Definitions of Managed Objects for Bridges with Rapid Spanning Tree Protocol
Extracted elements (22)
The Bridge MIB Working Group decided to freeze the technical content of the MIB modules at a level compatible with 802.1t and 802.1w, rather than tracking 802.1D-2004, due to concerns that 802.1D-2004 changes would require non-backward-compatible SMI changes. Future updates are left to the IEEE 802.1 working group.
The RSTP-MIB supplements but does not replace the Bridge MIB (RFC 4188). RFC 4188 updated the original RFC 1493 Bridge MIB to SMIv2, added dot1dStpPortPathCost32 for 802.1t support, and clarified interpretations of dot1dStpPriority, dot1dStpPortPriority, and dot1dStpTimeSinceTopologyChange for RSTP.
It is RECOMMENDED that implementers support the SNMPv3 framework including full cryptographic mechanisms for authentication and privacy. Deployment of SNMP versions prior to SNMPv3 is NOT RECOMMENDED; SNMPv3 with cryptographic security SHOULD be deployed instead.
The value of dot1dStpPortAdminEdgePort MUST be retained across reinitializations of the management system.
The value of dot1dStpPortAdminPathCost MUST be retained across reinitializations of the management system.
The value of dot1dStpPortAdminPointToPoint MUST be retained across reinitializations of the management system.
The value of dot1dStpTxHoldCount MUST be retained across reinitializations of the management system.
The value of dot1dStpVersion MUST be retained across reinitializations of the management system.
dot1dStpExtPortTable (dot1dStp 19) is a table augmenting dot1dStpPortEntry that contains port-specific RSTP information: ProtocolMigration, AdminEdgePort, OperEdgePort, AdminPointToPoint, OperPointToPoint, and AdminPathCost.
dot1dStpPortAdminEdgePort is a read-write TruthValue representing the administrative Edge Port parameter. Setting it to true(1) assumes edge-port status; setting it also sets dot1dStpPortOperEdgePort, though OperEdgePort reverts to false upon receipt of a BPDU.
dot1dStpPortAdminPathCost is a read-write Integer32 (0..200000000) for the administratively assigned path cost contribution toward the spanning tree root. Writing 0 assigns the automatically calculated default; the object returns 0 when the default is in use.
dot1dStpPortAdminPointToPoint is a read-write INTEGER with values forceTrue(0), forceFalse(1), and auto(2). In auto mode, the port is point-to-point if it is an aggregator with all aggregatable members or if the MAC is configured for full duplex.
dot1dStpPortOperEdgePort is a read-only TruthValue representing the operational Edge Port parameter. It is initialized from dot1dStpPortAdminEdgePort and is set to false upon reception of a BPDU, regardless of the administrative setting.
dot1dStpPortOperPointToPoint is a read-only TruthValue indicating the operational point-to-point status. When adminPointToPointMAC is auto(2), the value is determined dynamically per IEEE 802.1w clause 6.5 procedures and re-evaluated on any relevant change.
dot1dStpPortProtocolMigration is a read-write TruthValue; writing true(1) when operating in RSTP mode forces the port to transmit RSTP BPDUs. Any other operation has no effect and the object always returns false(2) when read.
dot1dStpTxHoldCount (dot1dStp 17) is a read-write Integer32 in the range 1..10 used by the Port Transmit state machine to limit maximum transmission rate. Default value is 3, corresponding to IEEE 802.1w clause 17.16.6 TxHoldCount.
dot1dStpVersion (dot1dStp 16) is a read-write INTEGER indicating the STP version currently running: stpCompatible(0) for IEEE 802.1D-1998 or rstp(2) for IEEE 802.1w/802.1D-2004 clause 17. Default value is rstp(2).
rstpCompliance is a MODULE-COMPLIANCE statement requiring two MANDATORY-GROUPS: rstpBridgeGroup (dot1dStpVersion, dot1dStpTxHoldCount) and rstpPortGroup (all six dot1dStpExtPortTable objects). Both groups must be implemented for compliance.
IANA assigned OID { mib-2 134 } to the rstpMIB module. This is the root OID for the entire RSTP-MIB, with subtrees for notifications (0), objects (1), and conformance (2).
dot1dStpPortAdminPointToPoint could be used to mislead an access control protocol such as 802.1x into believing only one system is attached to a LAN segment, potentially enabling man-in-the-middle attacks by granting network access based on that false assumption.
dot1dStpVersion could be read by an attacker to identify environments containing applications or protocols sensitive to RSTP mode, making even GET access to this object potentially sensitive.
Writable MIB objects dot1dStpVersion, dot1dStpTxHoldCount, dot1dStpPortProtocolMigration, dot1dStpPortAdminEdgePort, and dot1dStpPortAdminPathCost could be misused to cause network delays and spanning tree instabilities if SET operations are permitted in a non-secure environment.