ENTERASYS-POLICY-PROFILE-MIB

This object indicates the numerically lowest available index within this entity, which may be used for the value of etsysPolicyProfileIndex in the creation of a new entry in the etsysPolicyProfileTable.

An index is considered available if the index value falls within the range of 1 to 65535 and is not being used to index an existing entry in the etsysPolicyProfileTable contained within this entity.

This value should only be considered a guideline for management creation of etsysPolicyProfileEntries, there is no requirement on management to create entries based upon this index value.

Administratively assigned textual description of this Policy.

This object MUST NOT be modifiable while this entry's RowStatus is active(1).

This object allows for the dynamic creation and deletion of entries within the etsysPolicyProfileTable as well as the activation and deactivation of these entries.

When this object's value is active(1) the corresponding row's etsysPolicyProfilePortVid, etsysPolicyProfilePriority, and all entries within the etsysPolicyClassificationTable indexed by this row's etsysPolicyProfileIndex are available to be applied to network access ports or stations on the managed entity.

All ports corresponding to rows within the etsysPortPolicyProfileTable whose etsysPortPolicyProfileOperID is equal to the etsysPolicyProfileIndex, shall have the corresponding policy applied. Likewise, all stations corresponding to rows within the etsysStationPolicyProfileTable whose etsysStationPolicyProfileOperID is equal to the etsysPolicyProfileIndex, shall have the corresponding policy applied.

The value of etsysPortPolicyProfileOperID for each such row in the etsysPortPolicyProfileTable will be equal to the etsysPortPolicyProfileAdminID, unless the authorization information from a source such as a RADIUS server indicates to the contrary.

Refer to the specific objects within this MIB as well as well as RFC2674, the CTRON-PRIORITY-CLASSIFY-MIB, the CTRON-VLAN-CLASSIFY-MIB, and the CTRON-RATE-POLICING-MIB for a complete explanation of the application and behavior of these objects.

When this object's value is set to notInService(2) this policy will not be applied to any rows within the etsysPortPolicyProfileTable.

To allow policy profiles to be applied for security implementations, setting this object's value from active(1) to notInService(2) or destroy(6) SHALL fail if one or more instances of etsysPortPolicyProfileOperID or etsysStationPolicyProfileOperID currently reference this entry's associated policy due to a set by an underlying security protocol such as RADIUS.

For network functionality and clarity, setting this object to destroy(6) SHALL fail if one or more instances of etsysPortPolicyProfileOperID or etsysStationPolicyProfileOperID currently references this entry's etsysPolicyProfileIndex.

Refer to the RowStatus convention for further details on the behavior of this object.

This object defines whether a PVID override should be applied to ports which have this profile active.

enabled(1) means that any port with this policy active will have this row's etsysPolicyProfilePortVid applied to untagged frames or priority-tagged frames received on this port.

disabled(2) means that etsysPolicyProfilePortVid will not be applied. When this object is set to disabled(2) the value of etsysPolicyProfilePortVid has no meaning.

This object defines the PVID of this profile. If a port has an active policy and the policy's etsysPolicyProfilePortVidStatus is set to enabled(1), the etsysPolicyProfilePortVid will be applied to all untagged frames arriving on the port that do not match any of the policy classification rules.

Note that the 802.1Q PVID will still exist from a management view but will NEVER be applied to traffic arriving on a port that has an active policy and enabled etsysPolicyProfilePortVid defined, since policy is applied to traffic arriving on the port prior to the assignment of a VLAN using the 802.1Q PVID.

The behavior of an enabled etsysPolicyProfilePortVid on any associated port SHALL be identical to the behavior of the dot1qPvid upon that port.

Note that two special, otherwise illegal, values of the etsysPolicyProfilePortVid are used in defining the default forwarding actions, to be used in conjunction with policy classification rules, and do not result in packet tagging:

0 Indicates that the default forwarding action is to drop all packets that do not match an explicit rule.

4095 Indicates that the default forwarding action is to forward any packets not matching any explicit rules.

This object defines whether a Class of Service should be applied to ports which have this profile active.

enabled(1) means that any port with this policy active will have etsysPolicyProfilePriority applied to this port.

disabled(2) means that etsysPolicyProfilePriority will not be applied. When this object is set to disabled(2) the value of etsysPolicyProfilePriority has no meaning.

