HP-ICF-GENERIC-RPTR

OBJECT-IDENTITY

OBJECT-TYPE

Table containing security configuration for each port.

OBJECT-TYPE

An entry in the hubSecurePortTable, containing the security configuration for a single port.

OBJECT-TYPE

This object identifies the group containing the port for which this entry contains security configuration information.

OBJECT-TYPE

This object identifies the port within the group for which this entry contains security configuration information.

OBJECT-TYPE

The desired authorized MAC address for this port. This can be either a regular station address to configure a specific address, or it can be one of the following special values to specify the address learning method: FFFF-FFFF-FFFE: learnOnce. First source MAC address heard on this port becomes the authorized address. Setting this value initiates learning of a new authorized address. When a new authorized address is learned, it will be stored in nonvolatile memory. This variable will return learnOnceConditionally to a GET operation after it has been set to this value. FFFF-FFFF-FFFD: learnOnceConditionally. This option will initiate learning of a new authorized address only if the previous hubSecPtSecurityAddress was set to a specific address or learnContinuous. No action will be performed if the previous value was already learnOnceConditionally. FFFF-FFFF-FFFC: learnContinuous. Any address heard becomes the new authorized address. When a new address is learned, it may cause an alarm, but it does not store anything in nonvolatile memory.

OBJECT-TYPE

The MAC address of the station authorized to be on this port. This address could either have been configured by specifying a regular station address for hubSecPtSecurityAddress, or it could have been learned by the agent if hubSecPtSecurityAddress was set to one of the special values listed above. Once the agent has learned an authorized address, it will be saved across powerfails, unless the agent was configured for learnContinuous mode.

OBJECT-TYPE

If enabled, unicast packets not addressed to the authorized address for this port will be scrambled.

OBJECT-TYPE

If enabled, the agent will generate an intrusionTrap if a packet is received on this port with a source MAC address that is different from the hubSecPtAuthorizedAddress for this port.

OBJECT-TYPE

This flag indicates if an intrusion has occurred on this port. The Security LED on the hub will blink if any instance of this flag has the value intrusion. Setting this flag to noIntrusion will turn off the Security LED if no other ports have this flag set to intrusion. An intrusion will only cause an alarm and an intrusion log entry if this flag is equal to noIntrusion.

OBJECT-TYPE

This table contains a record of the twenty most recent port security violations. The first entry in the table is the oldest.

OBJECT-TYPE

A row in the hubIntruderLogTable containing information about a single port security violation.

OBJECT-TYPE

The index of this entry in the intruder log table. Index 1 will always contain the oldest entry. If the table is full when a new intrusion occurs, the new entry becomes index 20, and all earlier entries are shifted down by one entry, removing the old index 1.

OBJECT-TYPE

This object identifies the group containing the port on which this intrusion occurred.

OBJECT-TYPE

This object identifies the port within the group on which this intrusion occurred. A port number of zero indicates that this entry is unused and the values for the other variables in this entry are undefined.

OBJECT-TYPE

This object contains the source MAC address of the intruder.

OBJECT-TYPE

The value of sysUpTime when the intrusion occurred. This will be zero if the agent has been reset since the intruder was detected, since sysUpTime could be misinterpreted in that case.

OBJECT-TYPE

This object identifies the type of violation that occured: address, training, or both. The hubIntruderTrainingViolation object will indicate additional information, if any, on the type of training violation. This object will be equal to 'none' if this log entry is unused. Note that the values 'training' and 'both' are only valid for 802.12 ports.

OBJECT-TYPE

This object indicates the type of training violation. Note that for 802.3 ports, this object will always be equal to 'noViolation'. This object will be equal to 'noViolation' if this log entry is unused.

OBJECT-TYPE

Table containing security configuration for each port, where security for multiple MAC addresses per port is desired (e.g., switch systems).

OBJECT-TYPE

An entry in the hpSecurePortTable, containing the security configuration for a single port.

OBJECT-TYPE

This object identifies the group containing the port for which this entry contains security configuration information. On repeater systems, this can be used to identify a specific repeater within a managed stack of repeaters. On switch systems, stacked or unstacked, this value is always one.

