Tech-invite3GPPspaceIETFspace
96959493929190898887868584838281807978777675747372717069686766656463626160595857565554535251504948474645444342414039383736353433323130292827262524232221201918171615141312111009080706050403020100
in Index   Prev   Next

RFC 4363

Definitions of Managed Objects for Bridges with Traffic Classes, Multicast Filtering, and Virtual LAN Extensions

Pages: 99
Proposed Standard
Errata
Obsoletes:  2674
Part 4 of 4 – Pages 77 to 99
First   Prev   None

Top   ToC   RFC4363 - Page 77   prevText
    MAX-ACCESS  read-create
    STATUS      current
    DESCRIPTION
        "The type of constraint this entry defines.
            independent(1) - the VLAN, dot1qConstraintVlan,
                uses a filtering database independent from all
                other VLANs in the same set, defined by
                dot1qConstraintSet.
            shared(2) - the VLAN, dot1qConstraintVlan, shares
                the same filtering database as all other VLANs
                in the same set, defined by dot1qConstraintSet."
    ::= { dot1qLearningConstraintsEntry 3 }

dot1qConstraintStatus OBJECT-TYPE
    SYNTAX      RowStatus
    MAX-ACCESS  read-create
    STATUS      current
    DESCRIPTION
        "The status of this entry."
    ::= { dot1qLearningConstraintsEntry 4 }

dot1qConstraintSetDefault OBJECT-TYPE
    SYNTAX      Integer32 (0..65535)
    MAX-ACCESS  read-write
    STATUS      current
    DESCRIPTION
        "The identity of the constraint set to which a VLAN
        belongs, if there is not an explicit entry for that VLAN
        in dot1qLearningConstraintsTable.

        The value of this object MUST be retained across
        reinitializations of the management system."
    ::= { dot1qVlan 9 }

dot1qConstraintTypeDefault OBJECT-TYPE
    SYNTAX      INTEGER {
                    independent(1),
                    shared(2)
                }
    MAX-ACCESS  read-write
    STATUS      current
    DESCRIPTION
        "The type of constraint set to which a VLAN belongs, if
        there is not an explicit entry for that VLAN in
        dot1qLearningConstraintsTable.  The types are as defined
        for dot1qConstraintType.

        The value of this object MUST be retained across
Top   ToC   RFC4363 - Page 78
        reinitializations of the management system."
    ::= { dot1qVlan 10 }

-- -------------------------------------------------------------
-- dot1vProtocol subtree
-- -------------------------------------------------------------

dot1vProtocolGroupTable OBJECT-TYPE
    SYNTAX      SEQUENCE OF Dot1vProtocolGroupEntry
    MAX-ACCESS  not-accessible
    STATUS      current
    DESCRIPTION
        "A table that contains mappings from Protocol
         Templates to Protocol Group Identifiers used for
         Port-and-Protocol-based VLAN Classification."
    REFERENCE
        "IEEE 802.1v clause 8.6.4"
    ::= { dot1vProtocol 1 }

dot1vProtocolGroupEntry OBJECT-TYPE
    SYNTAX      Dot1vProtocolGroupEntry
    MAX-ACCESS  not-accessible
    STATUS      current
    DESCRIPTION
        "A mapping from a Protocol Template to a Protocol
         Group Identifier."
    INDEX       { dot1vProtocolTemplateFrameType,
                  dot1vProtocolTemplateProtocolValue }
    ::= { dot1vProtocolGroupTable 1 }

Dot1vProtocolGroupEntry ::=
    SEQUENCE {
        dot1vProtocolTemplateFrameType
            INTEGER,
        dot1vProtocolTemplateProtocolValue
            OCTET STRING,
        dot1vProtocolGroupId
            Integer32,
        dot1vProtocolGroupRowStatus
            RowStatus
    }

dot1vProtocolTemplateFrameType OBJECT-TYPE
    SYNTAX      INTEGER {
                  ethernet  (1),
                  rfc1042   (2),
                  snap8021H (3),
                  snapOther (4),
Top   ToC   RFC4363 - Page 79
                  llcOther  (5)
                }
    MAX-ACCESS  not-accessible
    STATUS      current
    DESCRIPTION
        "The data-link encapsulation format or the
         'detagged_frame_type' in a Protocol Template."
    REFERENCE
        "IEEE 802.1v clause 8.6.2"
    ::= { dot1vProtocolGroupEntry 1 }

dot1vProtocolTemplateProtocolValue OBJECT-TYPE
    SYNTAX      OCTET STRING (SIZE (2 | 5))
    MAX-ACCESS  not-accessible
    STATUS      current
    DESCRIPTION
        "The identification of the protocol above the data-link
         layer in a Protocol Template.  Depending on the
         frame type, the octet string will have one of the
         following values:

