path: root/MIBS/cisco/CISCOSB-SECURITY-SUITE

CISCOSB-SECURITY-SUITE DEFINITIONS ::= BEGIN

-- Version:    7.42_00
-- Date:       24 JAN 2006



IMPORTS
    MODULE-IDENTITY, OBJECT-TYPE,Counter32,
    Gauge32, Unsigned32, IpAddress, TimeTicks     FROM SNMPv2-SMI
    InterfaceIndexOrZero, InterfaceIndex,ifIndex  FROM IF-MIB
    TEXTUAL-CONVENTION,TruthValue, RowStatus,
    RowPointer, DisplayString                     FROM SNMPv2-TC
    Percents,switch001                            FROM CISCOSB-MIB
    PortList                                      FROM Q-BRIDGE-MIB;


rlSecuritySuiteMib MODULE-IDENTITY
        LAST-UPDATED "200604080001Z"
        ORGANIZATION "Cisco Systems, Inc."

        CONTACT-INFO
        "Postal: 170 West Tasman Drive
        San Jose , CA 95134-1706
        USA

        
        Website:  Cisco Small Business Support Community <http://www.cisco.com/go/smallbizsupport>"

        DESCRIPTION
                "The private MIB module definition for blocking attacks
                such as DoS(=Denial Of Service), SYN and well known viruses Attacks
                in CISCOSB devices."
        REVISION "200601090000Z"
        DESCRIPTION
                "Add per port dos attack table suport
                rlSecuritySuiteDenyTypesTable ,rlSecuritySuiteDoSSynAttackTable."
        ::= { switch001  120}

RlsecuritySuiteGlobalEnableType ::= TEXTUAL-CONVENTION
    STATUS current
    DESCRIPTION
        "Specifies the operating modes of the security-suite"
    SYNTAX INTEGER {
        enable-global-rules-only(1),
        enable-all-rules-types(2),
        disable(3),
        enable-interface-rules-only(4)
    }

RlSecuritySuiteKnownDosAttackType ::= TEXTUAL-CONVENTION
    STATUS current
    DESCRIPTION
        "Specifies well-known DoS attack"
    SYNTAX INTEGER {
        stacheldraht(1),
        invasor-Trojan(2),
        back-orifice-Trojan(3)
    }

RlSecuritySuiteKnownDosAttackProtocolType ::= TEXTUAL-CONVENTION
    STATUS current
    DESCRIPTION
        "Specifies protocol type of the well-known DoS attack"
    SYNTAX INTEGER {
        tcp(1),
        upd(2)
    }

RlSecuritySuiteAllMartianEntryType ::= TEXTUAL-CONVENTION
    STATUS current
    DESCRIPTION
        "Specifies Martian-address origin: pre-defined (reserved) or statically configured"
    SYNTAX INTEGER {
        reserved(1),
        static(2)
    }

RlSecuritySuiteDenyAttackType ::= TEXTUAL-CONVENTION
    STATUS current
    DESCRIPTION
        "Specifies the deny attack types"
    SYNTAX INTEGER {
        syn(1),
        icmp-echo-request(2),
        fragmented(3)
    }

RlSecuritySuiteDenySynFinTcp ::=  TEXTUAL-CONVENTION
    STATUS current
    DESCRIPTION
        "Specifies the dropping SYN, FIN flags enabled TCP packets status"
    SYNTAX INTEGER {
        deny(1),
        permit(2)
    }

RlSecuritySuiteSynProtectionMode ::=  TEXTUAL-CONVENTION
    STATUS current
    DESCRIPTION
        "Specifies the TCP SYN attack protection mode ."
    SYNTAX INTEGER {
        disabled(1),
        report(2),
        block(3)
    }