This object defines the default ingress Class of Service of this profile.

If a port has an active policy and the policy's etsysPolicyProfilePriorityStatus is set to enabled(1), the etsysPolicyProfilePriority will be applied to all packets arriving on the port that do not match any of the policy classification rules.

Note that dot1dPortDefaultUserPriority will still exist from a management view but will NEVER be applied to traffic arriving on a port that has an active policy and enabled etsysPolicyProfilePriority defined, since policy is applied to traffic arriving on the port prior to the assignment of a priority using dot1dPortDefaultUserPriority.

The behavior of an enabled etsysPolicyProfilePriority on any associated port SHALL be identical to the behavior of the dot1dPortDefaultUserPriority upon that port.

A reference to a packet mirror destination (defined elsewhere).

A value of (-1) indicates no mirror is specified, but a mirror is not explicitly prohibited.

A value of (0) indicates that mirroring is explicitly prohibited, unless a higher precedence source (a rule) has specified a mirror.

A reference to a Flow Setup Throttling (FST) class as defined by the etsysFlowLimitingClassType object.

A value of (0) indicates no FST class is specified.

A reference to a HTTP Redirect server group as specified by the etsysPolicyHttpRedirectGroupIndex object.

A value of (0) indicates no HTTP Redirect group is specified for this profile.

A table containing reference OIDs to entries within the classification tables. These classification tables include but may not be limited to:

ctPriClassifyTable

ctVlanClassifyTable

ctRatePolicyingConfigTable

This table is used to map a list of classification rules to an instance of the etsysPolicyProfileTable.

This object follows the RowPointer textual convention and is an OID reference to a classification rule.

This object MUST NOT be modifiable while this entry's etsysPolicyClassificationStatus object has a value of active(1).

The status of this row.

When set to active(1) this entry's classification rule, as referenced by etsysPolicyClassificationOID, becomes one of its associated policy's set of rules.

When this entry's associated policy, as defined by etsysPolicyProfileIndex, is active and assigned to a port through the etsysPortPolicyProfileTable or to a station through the etsysStationPolicyProfileTabbe, this classification rule will be applied to the port or station. The exact behavior of this application depends upon the classification rule.

When this object is set to notInService(2) or notReady(3) this entry is not considered one of its associated policy's set of rules and this classification rule will not be applied.

An entry MAY NOT be set to active(1) unless this row's etsysPolicyClassificationOID is set to a valid classification rule.

This object represents the desired Policy Profile for this dot1dBasePort or this ifIndex.

Setting this object to any value besides zero (0) should, if possible, immediately place this entry's dot1dBasePort or ifIndex into the given Policy Profile.

This object and etsysPortPolicyProfileOperID may not be the same if this object is set to a Policy (i.e. an instance of the etsysPolicyProfileTable) which is not in an active state or if the etsysPortPolicyProfileOperID has been set by an underlying security protocol such as RADIUS.

This object is the current policy which is being applied to this entry's dot1dBasePort. A value of zero(0) indicates there is no policy being applied to this dot1dBasePort or this ifIndex.

If the value of this object has been set by an underlying security protocol such as RADIUS, sets to this entry's etsysPortPolicyProfileAdminID MUST NOT change the value of this object until such time as the security protocol releases this object by setting it to a value of zero (0).

This object is the current policy which is being applied to this entry's MAC Address. A value of zero(0) indicates there is no policy being applied to this MAC Address.

The value of this object reflects either the setting from an underlying AAA service such as RADIUS, or the default setting based on the etsysPortPolicyProfileAdminID for the port on which the station is connected.

This object and the corresponding etsysPortPolicyProfileAdminID will not be the same if this object has been set by an underlying security protocol such as RADIUS.