         For 'ethernet', 'rfc1042' and 'snap8021H',
             this is the 16-bit (2-octet) IEEE 802.3 Type Field.
         For 'snapOther',
             this is the 40-bit (5-octet) PID.
         For 'llcOther',
             this is the 2-octet IEEE 802.2 Link Service Access
             Point (LSAP) pair: first octet for Destination Service
             Access Point (DSAP) and second octet for Source Service
             Access Point (SSAP)."
    REFERENCE
        "IEEE 802.1v clause 8.6.2"
    ::= { dot1vProtocolGroupEntry 2 }

dot1vProtocolGroupId OBJECT-TYPE
    SYNTAX      Integer32 (0..2147483647)
    MAX-ACCESS  read-create
    STATUS      current
    DESCRIPTION
        "Represents a group of protocols that are associated
         together when assigning a VID to a frame."
    REFERENCE
        "IEEE 802.1v clause 8.6.3, 12.10.2.1"
    ::= { dot1vProtocolGroupEntry 3 }

dot1vProtocolGroupRowStatus OBJECT-TYPE
    SYNTAX      RowStatus
    MAX-ACCESS  read-create
Top   ToC   RFC4363 - Page 80
    STATUS      current
    DESCRIPTION
        "This object indicates the status of this entry."
    ::= { dot1vProtocolGroupEntry 4 }

dot1vProtocolPortTable OBJECT-TYPE
    SYNTAX      SEQUENCE OF Dot1vProtocolPortEntry
    MAX-ACCESS  not-accessible
    STATUS      current
    DESCRIPTION
        "A table that contains VID sets used for
         Port-and-Protocol-based VLAN Classification."
    REFERENCE
        "IEEE 802.1v clause 8.4.4"
    ::= { dot1vProtocol 2 }

dot1vProtocolPortEntry OBJECT-TYPE
    SYNTAX      Dot1vProtocolPortEntry
    MAX-ACCESS  not-accessible
    STATUS      current
    DESCRIPTION
        "A VID set for a port."
    INDEX       { dot1dBasePort,
                  dot1vProtocolPortGroupId }
    ::= { dot1vProtocolPortTable 1 }

Dot1vProtocolPortEntry ::=
    SEQUENCE {
        dot1vProtocolPortGroupId
            Integer32,
        dot1vProtocolPortGroupVid
            Integer32,
        dot1vProtocolPortRowStatus
            RowStatus
    }

dot1vProtocolPortGroupId OBJECT-TYPE
    SYNTAX      Integer32 (1..2147483647)
    MAX-ACCESS  not-accessible
    STATUS      current
    DESCRIPTION
        "Designates a group of protocols in the Protocol
         Group Database."
    REFERENCE
        "IEEE 802.1v clause 8.6.3, 12.10.1.2"
    ::= { dot1vProtocolPortEntry 1 }

dot1vProtocolPortGroupVid OBJECT-TYPE
Top   ToC   RFC4363 - Page 81
    SYNTAX      Integer32 (1..4094)
    MAX-ACCESS  read-create
    STATUS      current
    DESCRIPTION
        "The VID associated with a group of protocols for
         each port."
    REFERENCE
        "IEEE 802.1v clause 8.4.4, 12.10.1.2"
    ::= { dot1vProtocolPortEntry 2 }

dot1vProtocolPortRowStatus OBJECT-TYPE
    SYNTAX      RowStatus
    MAX-ACCESS  read-create
    STATUS      current
    DESCRIPTION
        "This object indicates the status of this entry."
    ::= { dot1vProtocolPortEntry 3 }

-- -------------------------------------------------------------
-- IEEE 802.1Q MIB - Conformance Information
-- -------------------------------------------------------------

qBridgeConformance OBJECT IDENTIFIER ::= { qBridgeMIB 2 }

qBridgeGroups OBJECT IDENTIFIER ::= { qBridgeConformance 1 }

qBridgeCompliances OBJECT IDENTIFIER ::= { qBridgeConformance 2 }

-- -------------------------------------------------------------
-- units of conformance
-- -------------------------------------------------------------

qBridgeBaseGroup OBJECT-GROUP
    OBJECTS {
        dot1qVlanVersionNumber,
        dot1qMaxVlanId,
        dot1qMaxSupportedVlans,
        dot1qNumVlans,
        dot1qGvrpStatus
    }
    STATUS      current
    DESCRIPTION
        "A collection of objects providing device-level control
        and status information for the Virtual LAN bridge
        services."
    ::= { qBridgeGroups 1 }