RlSecuritySuiteSynProtectionPortMode  ::=  TEXTUAL-CONVENTION
    STATUS current
    DESCRIPTION
        "Specifies the TCP SYN attack protection mode ."
    SYNTAX INTEGER {
        normal(1),
        attacked(2),
        blocked(3)
    }

rlSecuritySuiteGlobalEnable OBJECT-TYPE
 SYNTAX     RlsecuritySuiteGlobalEnableType
 MAX-ACCESS read-write
 STATUS     current
 DESCRIPTION
     "This scalar globally enables/disables the DoS attack Suite. "
    ::= { rlSecuritySuiteMib 1 }

rlSecuritySuiteKnownDoSAttacksTable OBJECT-TYPE
    SYNTAX SEQUENCE OF RlSecuritySuiteKnownDoSAttacksEntry
    MAX-ACCESS not-accessible
    STATUS current
    DESCRIPTION
        "This table enables/disable well-know DoS attacks,
        applied globally to all ifIndexes."
    ::= { rlSecuritySuiteMib 2 }

rlSecuritySuiteKnownDoSAttacksEntry OBJECT-TYPE
    SYNTAX     RlSecuritySuiteKnownDoSAttacksEntry
    MAX-ACCESS not-accessible
    STATUS     current
    DESCRIPTION
   "Each entry in this table describes one well known DoS attack address"
    INDEX { rlSecuritySuiteKnownDoSAttack}
    ::= { rlSecuritySuiteKnownDoSAttacksTable 1 }

RlSecuritySuiteKnownDoSAttacksEntry::= SEQUENCE {
    rlSecuritySuiteKnownDoSAttack          RlSecuritySuiteKnownDosAttackType,
    rlSecuritySuiteKnownDoSAttackEnable    TruthValue
    }

rlSecuritySuiteKnownDoSAttack OBJECT-TYPE
    SYNTAX     RlSecuritySuiteKnownDosAttackType
    MAX-ACCESS not-accessible
    STATUS     current
    DESCRIPTION
        "A well-known DoS attack to enable"
    ::= { rlSecuritySuiteKnownDoSAttacksEntry 1 }

rlSecuritySuiteKnownDoSAttackEnable OBJECT-TYPE
    SYNTAX     TruthValue
    MAX-ACCESS read-write
    STATUS     current
    DESCRIPTION
        "Enable/Disable a well-known DoS attack "
    ::= { rlSecuritySuiteKnownDoSAttacksEntry 2 }

rlSecuritySuiteKnownDoSAttacksDetailsTable OBJECT-TYPE
    SYNTAX SEQUENCE OF RlSecuritySuiteKnownDoSAttacksDetailsEntry
    MAX-ACCESS not-accessible
    STATUS current
    DESCRIPTION
        "This read-only table used to present the detailed attributes
        of each well-known DoS attack. Used for presentation propose only."
    ::= { rlSecuritySuiteMib 3 }

rlSecuritySuiteKnownDoSAttacksDetailsEntry OBJECT-TYPE
    SYNTAX     RlSecuritySuiteKnownDoSAttacksDetailsEntry
    MAX-ACCESS not-accessible
    STATUS     current
    DESCRIPTION
   "Each entry in this table describes one well known DoS attack address ,"
    INDEX { rlSecuritySuiteKnownDoSAttack}
    ::= { rlSecuritySuiteKnownDoSAttacksDetailsTable 1 }

RlSecuritySuiteKnownDoSAttacksDetailsEntry::= SEQUENCE {
    rlSecuritySuiteKnownDoSAttackProtocl           RlSecuritySuiteKnownDosAttackProtocolType,
    rlSecuritySuiteKnownDoSAttackSrcTcpUdpPort     INTEGER,
    rlSecuritySuiteKnownDoSAttackDestTcpUdpPort    INTEGER
    }
rlSecuritySuiteKnownDoSAttackProtocl OBJECT-TYPE
    SYNTAX     RlSecuritySuiteKnownDosAttackProtocolType
    MAX-ACCESS read-only
    STATUS     current
    DESCRIPTION
        "Specifies the protocol type of the relevant well-known attack"
    ::= { rlSecuritySuiteKnownDoSAttacksDetailsEntry 1 }

rlSecuritySuiteKnownDoSAttackSrcTcpUdpPort OBJECT-TYPE
    SYNTAX     INTEGER
    MAX-ACCESS read-only
    STATUS     current
    DESCRIPTION
        "Specifies the source tcp/udp port of the relevant well-known attack"
    ::= { rlSecuritySuiteKnownDoSAttacksDetailsEntry 2 }