Specifies the action that the edge device should take if asked to apply an invalid or unknown policy.

applyDefaultPolicy(1) - Ignore the result and search for the next policy assignment rule.

dropPackets(2) - Block traffic.

forwardPackets(3) - Forward traffic, as if no policy had been assigned (via 802.1D/Q rules).

Although dropPackets(2) is the most secure option, it may not always be desirable.

A list of rule types which are supported by this device for the purpose of discarding the network traffic described by the bit.

A set bit, with the value 1, indicates support for the described functionality. A clear bit, with the value 0, indicates the described functionality is not supported.

A list of rule types which are supported by this device for the purpose of issuing syslog messages when the rule is used to identify the network traffic described by the bit.

A set bit, with the value 1, indicates support for the described functionality. A clear bit, with the value 0, indicates the described functionality is not supported.

A portlist containing bits representing the dot1dBridgePorts which have been disabled via the mechanism described in the etsysPolicyRuleDisablePort leaf. A set bit indicates a disabled port.

Ports may be enabled by performing a set with the corresponding bit cleared. Bits which are set will be ignored during the set operation.

A table containing rules bound to individual policies. A Rule is comprised of three components, a unique description of the network traffic, an associated list of actions, and an associated list of accounting and auditing controls and information.

The unique description of the network traffic, defined by a PolicyClassificationRuleType together with a length, matching data and a relevant bits field, port type, and port number (port number zero is reserved to mean any port), and scoped by a etsysPolicyProfileIndex, is used as the table index.

The etsysPolicyProfileIndex for which the rule is defined.

A value of zero(0) has special meaning in that it scopes rules which are used to determine the Policy Profile to which the frame belongs. See the etsysPolicyRuleResult1 and etsysPolicyRuleResult2 descriptions for specifics of how the results of a rule hit differ when the etsysPolicyRuleProfileIndex is zero.

The status of this row.

When set to active(1) this entry's classification rule, as referenced by etsysPolicyRulesOID, becomes one of its associated policy's set of rules.

When this entry's associated policy, as defined by etsysPolicyRuleProfileIndex, is active and assigned to a port through the etsysPortPolicyProfileTable or to a station through the etsysStationPolicyProfileTabbe, this classification rule will be applied to the port or station. The exact behavior of this application depends upon the classification rule.

When this object is set to notInService(2) or notReady(3) this entry is not considered one of its associated policy's set of rules and this classification rule will not be applied.

The storage type of this row.

When set to volatile(1) this entry's classification rule, as referenced by etsysPolicyRulesOID, will be removed (if present) from non-volatile storage. Rows created dynamically by the device will typically report this as their default storage type.

When set to nonVolatile(1) this entry's classification rule, as referenced by etsysPolicyRulesOID, will be added to non- volatile storage. This is the default value for rows created as the result of external management.

Values of other(0), permanent(4), and readOnly(5) may not be set, although they may be returned for rows created by the device.

If the etsysPolicyRuleProfileIndex is 0 then this field is read-only and defines the profile ID which will be assigned to frames matching this rule. This is the dynamically assigned value and may differ from the administratively configured value.

If the etsysPolicyRuleProfileIndex is not 0 then this field is read-create and defines the VLAN ID with which to mark a frame matching this PolicyRule.

Note that three special, otherwise illegal, values of the etsysPolicyRuleVlan are used in defining the forwarding action.

-1 Indicates that no VLAN or forwarding behavior modification is desired. A rule will not be matched against for the purpose of determining a marking VID if this value is set.

0 Indicates that the default forwarding action is to drop the packets matching this rule.

4095 Indicates that the default forwarding action is to forward any packets matching this rule.

If the etsysPolicyRuleProfileIndex is 0 then this field is read-create and defines the profile ID which the managing entity desires assigned to frames matching this rule. This is the administrative value and may differ from the dynamically assigned active value.

If the etsysPolicyRuleProfileIndex is not 0 then this field is The CoS with which to mark a frame matching this PolicyRule.

Note that one special, otherwise illegal, values of the etsysPolicyRuleCoS are used in defining the forwarding action.

