-- Copyright (C) 2009-2012 Aricent Group . All Rights Reserved

-- $Id: fsissacl.mib,v 1.11 2015/03/04 10:30:07 siva Exp $

ARICENT-ISS-ACL-MIB DEFINITIONS ::= BEGIN 

IMPORTS 
   MODULE-IDENTITY, OBJECT-TYPE, 
   Counter32, enterprises, IpAddress, Integer32, Unsigned32   
   FROM SNMPv2-SMI 
   InetAddressType, InetAddress, InetAddressPrefixLength,
   InetPortNumber
   FROM INET-ADDRESS-MIB
   RowStatus, TEXTUAL-CONVENTION, MacAddress, TruthValue
   FROM SNMPv2-TC; 

   issAcl MODULE-IDENTITY 
      LAST-UPDATED "201209050000Z" 
      ORGANIZATION "ARICENT COMMUNICATIONS SOFTWARE" 
      CONTACT-INFO "support@aricent.com" 

         DESCRIPTION 
             "Proprietary MIB definition for Access Control Feature" 
         REVISION "201209050000Z"

      DESCRIPTION 
             "Proprietary MIB definition for Access Control Feature" 
   ::= { enterprises  aricent-communication-holding-ltd(29601) iss(2) 21 }


PortList ::= TEXTUAL-CONVENTION
    STATUS      current
    DESCRIPTION
        "Each octet within this value specifies a set of eight
        ports, with the first octet specifying ports 1 through
        8, the second octet specifying ports 9 through 16, etc.
        Within each octet, the most significant bit represents
        the lowest numbered port, and the least significant bit
        represents the highest numbered port.  Thus, each port
        of the bridge is represented by a single bit within the
        value of this object.  If that bit has a value of '1'
        then that port is included in the set of ports; the port
        is not included if its bit has a value of '0'."
    SYNTAX      OCTET STRING

IndexInteger ::= TEXTUAL-CONVENTION
   DISPLAY-HINT "d"
   STATUS   current
   DESCRIPTION
        "An integer which may be used as a table index. If 0 then it is invalid"
   SYNTAX   Unsigned32 (1..65535)


IndexIntegerNextFree ::= TEXTUAL-CONVENTION
    DISPLAY-HINT "d"
    STATUS   current
    DESCRIPTION
       "An integer which may be used as a new Index in a table.

       The special value of 0 indicates that no more new entries can be
       created in the relevant table.

       When a MIB is used for configuration, an object with this SYNTAX
       always contains a legal value (if non-zero) for an index that is
       not currently used in the relevant table. The Command Generator
       (Network Management Application) reads this variable and uses the
       (non-zero) value read when creating a new row with an SNMP SET.
       When the SET is performed, the Command Responder (agent) must
       determine whether the value is indeed still unused; Two Network
       Management Applications may attempt to create a row
       (configuration entry) simultaneously and use the same value. If
       it is currently unused, the SET succeeds and the Command
       Responder (agent) changes the value of this object, according to
       an implementation-specific algorithm.  If the value is in use,

       however, the SET fails.  The Network Management Application must
       then re-read this variable to obtain a new usable value.

       An OBJECT-TYPE definition using this SYNTAX MUST specify the
       relevant table for which the object is providing this
       functionality."
    SYNTAX   Unsigned32 (0..4294967295)
iss    OBJECT IDENTIFIER ::= { enterprises 2076 81 }

EnabledStatus ::= TEXTUAL-CONVENTION
    STATUS      current
    DESCRIPTION
        "A simple status value for the object."
    SYNTAX      INTEGER { enabled(1), disabled(2) }

-- ----------------------------------------------------------------- -- 
-- groups in the MIB  
-- ----------------------------------------------------------------- -- 

      issAclRateControl           OBJECT IDENTIFIER ::= { issAcl 1 }
      issAclL2Filter              OBJECT IDENTIFIER ::= { issAcl 2 }
      issAclL3Filter              OBJECT IDENTIFIER ::= { issAcl 3 }
      issAclUserDefinedFilter     OBJECT IDENTIFIER ::= { issAcl 4 }
      issRedirectInterfaceGrp     OBJECT IDENTIFIER ::= { issAcl 5 }
      issRedirectIdNextFree       OBJECT IDENTIFIER ::= { issAcl 6 }
      issAclTrafficControl        OBJECT IDENTIFIER ::= { issAcl 7 }

