all Ports currently supporting rules which assign this profileIndex through administrative means. Rules of this type have a valid etsysPolicyRuleResult2 action and a profileIndex of 0. | |
| etsysPortPolicyProfileSummaryOperID | An aggregate list of all Ports currently supporting rules which assign this profileIndex through either an administrative or dynamic means. The profileId which will be assigned operationally, as frames are handled are too be reported here. | |
| etsysPortPolicyProfileSummaryDynamicID | An aggregate list of all Ports currently supporting rules which assign this profileIndex through a dynamic means. For example the profileIndex returned via a successful 802.1X supplicant authentication. | |
| etsysStationPolicyProfile group | etsysStationPolicyProfileMaxEntries | The maximum number of entries allowed in the etsysStationPolicyProfileTable. If this number is exceeded, based on stations connecting to the edge device, the oldest entries will be deleted. |
| etsysStationPolicyProfileNumEntries | The current number of entries in the etsysStationPolicyProfileTable. | |
| etsysStationPolicyProfileLastChange | sysUpTime at which the etsysStationPolicyProfileTable was last modified. | |
| etsysStationPolicyProfileTable | This table allows for a one to one mapping between a station's identifying address and a Policy Profile. | |
| etsysStationPolicyProfileEntry | Describes a particular entry within the etsysStationPolicyProfileTable. Entries within this table MUST be considered non-volatile and MUST be maintained across entity resets. | |
| etsysStationPolicyProfileIndex | An index value which represents a unique station entry. | |
| etsysStationIdentifierType | Indicates the type of station identifying address contained in etsysStationIdentifier. | |
| etsysStationIdentifier | A value which represents a unique MAC Address, IP Address, or other identifying address for a station, or other logical and authenticatable sub-entity within a station, connected to a port. | |
| etsysStationPolicyProfileOperID |
This object is the current policy which is being applied to this entry's MAC Address. A value of zero(0) indicates there is no policy being applied to this MAC Address. The value of this object reflects either the setting from an underlying AAA service such as RADIUS, or the default setting based on the etsysPortPolicyProfileAdminID for the port on which the station is connected. This object and the corresponding etsysPortPolicyProfileAdminID will not be the same if this object has been set by an underlying security protocol such as RADIUS. |
|
| etsysStationPolicyProfilePortType | A textual convention that defines the specific type of port designator the corresponding entry represents. | |
| etsysStationPolicyProfilePortID | A value which represents the physical port, of the type defined by this entry's etsysStationPolicyProfilePortType, on which the associated station entity is connected. This object is for convenience in cross referencing stations to ports. | |
| etsysInvalidPolicyPolicy group | etsysInvalidPolicyAction |
Specifies the action that the edge device should take if asked to apply an invalid or unknown policy. applyDefaultPolicy(1) - Ignore the result and search for the next policy assignment rule. dropPackets(2) - Block traffic. forwardPackets(3) - Forward traffic, as if no policy had been assigned (via 802.1D/Q rules). Although dropPackets(2) is the most secure option, it may not always be desirable. |
| etsysInvalidPolicyCount | Increments to indicate the number of times the device has detected an invalid/unknown policy. | |
| etsysDevicePolicyProfile group | etsysDevicePolicyProfileDefault | If this value is non-zero, the value indicates the etsysPolicyProfileEntry (and its associated etsysPolicyClassificationTable entries) which should be used by the device if the device is incapable of using the profile (or specific parts of the profile) explicitly applied to an inbound frame. A value of zero indicates that no default profile is currently active. |
| etsysPolicyCapability group | etsysPolicyCapabilities | A list of capabilities related to policies. A set bit, with the value 1, indicates support for the described functionality. A clear bit, with the value 0, indicates the described functionality is not supported. |
| etsysPolicyDynaPIDRuleCapabilities | A list of rule types which are supported by this device for the purpose of dynamically assigning a profile to the network traffic described by the bit. A set bit, with the value 1, indicates support for the described functionality. A clear bit, with the value 0, indicates the described functionality is not supported. | |
| etsysPolicyAdminPIDRuleCapabilities | A list of rule types which are supported by this device for the purpose of administratively assigning a profile to the network traffic described by the bit. A set bit, with the value 1, indicates support for the described functionality. A clear bit, with the value 0, indicates the described functionality is not supported. | |
| etsysPolicyVlanRuleCapabilities | A list of rule types which are supported by this device for the purpose of assigning a VlanId to the network traffic described by the bit. A set bit, with the value 1, indicates support for the described functionality. A clear bit, with the value 0, indicates the described functionality is not supported. | |
| etsysPolicyCosRuleCapabilities | A list of rule types which are supported by this device for the purpose of assigning a CoS to the network traffic described by the bit. A set bit, with the value 1, indicates support for the described functionality. A clear bit, with the value 0, indicates the described functionality is not supported. | |
| etsysPolicyDropRuleCapabilities |
A list of rule types which are supported by this device for the purpose of discarding the network traffic described by the bit. A set bit, with the value 1, indicates support for the described functionality. A clear bit, with the value 0, indicates the described functionality is not supported. |