OBJECT-TYPE

This object identifies the port within the group for which this entry contains security configuration information. On a switch system, this index corresponds to the ifIndex of the port.

OBJECT-TYPE

This object identifies the maximum number of MAC addresses learned on this port when the hpSecPtLearnMode is set to learnFirstN or learnFirstNConditionally. Changing the limit while in these modes clears any addresses for this port in the hpSecureAuthAddrTable. This limit does not apply when the learn mode is set to configureSpecific.

OBJECT-TYPE

This object identifies the learning mode of the port. The modes are as follows: LearnContinuous. The port can learn all new MAC addresses. When a new address is learned, it is stored in a manner such that it can be retrieved from the hpSecureAuthAddrTable. Changing the mode to this value clears any existing addresses for this port in the hpSecureAuthAddrTable. learnFirstN. First N source MAC addresses heard on this port become the authorized addresses. N is configured in hpSecPtAddressLimit. Setting this value initiates learning of up to N new authorized addresses. When a new authorized address is learned, it will be stored in the hpSecureAuthAddrTable. When the table has reached its limit N for this port, any new source MAC addresses received on the port constitutes an intrusion. See hpSecPtAlarmEnable for possible responses to the intrusion. This variable will return learnFirstNConditionally to a GET operation after it has been set to this value. learnFirstNConditionally. This option will initiate learning of up to N new authorized addresses only if the previous hpSecPtLearnMode was not set to learnFirstN or learnFirstN- Conditionally. N is configured in hpSecPtAddressLimit. configureSpecific. The port will not learn any addresses. Rather, specific authorized MAC addresses for this port are explicitly configured via the hpSecureCfgAddrTable. These addresses are also stored in the hpSecureAuthAddrTable. Any source MAC address received on this port other than those configured, constitutes an intrusion. See hpSecPtAlarmEnable for possible responses. learn8021xAuthorized. The port will learn only MAC address of a client authorized by 802.1X authenticator. learnLimitedContinuous. First N source MAC addresses heard on this port become the authorized addresses. N is specified by the hpSecPtAddressLimit object. When a new authorized address is learned, it will be stored in the hpSecureAuthAddrTable. When the table has reached its limit N for this port, any new source MAC addresses received on the port constitutes an intrusion. See hpSecPtAlarmEnable for possible responses. The authorized addresses in this mode will age out of the system, therefore the list of authorized addresses can be dynamic over time.

OBJECT-TYPE

If enabled on a switch, outbound unknown unicast packets will not be forwarded out this port. If enabled on a repeater, outbound unknown unicast packets for this port will be scrambled.

OBJECT-TYPE

This object identifies the action taken when an intrusion occurs. See hpSecPtLearnMode for what constitutes an intrusion. disable. No trap is sent and the port remains enabled. SendTrap. If the hpSecPtIntrusionFlag is set to noIntrusion, the agent will generate an intrusionTrap. SendTrapAndDisablePort. If the hpSecPtIntru- sionFlag is set to noIntrusion, the agent generate an intrusionTrap and disable the port. This value does not apply to repeaters.

OBJECT-TYPE

This flag indicates if an intrusion has occured on this port. Security-related LED(s) on the device will blink if any instance of this flag has the value intrusion. Setting this flag to noIntrusion will turn off the appropriate LED(s). An intrusion will only cause an alarm and an intrusion log entry if this flag is equal to noIntrusion. On a switch, packets causing intrusions will be not be forwarded.

OBJECT-TYPE

Table containing multiple configured authorized addresses per port. Facilitates security for ports whose hpSecPtLearnMode is set to configureSpecific.

OBJECT-TYPE

An entry in the hpSecureCfgAddrTable, containing the configured authorized address for a single port. Entries are stored in nonvolatile memory when either the hpSecPtrLearnMode for the port is changed to configureSpecific, or a new entry is configured while hpSecPtrLearnMode for the port is currently set to configureSpecific.

OBJECT-TYPE

This object identifies the group containing the port for which this entry contains the configured authorized address. On repeater systems, this can be used to identify a specific repeater within a managed stack of repeaters. On switch systems, stacked or unstacked, this value is always one.