-- Rate Control Group --------------------------------------------- --

issAclRateCtrlTable OBJECT-TYPE 
   SYNTAX      SEQUENCE OF IssAclRateCtrlEntry 
   MAX-ACCESS  not-accessible 
   STATUS      current 
   DESCRIPTION 
      "A table to control the rate limiting parameters 
       either for the entire switch or for each physical and port-channel
       interface in the switch."
   ::= { issAclRateControl 1 }

issAclRateCtrlEntry OBJECT-TYPE 
   SYNTAX      IssAclRateCtrlEntry 
   MAX-ACCESS  not-accessible 
   STATUS      current 
   DESCRIPTION 
      "An entry appears in this table for each physical and port-channel
       interface in the switch."
   INDEX { issAclRateCtrlIndex }
   ::= { issAclRateCtrlTable 1 }
   
IssAclRateCtrlEntry ::= 
   SEQUENCE { 
      issAclRateCtrlIndex 
         Integer32, 
      issAclRateCtrlDLFLimitValue
         Integer32, 
      issAclRateCtrlBCASTLimitValue
         Integer32, 
      issAclRateCtrlMCASTLimitValue
         Integer32,
      issAclRateCtrlPortRateLimit
         Integer32,
      issAclRateCtrlPortBurstSize
         Integer32
  }

issAclRateCtrlIndex OBJECT-TYPE 
   SYNTAX      Integer32 (1..65535)
   MAX-ACCESS  not-accessible 
   STATUS      current 
   DESCRIPTION 
      "The interface index for which the configuration in this 
       entry applies."
   ::= { issAclRateCtrlEntry 1 }
    
issAclRateCtrlDLFLimitValue OBJECT-TYPE 
   SYNTAX      Integer32 (0..2147483647)
   MAX-ACCESS  read-write 
   STATUS      current 
   DESCRIPTION 
      "Allows to configure the limiting value for the maximum number
       of dlf packets that can be transmitted per second over this interface.
       Setting this object to the value zero disables rate limiting for 
       Destination lookup failure packets on this interface. The value that
       can be set for this object is limited by the underlying hardware"
       
   DEFVAL  {0}
   ::= { issAclRateCtrlEntry 2 }

issAclRateCtrlBCASTLimitValue OBJECT-TYPE 
   SYNTAX      Integer32 (0..2147483647)
   MAX-ACCESS  read-write 
   STATUS      current 
   DESCRIPTION 
      "Allows to configure the limiting value for the maximum number
       of broadcast packets that can be transmitted per second over this 
       interface. Setting this object to the value zero disables rate 
       limiting for Broadcast packets on this interface. The value that
       can be set for this object is limited by the underlying hardware"
       
   DEFVAL  {0}
   ::= { issAclRateCtrlEntry 3 }


issAclRateCtrlMCASTLimitValue OBJECT-TYPE 
   SYNTAX      Integer32 (0..2147483647)
   MAX-ACCESS  read-write 
   STATUS      current 
   DESCRIPTION 
      "Allows to configure the limiting value for the maximum number
       of multicast packets that can be transmitted per second over this 
       interface. Setting this object to the value zero disables rate 
       limiting for Multicast packets on this interface. The value that
       can be set for this object is limited by the underlying hardware"
       
   DEFVAL  {0}
   ::= { issAclRateCtrlEntry 4}

issAclRateCtrlPortRateLimit OBJECT-TYPE
   SYNTAX      Integer32 (0..80000000)
   MAX-ACCESS  read-write
   STATUS      current
   DESCRIPTION
      "Configures interface Rate Limit (Packet that can be transferred
      on a port at a particular second).

      This object's value will take effect on the interface speed. Based
      on the operating speed of the port, the rate limit will be applied.
      This value can also be affected by the metering. A value of zero(0)
      disable rate limiting i.e. sets the port to full speed."