qBridgeFdbUnicastGroup OBJECT-GROUP
Top   ToC   RFC4363 - Page 82
    OBJECTS {
        dot1qFdbDynamicCount,
        dot1qTpFdbPort,
        dot1qTpFdbStatus
    }
    STATUS      current
    DESCRIPTION
        "A collection of objects providing information about all
        unicast addresses, learned dynamically or statically
        configured by management, in each Filtering Database."
    ::= { qBridgeGroups 2 }

qBridgeFdbMulticastGroup OBJECT-GROUP
    OBJECTS {
        dot1qTpGroupEgressPorts,
        dot1qTpGroupLearnt
    }
    STATUS      current
    DESCRIPTION
        "A collection of objects providing information about all
        multicast addresses, learned dynamically or statically
        configured by management, in each Filtering Database."
    ::= { qBridgeGroups 3 }

qBridgeServiceRequirementsGroup OBJECT-GROUP
    OBJECTS {
        dot1qForwardAllPorts,
        dot1qForwardAllStaticPorts,
        dot1qForwardAllForbiddenPorts,
        dot1qForwardUnregisteredPorts,
        dot1qForwardUnregisteredStaticPorts,
        dot1qForwardUnregisteredForbiddenPorts
    }
    STATUS      current
    DESCRIPTION
        "A collection of objects providing information about
        service requirements, learned dynamically or statically
        configured by management, in each Filtering Database."
    ::= { qBridgeGroups 4 }

qBridgeFdbStaticGroup OBJECT-GROUP
    OBJECTS {
        dot1qStaticUnicastAllowedToGoTo,
        dot1qStaticUnicastStatus,
        dot1qStaticMulticastStaticEgressPorts,
        dot1qStaticMulticastForbiddenEgressPorts,
        dot1qStaticMulticastStatus
    }
Top   ToC   RFC4363 - Page 83
    STATUS      current
    DESCRIPTION
        "A collection of objects providing information about
        unicast and multicast addresses statically configured by
        management, in each Filtering Database or VLAN."
    ::= { qBridgeGroups 5 }

qBridgeVlanGroup OBJECT-GROUP
    OBJECTS {
        dot1qVlanNumDeletes,
        dot1qVlanFdbId,
        dot1qVlanCurrentEgressPorts,
        dot1qVlanCurrentUntaggedPorts,
        dot1qVlanStatus,
        dot1qVlanCreationTime
    }
    STATUS      current
    DESCRIPTION
        "A collection of objects providing information about
        all VLANs currently configured on this device."
    ::= { qBridgeGroups 6 }

qBridgeVlanStaticGroup OBJECT-GROUP
    OBJECTS {
        dot1qVlanStaticName,
        dot1qVlanStaticEgressPorts,
        dot1qVlanForbiddenEgressPorts,
        dot1qVlanStaticUntaggedPorts,
        dot1qVlanStaticRowStatus,
        dot1qNextFreeLocalVlanIndex
    }
    STATUS      current
    DESCRIPTION
        "A collection of objects providing information about
        VLANs statically configured by management."
    ::= { qBridgeGroups 7 }

qBridgePortGroup OBJECT-GROUP
    OBJECTS {
        dot1qPvid,
        dot1qPortAcceptableFrameTypes,
        dot1qPortIngressFiltering,
        dot1qPortGvrpStatus,
        dot1qPortGvrpFailedRegistrations,
        dot1qPortGvrpLastPduOrigin
    }
    STATUS      deprecated
    DESCRIPTION
Top   ToC   RFC4363 - Page 84
        "A collection of objects providing port-level VLAN
        control and status information for all ports."
    ::= { qBridgeGroups 8 }

qBridgeVlanStatisticsGroup OBJECT-GROUP
    OBJECTS {
        dot1qTpVlanPortInFrames,
        dot1qTpVlanPortOutFrames,
        dot1qTpVlanPortInDiscards
    }
    STATUS      current
    DESCRIPTION
        "A collection of objects providing per-port packet
        statistics for all VLANs currently configured on this
        device."
    ::= { qBridgeGroups 9 }

qBridgeVlanStatisticsOverflowGroup OBJECT-GROUP
    OBJECTS {
        dot1qTpVlanPortInOverflowFrames,
        dot1qTpVlanPortOutOverflowFrames,
        dot1qTpVlanPortInOverflowDiscards
    }
    STATUS      current
    DESCRIPTION
        "A collection of objects providing overflow counters for
        per-port packet statistics for all VLANs currently configured
        on this device for high-capacity interfaces, defined as those
        that have the value of the corresponding instance of
        ifSpeed greater than 650,000,000 bits/second."
    ::= { qBridgeGroups 10 }