rlSecuritySuiteKnownDoSAttackDestTcpUdpPort OBJECT-TYPE
    SYNTAX     INTEGER
    MAX-ACCESS read-only
    STATUS     current
    DESCRIPTION
        "Specifies the destination tcp/udp port of the relevant well-known attack"
    ::= { rlSecuritySuiteKnownDoSAttacksDetailsEntry 3 }

rlSecuritySuiteReservedMartianAddresses OBJECT-TYPE
   SYNTAX     TruthValue
    MAX-ACCESS read-write
    STATUS     current
    DESCRIPTION
     "This scalar globally enables/disables discarding of the IP
     well-known addresses described below:
    -------------------------------------------------------------------------------
    |  Address block               |  Present use
    |-------------------------------------------------------------------------------
    |0.0.0.0/8                     |  Addresses in this block refer to source hosts
    |(except 0.0.0.0/32            |  on 'this' network.
    | as source address)           |
    |------------------------------------------------------------------------------
    |127.0.0.0/8                   | This block is assigned for use as the Internet host loop-back address.
    |-----------------------------------------------------------------------------------------------------
    |192.0.2.0/24                  | This block is assigned as 'TEST-NET'
    |                              | for use in documentation and example code.
    |---------------------------------------------------------------------------
    |224.0.0.0/4 as source.        | This block, formerly known as the Class D address space,
    |                              | is allocated for use in IPv4 multicast address assignments.
    |-------------------------------------------------------------------------------------------
    |240.0.0.0/4                   |
    |(except 255.255.255.255/32    | This block, formerly known as the Class E address space, is reserved.
    | as destination address)      |
    |-------------------------------------------------------------------------------------------------------
   "
    ::= { rlSecuritySuiteMib 4 }

rlSecuritySuiteMartianAddrAllTable OBJECT-TYPE
    SYNTAX SEQUENCE OF RlSecuritySuiteMartianAddrAllEntry
    MAX-ACCESS not-accessible
    STATUS current
    DESCRIPTION
        "This read-only table specifies all current configured Martian addresses -
        both pre-defined (=reserved) and used-configured (=static) addresses"
    ::= { rlSecuritySuiteMib 5 }

rlSecuritySuiteMartianAddrAllEntry OBJECT-TYPE
    SYNTAX     RlSecuritySuiteMartianAddrAllEntry
    MAX-ACCESS not-accessible
    STATUS     current
    DESCRIPTION
   "Each entry in this table describes one Martian address ,
   packets with this address as IP source or IP destination, are discarded."
    INDEX { rlSecuritySuiteMartianAddr,rlSecuritySuiteMartianAddrNetMask}
    ::= { rlSecuritySuiteMartianAddrAllTable 1 }

RlSecuritySuiteMartianAddrAllEntry::= SEQUENCE {
    rlSecuritySuiteMartianAddr                  IpAddress,
    rlSecuritySuiteMartianAddrNetMask           IpAddress,
    rlSecuritySuiteAllMartianEntryType          RlSecuritySuiteAllMartianEntryType
    }
rlSecuritySuiteMartianAddr OBJECT-TYPE
    SYNTAX     IpAddress
    MAX-ACCESS not-accessible
    STATUS     current
    DESCRIPTION
        "An IP address to discard all packets with that address as source
        or destination"
    ::= { rlSecuritySuiteMartianAddrAllEntry 1 }

rlSecuritySuiteMartianAddrNetMask OBJECT-TYPE
    SYNTAX     IpAddress
    MAX-ACCESS not-accessible
    STATUS     current
    DESCRIPTION
        "Specify the net mask that comprise the destination IP address prefix."
    ::= { rlSecuritySuiteMartianAddrAllEntry 2 }

rlSecuritySuiteAllMartianEntryType OBJECT-TYPE
    SYNTAX     RlSecuritySuiteAllMartianEntryType
    MAX-ACCESS read-only
    STATUS     current
    DESCRIPTION
        "Specific the entry origin: pre-defined (reserved) of statically configured."
    ::= { rlSecuritySuiteMartianAddrAllEntry 3 }