   ::= { issAclRateCtrlEntry 5 }

issAclRateCtrlPortBurstSize OBJECT-TYPE
   SYNTAX      Integer32 (0..80000000)
   MAX-ACCESS  read-write
   STATUS      current
   DESCRIPTION
      "Configures interface Burst Pkt Rate. (Packet Burst that can be
       transferred on a port at a particular second)

      This object's value will take effect on the interface speed. Based
      on the operating speed of the port, the burst size of the port
      will be applied. This value can also be affected by the metering. A
      value of zero(0) disable burst rate limiting i.e. sets the port burst
      rate limit to full speed."

   ::= { issAclRateCtrlEntry 6 }


   

-- ------------------------------------------------------------------ 
-- L2 Filter Group --------------------------------------------------

issAclL2FilterTable OBJECT-TYPE 

   SYNTAX      SEQUENCE OF IssAclL2FilterEntry
   MAX-ACCESS  not-accessible 
   STATUS      current 
   DESCRIPTION 
       "A table to configure L2 filter rules in the system."
   ::= { issAclL2Filter 1 }

issAclL2FilterEntry OBJECT-TYPE 
   SYNTAX      IssAclL2FilterEntry
   MAX-ACCESS  not-accessible 
   STATUS      current 
   DESCRIPTION 
       "Each entry in this table is a L2 filter rule.
   
       Index to the table is the L2 filter number."
   INDEX { issAclL2FilterNo}
   ::= { issAclL2FilterTable 1 }
   
IssAclL2FilterEntry ::= 
   SEQUENCE { 
      issAclL2FilterNo 
         Integer32, 
      issAclL2FilterPriority 
         Integer32, 
      issAclL2FilterEtherType
         Integer32, 
      issAclL2FilterProtocolType 
         Unsigned32, 
      issAclL2FilterDstMacAddr 
         MacAddress, 
      issAclL2FilterSrcMacAddr 
         MacAddress, 
      issAclL2FilterVlanId 
         Integer32,
      issAclL2FilterInPortList 
         PortList,
      issAclL2FilterAction 
         INTEGER, 
      issAclL2FilterMatchCount
         Counter32, 
      issAclL2FilterStatus
         RowStatus,
      issAclL2FilterOutPortList 
         PortList,
      issAclL2FilterDirection
         INTEGER,
      issAclL2FilterSubAction
         INTEGER, 
      issAclL2FilterSubActionId
         Integer32,
      issAclL2FilterRedirectId
         Integer32,
      issAclL2NextFilterNo 
         Integer32, 
      issAclL2NextFilterType 
         INTEGER,
      issAclL2FilterCreationMode
         INTEGER,
      issAclL2FilterInPortChannelList
         PortList,
      issAclL2FilterOutPortChannelList
         PortList,
      issAclL2FilterStatsEnabledStatus
         EnabledStatus,
      issAclClearL2FilterStats
         TruthValue
  }

issAclL2FilterNo OBJECT-TYPE 
   SYNTAX      Integer32 (1..65535)
   MAX-ACCESS  not-accessible 
   STATUS      current 
   DESCRIPTION 
      "L2 Filter rule number."
   ::= { issAclL2FilterEntry 1 }
    
issAclL2FilterPriority OBJECT-TYPE 
   SYNTAX      Integer32 (1..255)
   MAX-ACCESS  read-write 
   STATUS      current 
   DESCRIPTION 
      "The priority of the L2 filter can be used to decide which filter rule
       is applicable when 
          --> the packet matches with more than one filter rules
          --> All the filter rules result in 'allow'ing the packet

      Higher value of 'filter priority' implies a higher priority.