qBridgeVlanHCStatisticsGroup OBJECT-GROUP
    OBJECTS {
        dot1qTpVlanPortHCInFrames,
        dot1qTpVlanPortHCOutFrames,
        dot1qTpVlanPortHCInDiscards
    }
    STATUS      current
    DESCRIPTION
        "A collection of objects providing per-port packet
        statistics for all VLANs currently configured on this
        device for high-capacity interfaces, defined as those
        that have the value of the corresponding instance of
        ifSpeed greater than 650,000,000 bits/second."
    ::= { qBridgeGroups 11 }

qBridgeLearningConstraintsGroup OBJECT-GROUP
Top   ToC   RFC4363 - Page 85
    OBJECTS {
        dot1qConstraintType,
        dot1qConstraintStatus
    }
    STATUS      current
    DESCRIPTION
        "A collection of objects defining the Filtering Database
        constraints all VLANs have with each other."
    ::= { qBridgeGroups 12 }

qBridgeLearningConstraintDefaultGroup OBJECT-GROUP
    OBJECTS {
        dot1qConstraintSetDefault,
        dot1qConstraintTypeDefault
    }
    STATUS      current
    DESCRIPTION
        "A collection of objects defining the default Filtering
        Database constraints for VLANs that have no specific
        constraints defined."
    ::= { qBridgeGroups 13 }

qBridgeClassificationDeviceGroup OBJECT-GROUP
    OBJECTS {
        dot1vProtocolGroupId,
        dot1vProtocolGroupRowStatus
    }
    STATUS      current
    DESCRIPTION
        "VLAN classification information for the bridge."
    ::= { qBridgeGroups 14 }

qBridgeClassificationPortGroup OBJECT-GROUP
    OBJECTS {
        dot1vProtocolPortGroupVid,
        dot1vProtocolPortRowStatus
    }
    STATUS      current
    DESCRIPTION
        "VLAN classification information for individual ports."
    ::= { qBridgeGroups 15 }

qBridgePortGroup2 OBJECT-GROUP
    OBJECTS {
        dot1qPvid,
        dot1qPortAcceptableFrameTypes,
        dot1qPortIngressFiltering,
        dot1qPortGvrpStatus,
Top   ToC   RFC4363 - Page 86
        dot1qPortGvrpFailedRegistrations,
        dot1qPortGvrpLastPduOrigin,
        dot1qPortRestrictedVlanRegistration
    }
    STATUS      current
    DESCRIPTION
        "A collection of objects providing port-level VLAN
        control and status information for all ports."
    ::= { qBridgeGroups 16 }

-- -------------------------------------------------------------
-- compliance statements
-- -------------------------------------------------------------

qBridgeCompliance MODULE-COMPLIANCE
    STATUS  deprecated
    DESCRIPTION
        "The compliance statement for device support of Virtual
        LAN Bridge services.

        RFC2674 was silent about the expected persistence of the
        read-write objects in this MIB module.  Applications MUST
        NOT assume that the values of the read-write objects are
        persistent across reinitializations of the management
        system and MUST NOT assume that the values are not
        persistent across reinitializations of the management
        system."

    MODULE
        MANDATORY-GROUPS {
            qBridgeBaseGroup,
            qBridgeVlanGroup,
            qBridgeVlanStaticGroup,
            qBridgePortGroup
        }

        GROUP       qBridgeFdbUnicastGroup
        DESCRIPTION
            "This group is mandatory for bridges that implement
            802.1Q transparent bridging."

        GROUP       qBridgeFdbMulticastGroup
        DESCRIPTION
            "This group is mandatory for bridges that implement
            802.1Q transparent bridging."

        GROUP       qBridgeServiceRequirementsGroup
        DESCRIPTION
Top   ToC   RFC4363 - Page 87
            "This group is mandatory for bridges that implement
            extended filtering services.  All objects must be
            read-write if extended-filtering services are
            enabled."

        GROUP       qBridgeFdbStaticGroup
        DESCRIPTION
            "This group is optional."

        GROUP       qBridgeVlanStatisticsGroup
        DESCRIPTION
            "This group is optional as there may be significant
            implementation cost associated with its support."

        GROUP       qBridgeVlanStatisticsOverflowGroup
        DESCRIPTION
            "This group is optional as there may be significant
            implementation cost associated with its support.  It is most
            relevant for high-capacity interfaces where the SNMP agent
            supports only SNMPv1."