rlSecuritySuiteMartianAddrTable OBJECT-TYPE
    SYNTAX SEQUENCE OF RlDoSAttackMartianAddrEntry
    MAX-ACCESS not-accessible
    STATUS current
    DESCRIPTION
        "This table specifies the Martian addresses -
        the addresses that packets with these IP addressed as source or
        destination are discarded."
    ::= { rlSecuritySuiteMib 6 }

rlSecuritySuiteMartianAddrEntry OBJECT-TYPE
    SYNTAX     RlDoSAttackMartianAddrEntry
    MAX-ACCESS not-accessible
    STATUS     current
    DESCRIPTION
   "Each entry in this table describes one Martian address ,
   packets with this address as IP source or IP destination, are discarded."
    INDEX { rlSecuritySuiteMartianAddr,rlSecuritySuiteMartianAddrNetMask}
    ::= { rlSecuritySuiteMartianAddrTable 1 }

RlDoSAttackMartianAddrEntry::= SEQUENCE {
    rlSecuritySuiteMartianAddrStatus              RowStatus
    }

rlSecuritySuiteMartianAddrStatus OBJECT-TYPE
    SYNTAX      RowStatus
    MAX-ACCESS  read-create
    STATUS      current
    DESCRIPTION
       "The status of a table entry.
        It is used to delete/Add an entry from this table."
    ::= { rlSecuritySuiteMartianAddrEntry 1  }

rlSecuritySuiteDoSSynAttackTable OBJECT-TYPE
    SYNTAX SEQUENCE OF RlSecuritySuiteDoSSynAttackEntry
    MAX-ACCESS not-accessible
    STATUS current
    DESCRIPTION
        "This table contains IP address and rate, to limit DoS SYN attacks from
        a specific IP address and interface(s)"
    ::= { rlSecuritySuiteMib 7 }

rlSecuritySuiteDoSSynAttackEntry OBJECT-TYPE
    SYNTAX     RlSecuritySuiteDoSSynAttackEntry
    MAX-ACCESS not-accessible
    STATUS     current
    DESCRIPTION
   "Each entry in this table describes one Martian address ,
   packets with this address as IP source or IP destination, are discarded."
    INDEX { rlSecuritySuiteDoSSynAttackIfIndex,
            rlSecuritySuiteDoSSynAttackAddr,
            rlSecuritySuiteDoSSynAttackNetMask}
    ::= { rlSecuritySuiteDoSSynAttackTable 1 }

RlSecuritySuiteDoSSynAttackEntry::= SEQUENCE {
    rlSecuritySuiteDoSSynAttackIfIndex             InterfaceIndex,
    rlSecuritySuiteDoSSynAttackAddr                IpAddress,
    rlSecuritySuiteDoSSynAttackNetMask             IpAddress,
    rlSecuritySuiteDoSSynAttackSynRate             INTEGER,
    rlSecuritySuiteDoSSynAttackStatus              RowStatus
    }
rlSecuritySuiteDoSSynAttackIfIndex OBJECT-TYPE
    SYNTAX     InterfaceIndex
    MAX-ACCESS not-accessible
    STATUS     current
    DESCRIPTION
        "Interface which the attack is applied on"
    ::= { rlSecuritySuiteDoSSynAttackEntry 1 }

rlSecuritySuiteDoSSynAttackAddr OBJECT-TYPE
    SYNTAX     IpAddress
    MAX-ACCESS not-accessible
    STATUS     current
    DESCRIPTION
        "An IP address to discard all packets with that address as destination"
    ::= { rlSecuritySuiteDoSSynAttackEntry 2 }

rlSecuritySuiteDoSSynAttackNetMask OBJECT-TYPE
    SYNTAX     IpAddress
    MAX-ACCESS not-accessible
    STATUS     current
    DESCRIPTION
        "Relevant when rlSecuritySuiteSynAttackRangeType equals prefix(2).
        Specify the number of bits that comprise the destination
        IP address prefix."
    ::= { rlSecuritySuiteDoSSynAttackEntry 3 }