      Usage of 'L2FilterPriority' is implementation dependant."
   DEFVAL  { 1 }
   ::= { issAclL2FilterEntry 2 }

issAclL2FilterEtherType OBJECT-TYPE 
   SYNTAX      Integer32 (0..65535)
   MAX-ACCESS  read-write 
   STATUS      current 
   DESCRIPTION 
      "The value in the Type/Len field of a frame that will
      be matched to trigger this filter. The default value of
      this object is '0'. When this object is SET with the default
      value, frames are not matched for the value in the Type/Len
      field with the value set for this object."
   DEFVAL  { 0 }
   ::= { issAclL2FilterEntry 3 }

   
issAclL2FilterProtocolType OBJECT-TYPE 
   SYNTAX      Unsigned32 (0..65535) 
   MAX-ACCESS  read-write 
   STATUS      current 
   DESCRIPTION 
      "Specifies the non IP protocol type to be filtered.
       aarp | amber | dec-spanning | decnet-iv | 
       diagnostic | dsm |etype-6000 | etype-8042 | 
       lat | lavc-sca | mop-console | mop-dump | 
       msdos | mumps | netbios | vines-echo |
       vines-ip | xns-idp: A non-IP protocol.

      A value of '0' means, the filter is applicable for all protocols."
   DEFVAL  { 0 }
   ::= { issAclL2FilterEntry 4 }

issAclL2FilterDstMacAddr OBJECT-TYPE 
   SYNTAX      MacAddress
   MAX-ACCESS  read-write 
   STATUS      current 
   DESCRIPTION 
      "Destination MAC address to be matched with the packet. By Default, the
       Destination Mac Address will be zero which means dont care condition ie)
       any Dst Mac Address ."
   ::= { issAclL2FilterEntry 5 }

issAclL2FilterSrcMacAddr OBJECT-TYPE 
   SYNTAX      MacAddress
   MAX-ACCESS  read-write 
   STATUS      current 
   DESCRIPTION 
      "Source MAC address to be matched with the packet. By Default, the Source 
       Mac Address will be zero which means dont care condition ie) any Src Mac 
       address"
   ::= { issAclL2FilterEntry 6 }


issAclL2FilterVlanId OBJECT-TYPE 
   SYNTAX      Integer32 (0..4094)
   MAX-ACCESS  read-write 
   STATUS      current 
   DESCRIPTION 
      "Vlan Id to be filtered. In case of Provider bridges, This Vlan Id will
      be treated as customer Vlan Id. 
      A value of '0' means, this object is unused. Configuring this value is not
      allowed."
   DEFVAL  { 0 }
   ::= { issAclL2FilterEntry 7 }


issAclL2FilterInPortList OBJECT-TYPE 
   SYNTAX      PortList
   MAX-ACCESS  read-write 
   STATUS      current 
   DESCRIPTION 
      "Specifies the complete set of ports over which this filter is applied
       for packets ingress at ports in this list.
       If the In port list is '0', the filter rule is applicable for  the 
       incoming packets on all ports.
       Even though the issAclL2FilterInPortList is configured, It is applicable only
       if issAclL2FilterDirection is configured as 'in'.
       By default inport list is maintained as '0'." 
   ::= { issAclL2FilterEntry 8 }

issAclL2FilterAction OBJECT-TYPE 
   SYNTAX      INTEGER {
                  allow (1),
                  drop  (2),
                  redirect (3),
                  switchandcopytocpu (4),
                  dropandcopytocpu (5)
               }
   MAX-ACCESS  read-write 
   STATUS      current 
   DESCRIPTION 
      "Specifies the action to be taken on the packet if the filter
      rule matches.
      If the action is 'allow', the packet will be forwarded according
      to the forwarding rules.
      If the action is 'drop', the packet will be discarded.
      If the action is 'redirect', the packet will be switched according
      to the redirect rules.
      If the action is 'switch-and-copy-to-cpu', packet is switched and a copy of the
      packet is sent to the CPU.
      If the action is 'drop-and-copy-to-cpu', packet is not switched but only 
      sent to the CPU."
   DEFVAL  { allow } 
   ::= { issAclL2FilterEntry 9 }

issAclL2FilterMatchCount OBJECT-TYPE 
   SYNTAX      Counter32
   MAX-ACCESS  read-only 
   STATUS      current 
   DESCRIPTION 
      "Number of times this filter is matched."