-1 Indicates that no CoS or forwarding behavior modification is desired. A rule will not be matched against for the purpose of determining a CoS if this value is set.

If the etsysPolicyRuleProfileIndex is 0 then this field contains the currently applied profile ID for frames matching this rule. This may be either the administratively applied value or the dynamically applied value.

If the etsysPolicyRuleProfileIndex is not 0, then this object will return -1.

Note that one special value exists:

-1 Indicates that no profile ID is being applied by this rule.

A reference to a packet mirror destination (defined elsewhere).

A value of (-1) indicates no mirror is specified, but a mirror is not explicitly prohibited.

A value of (0) indicates that mirroring is explicitly prohibited, unless a higher precedence rule has specified a mirror.

If the etsysPolicyRuleProfileIndex is not 0 this field defines the profile ID which will be used as the quarantine provisioning agents mux response for the mac address and port whose frames matched this rule.

A value of (-1) indicates no quarantine profile is specified, but quarantine is not explicitly prohibited.

A value of (0) indicates that quarantine is explicitly prohibited.

If the etsysPolicyRuleProfileIndex is 0 this field is read only and will always return -1 when read.

A reference to a HTTP Redirect server group as specified by the etsysPolicyHttpRedirectGroupIndex object.

A value of (-1) indicates no HTTP Redirect is specified, but HTTP redirection is not explicitly prohibited.

A value of (0) indicates that HTTP Redirect is explicitly prohibited, unless a higher precedence rule has specified a HTTP Redirect.

Packets are only subject to HTTP redirection if they are IP frames with TCP port numbers matching an entry in etsysPolicyHttpRedirectSocketTable.

A table containing rules bound to individual policies. The rules here contained are representations of the non-volatile rules contained in the etsysPolicyRuleTable defined in this MIB.

A Rule comprises three components, a unique description of the network traffic, an associated list of actions, and an associated list of accounting and auditing controls and information.

The unique description of the network traffic, defined by a PolicyClassificationRuleType together with a length, matching data and a relevant bits field, port type, and port number (port number zero is reserved to mean any port), and scoped by a etsysPolicyProfileIndex, is used as the table index.

The status of this row.

When active(1) this entry's classification rule, is one of its associated policy's set of rules.

When this entry's associated policy, as defined by etsysPolicyRuleProfileIndex, is active and assigned to a port through the etsysPortPolicyProfileTable or to a station through the etsysStationPolicyProfileTable, this classification rule will be applied to the port or station. The exact behavior of this application depends upon the classification rule.

When this object is notInService(2) or notReady(3) this entry is not considered one of its associated policy's set of rules and this classification rule will not be applied.

The storage type of this row.

For all entries in the table this is set to nonVolatile(1), and as such, this entry's classification rule will be added to non-volatile storage.

If the etsysPolicyRuleProfileIndex is 0 this field defines the profile ID which will be assigned to frames matching this rule. This is the dynamically assigned value and may differ from the administratively configured value.

If the etsysPolicyRuleProfileIndex is not 0 then this field defines the VLAN ID with which to mark a frame matching this PolicyNonVolatileRule.

Note that three special, otherwise illegal, values of the etsysPolicyNonVolatileRuleVlan are used in defining the forwarding action.

-1 Indicates that no VLAN or forwarding behavior modification is desired. A rule will not be matched against for the purpose of determining a marking VID if this value is set.

0 Indicates that the default forwarding action is to drop the packets matching this rule.

4095 Indicates that the default forwarding action is to forward any packets matching this rule.

If the etsysPolicyRuleProfileIndex is 0 this field defines the profile ID which the managing entity desires assigned to frames matching this rule. This is the administrative value and may differ from the dynamically assigned active value.

If the etsysPolicyRuleProfileIndex is not 0 then this field is The CoS with which to mark a frame matching this PolicyNonVolatileRule.

Note that one special, otherwise illegal, value of the etsysPolicyNonVolatileRuleCoS is used in defining the forwarding action.

-1 Indicates that no CoS or forwarding behavior modification is desired. A rule will not be matched against for the purpose of determining a CoS if this value is set.