OBJECT-TYPE

This object identifies the port within the group for which this entry contains the configured authorized address. On a switch, this index corresponds to the ifIndex of the port.

OBJECT-TYPE

A specific authorized MAC address for this port configured by a management station.

OBJECT-TYPE

The row status of a hpSecureCfgAddrEntry.

OBJECT-TYPE

Table containing the authorized addresses for each port. An authorized address is an address learned while the hpSecPtLearnMode for the port is set to learnContinuous, learnFirstN, learnLimitedContinuous, or learnFirstNConditionally; or an address in the hpSecureCfgAddrTable when the hpSecPtLearnMode for the port is set to configureSpecific. On a switch, for ports whose hpSecPtLearnMode is set to learnContinuous or learnLimitedContinuous, this table may return MAC address information based on the switch's 802.1d forwarding database.

OBJECT-TYPE

An entry in the hpSecureAuthAddrTable, containing the authorized address for a single port. Entries are stored in nonvolatile memory except when the port's hpSecPtLearnMode is set to learnContinuous or learnLimitedContinuous.

OBJECT-TYPE

This object identifies the group containing the port for which this entry contains authorized address information. On repeater systems, this can be used to identify a specific repeater within a managed stack of repeaters. On switch systems, stacked or unstacked, this value is always one.

OBJECT-TYPE

This object identifies the port within the group for which this entry contains authorized address information. On a switch, this index corresponds to ifIndex of the port.

OBJECT-TYPE

The MAC address of the station authorized to be on this port. See hpSecureAuthAddrTable for the definition of 'authorized address'.

OBJECT-IDENTITY

OBJECT-IDENTITY

OBJECT-IDENTITY

OBJECT-IDENTITY

OBJECT-IDENTITY

OBJECT-TYPE

This flag controls whether or not the device will send self healing packets. Self healing packets are normally sent once per second by the agent when no other traffic is present. When there is no traffic present on a network, there is no way to detect cabling problems (or the repair of cabling problems) and status LEDs are not always correct. Enabling this flag allows the agent to detect cabling problems on an idle network. This flag can be disabled if self healing packets are not wanted. On the 100BaseVG-AnyLAN SNMP/Bridge card, these packets are addressed to a unique unused unicast station address which has been reserved by HP for this purpose. On 802.3 repeaters, these packets are self addressed. On an 802.3 repeater, this flag MUST be enabled when using the Robust Port Healing feature. Without Robust Port Healing either a good transmit or a good receive will reconnect an autopartitioned port. With Robust Port Healing the criteria is more restrictive and only a good transmit will heal a segmented port. If all ports are segmented, the repeater will not repeat anything until the agent transmits a self healing packet and reconnects the autopartitioned ports.

OBJECT-TYPE

A table containing generic information about the current logical repeaters in this managed system.

OBJECT-TYPE

An entry in the table, containing information about a single logical repeater.

OBJECT-TYPE

This object uniquely identifies the logical repeater in the managed system for which this entry contains information. This object will have the same value as the corresponding 'repeater index' object in the media-specific repeater MIB for this repeater. Note that it will also have the same value as the instance of the Entity MIB's entLogicalIndex for the entry in the entLogicalTable that represents this repeater.

OBJECT-TYPE

The interface on the agent that is used to transmit and receive packets through this repeater. The ifEntry identified by this value is the same entry identified by the same value of the ifIndex object. The value zero indicates that the agent has no interface through which it can send and receive packets on this repeater.

OBJECT-TYPE

A friendly name for this repeater. Management applications can use this to configure a user friendly name for this logical repeater.

OBJECT-TYPE

The virtual LAN that this repeater is on. Note that setting this object does not affect the operation of the repeater in any way. It is a 'notepad' for management applications to allow them to record which VLAN on a connected switch this logical repeater is connected to.