        GROUP       qBridgeVlanHCStatisticsGroup
        DESCRIPTION
            "This group is optional as there may be significant
            implementation cost associated with its support.  It is most
            relevant for high-capacity interfaces."

        GROUP       qBridgeLearningConstraintsGroup
        DESCRIPTION
            "This group is mandatory for devices implementing
             both Independent VLAN Learning (IVL) and Shared
             VLAN Learning (SVL) modes of operation of the
             filtering database, as defined by IEEE 802.1Q."

        GROUP       qBridgeLearningConstraintDefaultGroup
        DESCRIPTION
            "This group is mandatory for devices implementing
             both Independent VLAN Learning (IVL) and Shared
             VLAN Learning (SVL) modes of operation of the
             filtering database, as defined by IEEE 802.1Q."

        OBJECT      dot1qPortAcceptableFrameTypes
        MIN-ACCESS  read-only
        DESCRIPTION
            "Write access is not required as this is an optional
            capability in IEEE 802.1Q."

        OBJECT      dot1qPortIngressFiltering
Top   ToC   RFC4363 - Page 88
        MIN-ACCESS  read-only
        DESCRIPTION
            "Write access is not required as this is an optional
            capability in IEEE 802.1Q."

        OBJECT      dot1qConstraintSetDefault
        MIN-ACCESS  read-only
        DESCRIPTION
            "Write access is not required as this is an optional
            capability in IEEE 802.1Q."

        OBJECT      dot1qConstraintTypeDefault
        MIN-ACCESS  read-only
        DESCRIPTION
            "Write access is not required as this is an optional
            capability in IEEE 802.1Q."

       ::= { qBridgeCompliances 1 }

qBridgeCompliance2 MODULE-COMPLIANCE
    STATUS  current
    DESCRIPTION
        "The compliance statement for device support of Virtual
        LAN Bridge services.

        This document clarifies the persistence requirements for
        the read-write objects in this MIB module.  All
        implementations claiming compliance to qBridgeCompliance2
        MUST retain the values of those read-write objects that
        specify this requirement."

    MODULE
        MANDATORY-GROUPS {
            qBridgeBaseGroup,
            qBridgeVlanGroup,
            qBridgeVlanStaticGroup,
            qBridgePortGroup2
        }

        GROUP       qBridgeFdbUnicastGroup
        DESCRIPTION
            "This group is mandatory for bridges that implement
            802.1Q transparent bridging."

        GROUP       qBridgeFdbMulticastGroup
        DESCRIPTION
            "This group is mandatory for bridges that implement
            802.1Q transparent bridging."
Top   ToC   RFC4363 - Page 89
        GROUP       qBridgeServiceRequirementsGroup
        DESCRIPTION
            "This group is mandatory for bridges that implement
            extended filtering services.  All objects must be
            read-write if extended-filtering services are
            enabled."

        GROUP       qBridgeFdbStaticGroup
        DESCRIPTION
            "This group is optional."

        GROUP       qBridgeVlanStatisticsGroup
        DESCRIPTION
            "This group is optional as there may be significant
            implementation cost associated with its support."

        GROUP       qBridgeVlanStatisticsOverflowGroup
        DESCRIPTION
            "This group is optional as there may be significant
            implementation cost associated with its support.  It is most
            relevant for high-capacity interfaces where the SNMP agent
            supports only SNMPv1."

        GROUP       qBridgeVlanHCStatisticsGroup
        DESCRIPTION
            "This group is optional as there may be significant
            implementation cost associated with its support.  It is most
            relevant for high-capacity interfaces."

        GROUP       qBridgeLearningConstraintsGroup
        DESCRIPTION
            "This group is mandatory for devices implementing
             both Independent VLAN Learning (IVL) and Shared
             VLAN Learning (SVL) modes of operation of the
             filtering database, as defined by IEEE 802.1Q."

        GROUP       qBridgeLearningConstraintDefaultGroup
        DESCRIPTION
            "This group is mandatory for devices implementing
             both Independent VLAN Learning (IVL) and Shared
             VLAN Learning (SVL) modes of operation of the
             filtering database, as defined by IEEE 802.1Q."

        GROUP       qBridgeClassificationDeviceGroup
        DESCRIPTION
            "This group is mandatory ONLY for devices implementing
             VLAN Classification as specified in IEEE 802.1v."
Top   ToC   RFC4363 - Page 90
        GROUP       qBridgeClassificationPortGroup
        DESCRIPTION
            "This group is mandatory ONLY for devices implementing
             VLAN Classification as specified in IEEE 802.1v."