If the etsysPolicyRuleProfileIndex is 0 then this field contains the currently applied profile ID for frames matching this rule. This may be either the administratively applied value or the dynamically applied value.

If the etsysPolicyRuleProfileIndex is not 0, then this object will return -1.

Note that one special value exists: -

1 Indicates that no profile ID is being applied by this rule.

A reference to a packet mirror destination (defined elsewhere).

A value of (-1) indicates no mirror is specified, but a mirror is not explicitly prohibited.

A value of (0) indicates that mirroring is explicitly prohibited, unless a higher precedence rule has specified a mirror.

If the etsysPolicyRuleProfileIndex is not 0 this field defines the profile ID which will be used as the quarantine provisioning agents mux response for the mac address and port whose frames matched this rule.

A value of (-1) indicates no quarantine profile is specified, but quarantine is not explicitly prohibited.

A value of (0) indicates that quarantine is explicitly prohibited. If the etsysPolicyRuleProfileIndex is 0 this field will always return -1 when read.

Indicates which field to use in the application of the RADIUS response in the event that both the proprietary filter-id indicating a policy profile and the standard (RFC3580) vlan- tunnel-attribute are present. If policyProfile(1) is selected, then the filter-id will be used, if vlanTunnelAttribute(2) is selected, then the vlan-tunnel-attribute will be used (and the policy-map will be applied, if present). A value of vlanTunnelAttributeWithPolicyProfile(3) indicates that both attributes should be applied, in the following manner: the policyProfile should be enforced, with the exception of the etsysPolicyProfilePortVid (if present), the returned vlan-tunnel-attribute will be used in its place. In this case, the policy-map will be ignored (as the policyProfile was explicitly assigned). VLAN classification rules will still be applied, as defined by the assigned policyProfile.

Modifications of this value will not effect the current status of any users currently authenticated. The new state will be applied to new, successful authentications. The current status of current authentication may be modified through the individual agents or through the ENTERASYS-MULTI-AUTH-MIB, if supported.

The index of a Policy Profle as defined in the etsysPolicyProfileTable. A value of 0 indicates that the row is functionally non- operational (no mapping exists). Devices which support the ENTERASYS-VLAN-AUTHORIZATION-MIB, and for which the value of etsysVlanAuthorizationEnable is Enabled and the value of etsysVlanAuthorizationStatus is Enabled on the port referenced by the authorization request, should then use the VlanIndex provisioned (e.g. from the Tunnel-Private-Group-ID RADIUS attribute) as defined by RFC3580, otherwise, the device should treat the result as if no matching Policy Profile had been found (e.g. as a simple success). In the case where a Policy Profile is already being applied to the referenced station, but no mapping exists, the device MUST treat the Tunnel-Private-Group-ID as an override to the etsysPolicyProfilePortVid defined by that profile (any matched classification rules which explicit provision a VLAN MUST still override both the etsysPolicyProfilePortVid and the Tunnel-Private-Group-ID.)

A non-zero value of this object indicates that the VlanIndex provisioned (e.g. from the Tunnel-Private-Group-ID RADIUS attribute) should be mapped to a Policy Profile as defined in the etsysPolicyProfileTable, and that policy applied as if the Policy name had been provisioned instead (e.g, in the Filter-ID RADIUS attribute). If the mapping references a non-existent row of the etsysPolicyProfileTable, or the referenced row has a etsysPolicyProfileRowStatus value other than Active, the device MUST behave as if the mapping did not exist (apply the vlan-tunnel-attribute). The etsysPolicyRFC3580MapInvalidMapping MUST then be incremented.

Controls the enabling and disabling the entire Policy application.

A value of enabled(1) indicates that all objects in this MIB module are actively being applied on the device. A value of disabled(2) indicates that none of the objects in this MIB are actively being applied.

The agent may optionally implement this leaf as read-only. All other objects in this MIB module MUST remain available and configurable regardless of the current value of this object. This object MUST be considered non-volatile and its value MUST be maintained across entity resets.