OBJECT-IDENTITY

OBJECT-TYPE

A currently unassigned value of hpicfBackupLinkIndex. The value 0 indicates that no unassigned values are available. In order to cause a non-zero value of this object to be assigned for use as the hpicfBackupLinkIndex of a future backup link configuration, it must be successfully modified by a set operation. When modified by a set operation, the new value must precisely match the value presently held by the object. If not, the management protocol set operation will fail. Immediately after the completion of a successful set operation, the agent must modify the value of this object. The algorithm for modifying the value is implementation-dependent, and may use a subset of values within the legal range. However, the agent must guarantee that the new value is not assigned to any in-use value of hpicfBackupLinkIndex. A management station creates a new backup link using this algorithm: - issue a management protocol retrieval operation to obtain the value of hpicfBackupLinkNextIndex; if the retrieved value is zero, a new backup link cannot be created at this time; - issue a management protocol set operation for hpicfBackupLinkNextIndex, supplying the same value as obtained in the previous step; - if the set operation succeeds, use the supplied value as the hpicfBackupLinkIndex of the new backup link; if the set operation fails, go back to the first step and obtain a new value for hpicfBackupLinkNextIndex; - issue a management protocol set operation to create an instance of the hpicfBackupLinkStatus object setting its value to 'createAndGo' or 'createAndWait' (as specified in the description of the RowStatus textual convention). Note that the set of hpicfBackupLinkNextIndex and the instance of hpicfBackupLinkStatus may occur in the same set operation if desired.

OBJECT-TYPE

A table of backup link configuration entries. For a given backup link, the agent will periodically send a test packet to the device at the specified address. If no response is received after a configured number of test packets are sent, the agent will enable the backup port and disable the primary port, and will stop sending periodic test packets. After the agent has switched to the backup link, the primary port will need to explicitly be re-enabled via management action in order to return to using the primary port. At any time, a management station can examine the associated instance of the hpicfBackupLinkState object to determine if the backup port is currently in use. The backup link algorithm enables and disables the backup port by modifying the instance of the rptrPortAdminStatus object corresponding to that port. After the backup port has been enabled by the backup link algorithm, if the primary port is subsequently enabled via management action, the backup port will be turned off and the periodic test packets will resume. When a row of this table is activated, the backup port will be disabled, the primary port will be enabled, and the periodic test packets will be sent. The time between test packets is configurable using the associated instance of the hpicfBackupLinkTestTime object. The number of failures needed to switch to the backup port is configurable using the associated instance of the hpicfBackupLinkConsecFailures object. The backup link function can be disabled by setting the relevant instance of the hpicfBackupLinkStatus object to either 'notInService' or 'destroy'. Note that the primary port for a backup link must be mapped to a repeater segment that the agent is capable of transmitting through. In addition, a given port cannot be used in more than one active backup link at the same time.

OBJECT-TYPE

A row in the table, containing information about a single backup link.

OBJECT-TYPE

The value of this object uniquely identifies this backup link.

OBJECT-TYPE

The group containing the primary port for this backup link.

OBJECT-TYPE

The port number within the group of the primary port for this backup link.

OBJECT-TYPE

The group containing the backup port for this backup link.

OBJECT-TYPE

The port number within the group of the backup port for this backup link.

OBJECT-TYPE

The MAC address of the device to which periodic test packets are sent in order to determine if the primary link is operational.

OBJECT-TYPE

The frequency, in seconds, between sending periodic test packets. The test packet response timeout is fixed at 500ms.

OBJECT-TYPE

The number of consecutive test packet failures which will cause the agent to switch to the backup port (i.e., backup port turned on, primary port turned off). A value of one is generally not recommended and will cause the backup link to be enabled upon the first failure.

OBJECT-TYPE

The current state of this backup link. One of the following values: notActive - backup link not running because this row has not yet been made active usingPrimary - backup link is running and using the primary port usingBackup - backup link test has failed; the primary port has been disabled and the backup port has been enabled

OBJECT-TYPE

The index of the eventEntry in the RMON MIB that will be triggered whenever the value of hpicfBackupLinkState changes from 'usingPrimary' to 'usingBackup'. The eventEntry identified by a particular value of this index is the same as identified by the same value of the eventIndex object. If there is no corresponding entry in the eventTable, then no association exists. In particular, if this value is zero, no associated event will be generated, as zero is not a valid event index.