        OBJECT      dot1qPortAcceptableFrameTypes
        MIN-ACCESS  read-only
        DESCRIPTION
            "Write access is not required as this is an optional
            capability in IEEE 802.1Q."

        OBJECT      dot1qPortIngressFiltering
        MIN-ACCESS  read-only
        DESCRIPTION
            "Write access is not required as this is an optional
            capability in IEEE 802.1Q."

        OBJECT      dot1qConstraintSetDefault
        MIN-ACCESS  read-only
        DESCRIPTION
            "Write access is not required as this is an optional
            capability in IEEE 802.1Q."

        OBJECT      dot1qConstraintTypeDefault
        MIN-ACCESS  read-only
        DESCRIPTION
            "Write access is not required as this is an optional
            capability in IEEE 802.1Q."

        OBJECT      dot1vProtocolGroupId
        MIN-ACCESS  read-only
        DESCRIPTION
            "Write access is not required as this is an optional
            capability in IEEE 802.1v."

        OBJECT      dot1vProtocolGroupRowStatus
        MIN-ACCESS  read-only
        DESCRIPTION
            "Write access is not required as this is an optional
            capability in IEEE 802.1v."

        ::= { qBridgeCompliances 2 }

END
Top   ToC   RFC4363 - Page 91

6. Acknowledgements

Much of the groundwork for this document was performed by the IEEE 802.1 working group during the definition of the IEEE 802.1D updates [802.1D] and IEEE 802.1Q [802.1Q]. The authors wish to thank the members of the Bridge Working Group, and David Harrington, Anders SW Christensen, Andrew Smith, Paul Langille, Anil Rijhsinghani, and Keith McCloghrie in particular for their comments and suggestions, which improved this effort. Editing for the final version was done by David Levi. The new textual conventions related to VLAN-IDs were produced as a result of a review of the use of VLAN-ID in several MIB modules. Further investigation found that VLAN-ID objects were defined in a few other MIB modules. The editor would like to thank all who contributed to the discussion that resulted in these new textual conventions. Specifically, Bert Wijnen, Les Bell, Andrew Smith, Mike Heard, Randy Presuhn, Dan Romascanu, Eduardo Cardona, Tom Petch, Juergen Schoenwaelder, Richard Woundy, Tony Jeffree, and William Murwin. We also received input and feedback from IEEE confirming that the values 0 and 4095 are not used for identifying a specific VLAN-ID and so can be used to represent none or a wildcard (see Appendix A).

7. Security Considerations

There are a number of management objects defined in this MIB module with a MAX-ACCESS clause of read-write and/or read-create. Such objects may be considered sensitive or vulnerable in some network environments. The support for SET operations in a non-secure environment without proper protection can have a negative effect on network operations. These tables and objects and their sensitivity/vulnerability are described below. The following tables and objects in the P-BRIDGE-MIB can be manipulated to interfere with the operation of priority classes. This could, for example, be used to force a reinitialization of state machines, thus causing network instability. Another possibility would be for an attacker to override established policy on port priorities, thus giving a user (or an attacker) unauthorized preferential treatment. dot1dTrafficClassesEnabled dot1dGmrpStatus dot1dPortPriorityTable dot1dUserPriorityRegenTable
Top   ToC   RFC4363 - Page 92
         dot1dTrafficClassTable
         dot1dPortGarpTable
         dot1dPortGmrpTable

   The following tables and objects in the Q-BRIDGE-MIB could be
   manipulated to interfere with the operation of virtual LANs.  This
   could, for example, be used to force a reinitialization of state
   machines to cause network instability, or changing the forwarding and
   filtering policies.

         dot1qGvrpStatus
         dot1qForwardAllTable
         dot1qStaticUnicastTable
         dot1qStaticMulticastTable
         dot1qVlanStaticTable
         dot1qPortVlanTable
         dot1qLearningConstraintsTable
         dot1vProtocolGroupTable
         dot1vProtocolPortTable

   Some of the readable objects in this MIB module (i.e., objects with a
   MAX-ACCESS other than not-accessible) may be considered sensitive or
   vulnerable in some network environments.  It is thus important to
   control even GET and/or NOTIFY access to these objects and possibly
   to even encrypt the values of these objects when sending them over
   the network via SNMP.  These are the tables and objects and their
   sensitivity/vulnerability.

   The objects dot1dDeviceCapabilities and dot1dPortCapabilitiesTable in
   the P-BRIDGE-MIB could be used by an attacker to determine which
   attacks might be useful to attempt against a given device.