   ::= { issAclL2FilterEntry 10 }

issAclL2FilterStatus OBJECT-TYPE 
   SYNTAX      RowStatus
   MAX-ACCESS  read-create 
   STATUS      current 
   DESCRIPTION 
        "This object indicates the status of this entry. An entry is
        created in this table when this object is SET to 'createAndWait'.
        The entry in this table is used when the status of this object 
        is SET 'active'. The entry in this table is not used when this 
        object is SET 'notInService'. An entry created in this table is
        be deleted when this object is SET 'destroy'. The entry status will 
        be made 'active' only if either of In/Out PortList or In/Out 
        PortChannelList are configured in case of l2Filter."
   ::= { issAclL2FilterEntry 11 }

issAclL2FilterOutPortList OBJECT-TYPE 
   SYNTAX      PortList
   MAX-ACCESS  read-write 
   STATUS      current 
   DESCRIPTION 
      "Specifies the complete set of ports over which this filter is applied
       for packets egress at Ports in this list.
      If the Out port list is '0', the filter rule is applicable for  the 
      outgoing packets on all ports.
      Even though the issAclL2FilterOutPortList is configured, It is applicable only
      if issAclL2FilterDirection is configured as 'out'.
      By default outport list is maintained as '0'." 
   ::= { issAclL2FilterEntry 12 }
   
issAclL2FilterDirection OBJECT-TYPE 
   SYNTAX      INTEGER {
                    in (1),
                    out (2)
               }
   MAX-ACCESS  read-write 
   STATUS      current 
   DESCRIPTION 
      "Specifies the direction of this filter to be applied. By Default the
      filter will be applied on ingress direction.
      When the direction of this filter is 'in', It is applied on specified
      ports of the issAclL2FilterInPortList.
      When the direction of this filter is 'out', It is applied on specified
      ports of the issAclL2FilterOutPortList."
   DEFVAL  { in } 
   ::= { issAclL2FilterEntry 13 }

issAclL2FilterSubAction OBJECT-TYPE 
   SYNTAX      INTEGER {
                  none         (0),
                  modifyVlan   (1),
                  nestedVlan   (2),
                  modifyCVlan  (3)
               }
   MAX-ACCESS  read-write 
   STATUS      current 
   DESCRIPTION 
       "The action to be taken on the incoming packet is detailed below -
        none       - no action
        modifyVlan - Traffic matching ACL rule will have VLAN ID
                    classified/modified to value specified by this object.
        nestedVlan - Traffic matching ACL rule will have one additional VLAN Tag
                    added to the packet ( on top of existing VLAN tags, if any).
        modifyCVlan - Traffic matching ACL rule will have Customer VLAN ID
                    classified/modified to value specified by this object.
        Note - VLANID added is specified by mib object issAclL2FilterSubActionId
        strip-etherhdr-apply-nextfilter - Traffic matching ACL rule  will have 
        outer ethernet header stripped, Ex This can be used for stripping the 
        outer ethernet header for MPLS packet."
   DEFVAL  { none } 
   ::= { issAclL2FilterEntry 14 }

issAclL2FilterSubActionId OBJECT-TYPE 
   SYNTAX      Integer32 (0..4094)
   MAX-ACCESS  read-write 
   STATUS      current 
   DESCRIPTION 
      "Id to be used if the object as specified by  issAclL2FilterSubAction is either modifyvlan or nestedvlan only.
       Non-Zero value need to be specify when issAclL2FilterSubAction is modify or Nested        Vlan. Value of Zero need to be specify when issAclL2FilterSubAction is none" 
   DEFVAL  { 0 } 
   ::= { issAclL2FilterEntry 15 }


issAclL2FilterRedirectId OBJECT-TYPE
   SYNTAX      Integer32 
   MAX-ACCESS  read-only
   STATUS      current
   DESCRIPTION
      "Specifies the redirect index associated with L2Filter entry."
   ::= { issAclL2FilterEntry 16 }

issAclL2NextFilterNo OBJECT-TYPE 
   SYNTAX      Integer32 (1..65535)
   MAX-ACCESS  read-write 
   STATUS      current 
   DESCRIPTION 
      "Next Filter rule number to be matched for traffic matching 
      the current ACL rule "
   ::= { issAclL2FilterEntry 17 }