rlSecuritySuiteDoSSynAttackSynRate OBJECT-TYPE
    SYNTAX     INTEGER
    MAX-ACCESS read-create
    STATUS     current
    DESCRIPTION
        "Specify the maximum connections per second allowed from this IP address
        and rlSecuritySuiteSynAttackPortList"
    ::= { rlSecuritySuiteDoSSynAttackEntry 4 }

rlSecuritySuiteDoSSynAttackStatus OBJECT-TYPE
    SYNTAX      RowStatus
    MAX-ACCESS  read-create
    STATUS      current
    DESCRIPTION
       "The status of a table entry.
        It is used to delete/Add an entry from this table."
    ::= { rlSecuritySuiteDoSSynAttackEntry 6  }

rlSecuritySuiteDenyTypesTable OBJECT-TYPE
    SYNTAX SEQUENCE OF RlSecuritySuiteDenyTypesEntry
    MAX-ACCESS not-accessible
    STATUS current
    DESCRIPTION
        "This table specifies the ip address and TCP ports that
        TCP SYN packets from them on a specific interfaces are dropped."
    ::= { rlSecuritySuiteMib 8 }

rlSecuritySuiteDenyTypesEntry OBJECT-TYPE
    SYNTAX     RlSecuritySuiteDenyTypesEntry
    MAX-ACCESS not-accessible
    STATUS     current
    DESCRIPTION
   "Each entry in this table describes one ip address, TCP port and
   list of ifIndexes, that packets with these attributes are discarded."
    INDEX { rlSecuritySuiteDenyIfIndex,
            rlSecuritySuiteDenyAttackType,
            rlSecuritySuiteDenyDestAddr,
            rlSecuritySuiteDenyNetMask,
            rlSecuritySuiteDenyDestPort}
    ::= { rlSecuritySuiteDenyTypesTable 1 }

RlSecuritySuiteDenyTypesEntry::= SEQUENCE {
    rlSecuritySuiteDenyIfIndex             InterfaceIndex,
    rlSecuritySuiteDenyAttackType          RlSecuritySuiteDenyAttackType,
    rlSecuritySuiteDenyDestAddr            IpAddress,
    rlSecuritySuiteDenyNetMask             IpAddress,
    rlSecuritySuiteDenyDestPort            INTEGER,
    rlSecuritySuiteDenyStatus              RowStatus
    }

rlSecuritySuiteDenyIfIndex OBJECT-TYPE
    SYNTAX     InterfaceIndex
    MAX-ACCESS not-accessible
    STATUS     current
    DESCRIPTION
        "Interface which the attack is applied on"
    ::= { rlSecuritySuiteDenyTypesEntry 1 }

rlSecuritySuiteDenyAttackType OBJECT-TYPE
    SYNTAX     RlSecuritySuiteDenyAttackType
    MAX-ACCESS not-accessible
    STATUS     current
    DESCRIPTION
        "The specific deny attack type"
    ::= { rlSecuritySuiteDenyTypesEntry 2 }

rlSecuritySuiteDenyDestAddr OBJECT-TYPE
    SYNTAX     IpAddress
    MAX-ACCESS not-accessible
    STATUS     current
    DESCRIPTION
        "An IP address to discard all packets with that address as destination"
    ::= { rlSecuritySuiteDenyTypesEntry 3 }

rlSecuritySuiteDenyNetMask OBJECT-TYPE
    SYNTAX     IpAddress
    MAX-ACCESS not-accessible
    STATUS     current
    DESCRIPTION
        "Relevant when rlSecuritySuiteDenyTCPRangeType equals mask(1).
        Specify the number of bits that comprise the destination
        IP address prefix."
    ::= { rlSecuritySuiteDenyTypesEntry 4 }

rlSecuritySuiteDenyDestPort OBJECT-TYPE
    SYNTAX     INTEGER
    MAX-ACCESS not-accessible
    STATUS     current
    DESCRIPTION
        "Destination TCP port.
        Use 65553 to specify all ports.
        This key-field is relevant in specific attack types (not all)
        Use 0 when not relevant."
    ::= { rlSecuritySuiteDenyTypesEntry 5 }