   The following read-only tables and objects in the Q-BRIDGE-MIB could
   be used by an attacker to determine which attacks might be useful to
   attempt against a given device, could be used by an attacker to
   detect whether their attacks are being blocked or filtered, or could
   be used to understand the logical topology of the network.

         dot1qMaxVlanID
         dot1qMaxSupportedVlans
         dot1qNumVlans
         dot1qFdbTable
         dot1qTpFdbTable
         dot1qTpGroupTable
         dot1qVlanCurrentTable
         dot1qPortVlanStatisticsTable
Top   ToC   RFC4363 - Page 93
   SNMP versions prior to SNMPv3 did not include adequate security.
   Even if the network itself is secure (for example by using IPSec),
   even then, there is no control as to who on the secure network is
   allowed to access and GET/SET (read/change/create/delete) the objects
   in this MIB module.

   It is RECOMMENDED that implementers consider the security features as
   provided by the SNMPv3 framework (see [RFC3410], section 8),
   including full support for the SNMPv3 cryptographic mechanisms (for
   authentication and privacy).

   Further, deployment of SNMP versions prior to SNMPv3 is NOT
   RECOMMENDED.  Instead, it is RECOMMENDED to deploy SNMPv3 and to
   enable cryptographic security.  It is then a customer/operator
   responsibility to ensure that the SNMP entity giving access to an
   instance of this MIB module is properly configured to give access to
   the objects only to those principals (users) that have legitimate
   rights to indeed GET or SET (change/create/delete) them.

8. Normative References

[BRIDGE-MIB] Norseth, K. and E. Bell, "Definitions of Managed Objects for Bridges", RFC 4188, September 2005. [RFC2578] McCloghrie, K., Perkins, D., and J. Schoenwaelder, "Structure of Management Information Version 2 (SMIv2)", STD 58, RFC 2578, April 1999. [RFC2579] McCloghrie, K., Perkins, D., and J. Schoenwaelder, "Textual Conventions for SMIv2", STD 58, RFC 2579, April 1999. [RFC2580] McCloghrie, K., Perkins, D., and J. Schoenwaelder, "Conformance Statements for SMIv2", STD 58, RFC 2580, April 1999. [RFC2674] Bell, E., Smith, A., Langille, P., Rijhsinghani, A., and K. McCloghrie, "Definitions of Managed Objects for Bridges with Traffic Classes, Multicast Filtering and Virtual LAN Extensions", RFC 2674, August 1999. [RFC2863] McCloghrie, K. and F. Kastenholz, "The Interfaces Group MIB", RFC 2863, June 2000. [RFC3418] Presuhn, R., "Management Information Base (MIB) for the Simple Network Management Protocol (SNMP)", STD 62, RFC 3418, December 2002.
Top   ToC   RFC4363 - Page 94
   [802.1D]     "Information technology - Telecommunications and
                information exchange between systems - Local and
                metropolitan area networks - Common specifications -
                Part 3: Media Access Control (MAC) Bridges:  Revision.
                This is a revision of ISO/IEC 10038: 1993, 802.1j-1992
                and 802.6k-1992.  It incorporates P802.11c, P802.1p and
                P802.12e."  ISO/IEC 15802-3: 1998.

   [802.1Q]     ANSI/IEEE Standard 802.1Q, "IEEE Standards for Local and
                Metropolitan Area Networks: Virtual Bridged Local Area
                Networks", 2003.

   [802.1t]     IEEE 802.1t-2001, "(Amendment to IEEE Standard 802.1D)
                IEEE Standard for Information technology -
                Telecommunications and information exchange between
                systems - Local and metropolitan area networks - Common
                specifications - Part 3: Media Access Control (MAC)
                Bridges: Technical and Editorial Corrections".

   [802.1u]     IEEE 802.1u-2001, "(Amendment to IEEE Standard 802.1Q)
                IEEE Standard for Local and metropolitan area networks -
                Virtual Bridged Local Area Networks - Amendment 1:
                Technical and Editorial Corrections".

   [802.1v]     IEEE 802.1v-2001, "(Amendment to IEEE Standard 802.1Q)
                IEEE Standards for Local and Metropolitan Area Networks:
                Virtual Bridged Local Area Networks--Amendment 2: VLAN
                Classification by Protocol and Port".