issAclL2NextFilterType OBJECT-TYPE
   SYNTAX      INTEGER {
                l2filter      (0),
                l3filter      (1),
                userdefined   (2)
        }
   MAX-ACCESS  read-write
   STATUS      current
   DESCRIPTION
 	" This object specifies the type of the next access-control list. The type could take the value 'l2filter' for MAC-based
	  ACLs and 'l3filter' for IP-based ACLs. It takes the value 'userdefined' for filtering based on user-defined 
          filters."
   ::= { issAclL2FilterEntry 18 }
issAclL2FilterCreationMode OBJECT-TYPE
   SYNTAX      INTEGER {
                   internal (1),
                   external (2)
               }
   MAX-ACCESS  read-only
   STATUS      current
   DESCRIPTION
      "Specifies the filter created mode.
       internal: Indicates filter is created by the system internally.
       external: Indicates filter is created externally by user configuration.
       Filter table with the mode 'internal' is readonly, and cannot be deleted 
       by setting 'destroy' to table row status."
   DEFVAL  { external }
   ::= { issAclL2FilterEntry 19 }

issAclL2FilterInPortChannelList OBJECT-TYPE
   SYNTAX      PortList
   MAX-ACCESS  read-write
   STATUS      current
   DESCRIPTION
      "This object specifies the complete set of port channel interfaces over which
       the filter is applied for packets arriving at the ports in this list.

       By default InPortChannel list is '0'."
   ::= { issAclL2FilterEntry 20 }


issAclL2FilterOutPortChannelList OBJECT-TYPE
   SYNTAX      PortList
   MAX-ACCESS  read-write
   STATUS      current
   DESCRIPTION
      "This object specifies the complete set of portchannel interfaces over which the filter is applied
       for packets egress at ports in this list.
       This configuration is applicable only if issAclL2FilterDirection is configured as 'out'.
       By default the OutPortChannel list is '0'."
   ::= { issAclL2FilterEntry 21 }

issAclL2FilterStatsEnabledStatus OBJECT-TYPE
   SYNTAX      EnabledStatus
   MAX-ACCESS  read-write
   STATUS      current
   DESCRIPTION
      "This object specifies the status of L2 filter statistics collection.
       When set as enabled, the number of hits for the specific
       filter entry is collected and can be verified using the
       issAclL2FilterMatchCount object.

       When set as disabled, the number of hits for the specific filter
       entry is not collected."
   DEFVAL   { disabled }
   ::= { issAclL2FilterEntry 22 }

issAclClearL2FilterStats OBJECT-TYPE
   SYNTAX      TruthValue
   MAX-ACCESS  read-write
   STATUS      current
   DESCRIPTION
      "This object clears the hit count of the specific filter.

       When this object is set as 'true'(1), the hit count for the filter is
       cleared and the object value is reset to 'false'(2). The get routine for
       this object always returns 'false'(2)."
   DEFVAL   { false }
   ::= { issAclL2FilterEntry 23 }

-- ------------------------------------------------------------------ 
-- L3 Filter Group --------------------------------------------------

issAclL3FilterTable OBJECT-TYPE 
   SYNTAX      SEQUENCE OF IssAclL3FilterEntry
   MAX-ACCESS  not-accessible 
   STATUS      current 
   DESCRIPTION 
       " A table to configure L3 filter rules in the system.
       "
   ::= { issAclL3Filter 1 }

issAclL3FilterEntry OBJECT-TYPE 
   SYNTAX      IssAclL3FilterEntry
   MAX-ACCESS  not-accessible 
   STATUS      current 
   DESCRIPTION 
       " Each entry in this table is a L3 filter rule.
         Index to the table is L3 filter number. "
   INDEX { issAclL3FilterNo}
   ::= { issAclL3FilterTable 1 }
   