rlSecuritySuiteDenyStatus OBJECT-TYPE
    SYNTAX      RowStatus
    MAX-ACCESS  read-create
    STATUS      current
    DESCRIPTION
       "The status of a table entry.
        It is used to delete/Add an entry from this table."
    ::= { rlSecuritySuiteDenyTypesEntry 6  }


rlSecuritySuiteDenySynFinTcp OBJECT-TYPE
 SYNTAX     RlSecuritySuiteDenySynFinTcp
 MAX-ACCESS read-write
 STATUS     current
 DESCRIPTION
     "This scalar globally enable or disable dropping of tcp packets with both SYN and FIN flags enabled. "
    ::= { rlSecuritySuiteMib 9 }

rlSecuritySuiteSynProtectionMode OBJECT-TYPE
 SYNTAX     RlSecuritySuiteSynProtectionMode
 MAX-ACCESS read-write
 STATUS     current
 DESCRIPTION
     "This scalar globally set protection mode on TCP SYN traffic.
      Disabled - the system doesn't support protection against TCP SYN attack.
      Report   - the system doesn't support protection against TCP SYN attack,but reports about it.
      Block    - the systems supports protection against TCP SYN attack by blocking this traffic on the port.  "
    ::= { rlSecuritySuiteMib 10 }

rlSecuritySuiteSynProtectionTreshold OBJECT-TYPE
 SYNTAX     INTEGER
 MAX-ACCESS read-write
 STATUS     current
 DESCRIPTION
     "This scalar globally set protection mode treshold value in packet per second
      on TCP SYN traffic."
    ::= { rlSecuritySuiteMib 11 }

rlSecuritySuiteSynProtectionRecoveryTimeout OBJECT-TYPE
 SYNTAX     INTEGER
 MAX-ACCESS read-write
 STATUS     current
 DESCRIPTION
     "This scalar globally set protection reovery time out in secounds."
    ::= { rlSecuritySuiteMib 12 }

rlSecuritySuiteSynProtectionPortTable OBJECT-TYPE
    SYNTAX SEQUENCE OF RlSecuritySuiteSynProtectionPortEntry
    MAX-ACCESS not-accessible
    STATUS current
    DESCRIPTION
        "This table keeps SYN protection status per port."
    ::= { rlSecuritySuiteMib 13 }

rlSecuritySuiteSynProtectionPortEntry OBJECT-TYPE
    SYNTAX     RlSecuritySuiteSynProtectionPortEntry
    MAX-ACCESS not-accessible
    STATUS     current
    DESCRIPTION
   "Each entry in this table describes TCP SYN protection status for one port."
    INDEX { ifIndex}
    ::= { rlSecuritySuiteSynProtectionPortTable 1 }

RlSecuritySuiteSynProtectionPortEntry::= SEQUENCE {
    rlSecuritySuiteSynProtectionPortMode                RlSecuritySuiteSynProtectionPortMode,
    rlSecuritySuiteSynProtectionPortModeLastTimeAttack  RlSecuritySuiteSynProtectionPortMode,
    rlSecuritySuiteSynProtectionPortLastTimeAttack      DisplayString
    }

rlSecuritySuiteSynProtectionPortMode OBJECT-TYPE
    SYNTAX     RlSecuritySuiteSynProtectionPortMode
    MAX-ACCESS read-only
    STATUS     current
    DESCRIPTION
        "The port's TCP SYN protection mode."
    ::= { rlSecuritySuiteSynProtectionPortEntry 1 }


rlSecuritySuiteSynProtectionPortModeLastTimeAttack OBJECT-TYPE
    SYNTAX     RlSecuritySuiteSynProtectionPortMode
    MAX-ACCESS read-only
    STATUS     current
    DESCRIPTION
        "The port's TCP SYN protection last attack time mode."
    ::= { rlSecuritySuiteSynProtectionPortEntry 2 }

rlSecuritySuiteSynProtectionPortLastTimeAttack OBJECT-TYPE
    SYNTAX     DisplayString
    MAX-ACCESS read-only
    STATUS     current
    DESCRIPTION
        "The port's TCP SYN protection last attack time."
    ::= { rlSecuritySuiteSynProtectionPortEntry 3 }



END