9. Informative References

[RFC1493] Decker, E., Langille, P., Rijsinghani, A. and K. McCloghrie, "Definitions of Managed Objects for Bridges", RFC 1493, July 1993. [RFC4323] Patrick, M. and W. Murwin, "Data Over Cable System Interface Specification Quality of Service Management Information Base (DOCSIS-QOS MIB)", RFC 4323, January 2006. [RFC4149] Kalbfleisch, C., Cole, R., and D. Romascanu, "Definition of Managed Objects for Synthetic Sources for Performance Monitoring Algorithms", RFC 4149, August 2005. [RFC2613] Waterman, R., Lahaye, B., Romascanu, D., and S. Waldbusser, "Remote Network Monitoring MIB Extensions for Switched Networks Version 1.0", RFC 2613, June 1999.
Top   ToC   RFC4363 - Page 95
   [RFC3318]    Sahita, R., Hahn, S., Chan, K., and K. McCloghrie,
                "Framework Policy Information Base", RFC 3318, March
                2003.

   [RFC3410]    Case, J., Mundy, R., Partain, D., and B. Stewart,
                "Introduction and Applicability Statements for
                Internet-Standard Management Framework", RFC 3410,
                December 2002.
Top   ToC   RFC4363 - Page 96

Appendix A. Email from Tony Jeffrey from IEEE

-----Original Message----- From: Tony Jeffree [mailto:tony@jeffree.co.uk] Sent: Friday, 6th of June 2003 17:16 To: Wijnen, Bert (Bert) [mailto:bwijnen@lucent.com] Subject: RE: VLAn ID Bert et al - We have concluded that the use of 4095 as a wildcard is acceptable to 802.1, and we will make any necessary changes to 802.1Q in due course to relax the current stated restriction. However, we need to know whether that is all that needs to be done to 802.1Q - i.e., is there any need to change our definitions of the managed objects in the document (Clause 12) to reflect the interpretation of 4095 as a wildcard, or is this simply an issue for the SNMP machinery to handle? Regards, Tony
Top   ToC   RFC4363 - Page 97

Authors' Adresses

David Levi Nortel Networks 4655 Great America Parkway Santa Clara, CA 95054 USA Phone: +1 865 686 0432 EMail: dlevi@nortel.com David Harrington Effective Software 50 Harding Rd. Portsmouth, NH 03801 USA Phone: +1 603 436 8634 EMail: ietfdbh@comcast.net Vivian Ngai Salt lake City, UT USA EMail: vivian_ngai@acm.org Les Bell Hemel Hempstead Herts. HP2 7YU UK EMail: elbell@ntlworld.com Andrew Smith Beijing Harbour Networks Jiuling Building 21 North Xisanhuan Ave. Beijing, 100089 PRC Fax: +1 415 345 1827 EMail: ah_smith@acm.org
Top   ToC   RFC4363 - Page 98
   Paul Langille
   Newbridge Networks
   5 Corporate Drive
   Andover, MA 01810
   USA

   Phone: +1 978 691 4665
   EMail: langille@newbridge.com


   Anil Rijhsinghani
   Accton Technology Corporation
   5 Mount Royal Ave
   Marlboro, MA 01752
   USA
   EMail: anil@accton.com


   Keith McCloghrie
   Cisco Systems, Inc.
   170 West Tasman Drive
   San Jose, CA 95134-1706
   USA

   Phone: +1 408 526 5260
   EMail: kzm@cisco.com
Top   ToC   RFC4363 - Page 99
Full Copyright Statement

   Copyright (C) The Internet Society (2006).

   This document is subject to the rights, licenses and restrictions
   contained in BCP 78, and except as set forth therein, the authors
   retain all their rights.

   This document and the information contained herein are provided on an
   "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
   OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
   ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
   INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
   INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
   WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Intellectual Property

   The IETF takes no position regarding the validity or scope of any
   Intellectual Property Rights or other rights that might be claimed to
   pertain to the implementation or use of the technology described in
   this document or the extent to which any license under such rights
   might or might not be available; nor does it represent that it has
   made any independent effort to identify any such rights.  Information
   on the procedures with respect to rights in RFC documents can be
   found in BCP 78 and BCP 79.

   Copies of IPR disclosures made to the IETF Secretariat and any
   assurances of licenses to be made available, or the result of an
   attempt made to obtain a general license or permission for the use of
   such proprietary rights by implementers or users of this
   specification can be obtained from the IETF on-line IPR repository at
   http://www.ietf.org/ipr.

   The IETF invites any interested party to bring to its attention any
   copyrights, patents or patent applications, or other proprietary
   rights that may cover technology that may be required to implement
   this standard.  Please address the information to the IETF at
   ietf-ipr@ietf.org.

Acknowledgement

   Funding for the RFC Editor function is provided by the IETF
   Administrative Support Activity (IASA).