OBJECT-TYPE

The status of this entry. This object may not be set to 'active' unless the corresponding instance of hpicfBackupLinkAddress has been set to a valid unicast address, the corresponding instances of hpicfBackupLinkPrimaryGroup, hpicfBackupLinkPrimaryPort, hpicfBackupLinkBackupGroup, and hpicfBackupLinkBackupPort have been configured to refer to two existing ports and that those ports are not used in any other active backup link configuration, and the primary port is mapped to a repeater segment which the agent is capable of transmitting through.

OBJECT-IDENTITY

OBJECT-TYPE

A table for configuring segment-to-repeater mapping for repeater segments in this managed system.

OBJECT-TYPE

An entry in the table, containing mapping information about a single repeater segment.

OBJECT-TYPE

The value of an instance of this object uniquely identifies a physical repeater segment in this managed system. The value of an instance of this object will be equal to the instance of the Entity MIB's entPhysicalIndex for the entry in the entPhysicalTable that represents this segment.

OBJECT-TYPE

The index of the repeater that this segment is currently connected to. Changing this value has the effect of moving all ports on this segment to a different repeater. The hpGRpPMSegAllowedRptrTable should be consulted to determine which repeaters this segment can be connected to.

OBJECT-TYPE

This table is used to inform a management application about which repeaters a physical segment is able to be connected to. There is one row in this table for each allowable segment-to-repeater connection.

OBJECT-TYPE

A row in the table, containing a single allowable segment-to-repeater connection. The presence of a row indicates that the segment identified by hpGRpPMSegmentIndex can be mapped to the repeater identified by hpGRpPMSegAllowedRptrIndex.

OBJECT-TYPE

The repeater index that identifies a repeater that this segment is able to be connected to.

OBJECT-TYPE

A table for configuring port-to-repeater mapping for repeater ports in this managed system.

OBJECT-TYPE

An entry in the table, containing mapping information about a single repeater port.

OBJECT-TYPE

The group containing the port for which this entry contains mapping information.

OBJECT-TYPE

The port within the group for which this entry contains mapping information.

OBJECT-TYPE

This object indicates which entry in the Entity MIB's entPhysicalTable represents this port. The entPhysicalEntry identified by this value is the same entry identified by the same value of the entPhysicalIndex object.

OBJECT-TYPE

The index of the repeater that this port is currently mapped to. Changing this value has the effect of moving this port to a different repeater. The hpGRpPMPortAllowedRptrTable should be consulted to determine which repeaters this port can be mapped to. A value of zero indicates that this port is currently not a member of any repeater.

OBJECT-TYPE

This table is used to inform a management application about which repeaters a logical port is able to be mapped to. There is one row in this table for each allowable port to repeater mapping.

OBJECT-TYPE

A row in the table, containing a single allowable port to repeater mapping. The presence of a row indicates that the port identified by hpGRpPMPortGroupIndex, hpGRpPMPortIndex can be mapped to the repeater identified by hpGRpPMPortAllowedRptrIndex.

OBJECT-TYPE

The repeater index that identifies a repeater that this port is able to be mapped to.

OBJECT-IDENTITY

OBJECT-TYPE

If this object has the value 'enabled', when a switch is discovered in the stack, the repeater ports will be evenly distributed across the repeater segments if they had not previously been assigned to segments (in other words, if they are in their default state). If this object has the value 'disabled', this automatic distribution of ports will not occur.

OBJECT-TYPE

Setting this object to 'balancing' will cause the agent to distribute ports in the stack across the repeater segments, attempting to balance the traffic load on each segment. When the agent has finished the load balancing, it will set the value of this object to 'completed'. Setting this object to 'undoLast' will cause the agent to return all of the ports to the segment they were on before the last load balancing. This object will have the value of 'cantUndo' if there has been no load balancing since the last agent reset or if the last load balancing has already been undone. This object can only be set to 'undoLast' when its current value is 'completed'.

OBJECT-TYPE

This object contains the value of sysUpTime for the last time the hpGRPLoadBalanceNow object was set to 'balancing'. If load balancing has not been performed since the last agent reset, this object will have the value 0.

OBJECT-IDENTITY

OBJECT-TYPE

A table of switches, both internal and external, connected to ports in this repeater system. Typically, internal switches are added by the agent and cannot be removed by a management operation. External switches may be added or removed by management operations using the hpicfGRpSwitchStatus object.

OBJECT-TYPE

An entry in the table, representing a single attached switch.

OBJECT-TYPE

An index used to uniquely identify this switch.

OBJECT-TYPE

This object indicates whether this switch is an internal switch card or a switch external to the repeater system. This object will always be equal to 'external' for rows that are created using hpicfGRpSwitchStatus. For internal switches, the type of internal switch can be determined by examining the relevant instance of the entPhysicalType object.

OBJECT-TYPE

For an internal switch, this object is the index in the entPhysicalTable for the internal switch card. For an external switch, the value of this object will be zero.

OBJECT-TYPE

The number of links from this switch's ports to repeater ports in this repeater system. For internal switches, this object cannot be modified by a network management operation. For an external switch, when this object is set, a number of rows will be added to the hpicfGRpSwitchLinkTable equal to the value of this object. The values of hpicfGRpSwitchLinkIndex will be numbered from 1 to the value of this object. An instance of this object may not be modified if the corresponding instance of the hpicfGRpSwitchStatus object would be equal to 'active' both before and after the modification attempt.

OBJECT-TYPE

The status of this hpicfGRpSwitchEntry. An entry may not exist in the active state unless the associated instance of the hpicfGRpSwitchLinkCount has been set to a non-zero value, and all associated instances of the hpicfGRpSwitchLinkRptrGroup and hpicfGRpSwitchLinkRptrPort objects have been set to non-zero values. If this object is set to 'destroy', all associated entries in the hpicfGRpSwitchLinkTable shall be deleted.

OBJECT-TYPE

A table of links to switch ports for both internal and external switches that are connected to repeater ports in this repeater system.

OBJECT-TYPE

An entry in the table, representing a single link to a switch port.

OBJECT-TYPE

An identifier that uniquely identifies this switch link among all of the links associated with this switch. The values of this object are numbered consecutively from 1 to the value of the instance of the hpicfGRpSwitchLinkCount associated with this switch.

OBJECT-TYPE

The group containing the repeater port to which this switch link is attached. For internal switches, this object may not be modified by a network management operation. For external switches, an instance of this object will be created with the value of zero. It must be modified to a non-zero value corresponding to a known repeater group index before the instance of the hpicfGRpSwitchStatus object associated with this switch can be set to 'active'. An instance of this object may not be modified if the instance of the hpicfGRpSwitchStatus object associated with this switch would be equal to 'active' both before and after the modification attempt.

OBJECT-TYPE

The repeater port within the group to which this switch link is attached. For internal switches, this object may not be modified by a network management operation. For external switches, an instance of this object will be created with the value of zero. It must be modified to a non-zero value corresponding to a known repeater port index before the instance of the hpicfGRpSwitchStatus object associated with this switch can be set to 'active'. An instance of this object may not be modified if the instance of the hpicfGRpSwitchStatus object associated with this switch would be equal to 'active' both before and after the modification attempt.

OBJECT-TYPE

This object indicates whether this switch link is enabled ('active') or disabled ('redundant') due to one of the following: - There are more links to this switch than there are repeater segments. - The agent detected a switching loop. - The link is intended as a backup connection for other links on this switch. There can only be one active link to the switch from each repeater segment, otherwise you will have a switching loop. Therefore, if more than one switch link is connected to repeater ports on the same repeater segment, only one of them may have the value 'active'. All of the others must have the value 'redundant.

OBJECT-TYPE

The hpicfGRpSwitchIndex of the switch that is currently the primary switch for this stack. The automatic port-to-segment distribution feature will make decisions based on which switch is the primary switch. A value of 0 indicates that there are no internal switches in the system, and no external switches have been configured.

OBJECT-TYPE

The hpicfGRpSwitchIndex of the switch that the network administrator wants to be the primary switch for this stack. If the value of this object is zero, the agent will select the primary switch. Note that the agent may choose to use a different switch as the primary switch if it is unable to locate the switch identified by this object.

OBJECT-IDENTITY

OBJECT-TYPE