IssAclL3FilterEntry ::= 
   SEQUENCE { 
      issAclL3FilterNo 
         Integer32, 
      issAclL3FilterPriority 
         Integer32, 
      issAclL3FilterProtocol  
         Integer32, 
      issAclL3FilterMessageType 
         Integer32, 
      issAclL3FilterMessageCode 
         Integer32, 
      issAclL3FilteAddrType     
         InetAddressType,
      issAclL3FilterDstIpAddr
         InetAddress, 
      issAclL3FilterSrcIpAddr 
         InetAddress, 
      issAclL3FilterDstIpAddrPrefixLength 
         InetAddressPrefixLength,
      issAclL3FilterSrcIpAddrPrefixLength 
         InetAddressPrefixLength,
      issAclL3FilterMinDstProtPort
         Unsigned32, 
      issAclL3FilterMaxDstProtPort
         Unsigned32, 
      issAclL3FilterMinSrcProtPort
         Unsigned32, 
      issAclL3FilterMaxSrcProtPort
         Unsigned32, 
      issAclL3FilterInPortList 
         PortList,
      issAclL3FilterOutPortList 
         PortList, 
      issAclL3FilterAckBit
         INTEGER,
      issAclL3FilterRstBit
         INTEGER,
      issAclL3FilterTos
         Integer32,
      issAclL3FilterDscp
         Integer32,
      issAclL3FilterDirection
         INTEGER, 
      issAclL3FilterAction 
         INTEGER, 
      issAclL3FilterMatchCount
         Counter32, 
      issAclL3FilterFlowId
         Unsigned32,
      issAclL3FilterStatus
         RowStatus,
      issAclL3FilterSubAction
         INTEGER, 
      issAclL3FilterSubActionId
         Integer32,
      issAclL3FilterRedirectId
         Integer32,
      issAclL3FilterCreationMode
         INTEGER,
      issAclL3FilterInPortChannelList
         PortList,
      issAclL3FilterOutPortChannelList
         PortList,
      issAclL3FilterStatsEnabledStatus
         EnabledStatus,
      issAclClearL3FilterStats
         TruthValue

  }

issAclL3FilterNo OBJECT-TYPE 
   SYNTAX      Integer32 (1..65535)
   MAX-ACCESS  not-accessible 
   STATUS      current 
   DESCRIPTION 
      "L3 Filter rule number."
   ::= { issAclL3FilterEntry 1 }
    
issAclL3FilterPriority OBJECT-TYPE 
   SYNTAX      Integer32 (1..255)
   MAX-ACCESS  read-write 
   STATUS      current 
   DESCRIPTION 
      "The priority of the filter can be used to decide which filter rule
       is applicable when 
          --> the packet matches with more than one filter rules
          --> All the filter rules result in 'allow'ing the packet

      Higher value of 'L3 filter priority' implies a higher priority.
      Usage of 'L3FilterPriority' is implementation dependant."
   DEFVAL  { 1 }
   ::= { issAclL3FilterEntry 2 }
   
issAclL3FilterProtocol OBJECT-TYPE 
   SYNTAX      Integer32 (0..255)
   MAX-ACCESS  read-write 
   STATUS      current 
   DESCRIPTION 
      " The type of protocol to be checked against the packet. The
      default value is 255. If the value is 255, it means that the
      protocol type can be anything and it will not be checked to 
      decide the action. "
   DEFVAL   { 255 }
   ::= { issAclL3FilterEntry 3 }
   
issAclL3FilterMessageType OBJECT-TYPE 
   SYNTAX      Integer32 (0..65535)
   MAX-ACCESS  read-write 
   STATUS      current 
   DESCRIPTION 
     " The message type to be checked against the packet. If the
      message type matches with the packet, then the packet will be
      dropped / allowed based on the action set in issAclL3FilterAction.
      The default value is 255. It means that message type is not
      configured and need not be checked.
      Generally the value zero is given as default. But here
      zero can be an ICMP Type value. Hence 255 is given as the
      default value. 
      Some ICMP message types are: 
           echoReply(0),
           destinationUnreachable(3),
           sourceQuench(4),
           redirect(5),
           echoRequest(8),
           timeExceeded(11),
           parameterProblem(12),
           timestampRequest(13),
           timestampReply(14),
           informationRequest(15),
           informationReply(16),
           addressMaskRequest(17),
           addressMaskReply (18),
           noICMPType(255)
      "
   DEFVAL  { 255 }
   ::= { issAclL3FilterEntry 4 }

issAclL3FilterMessageCode OBJECT-TYPE 
   SYNTAX      Integer32 (0..65535)
   MAX-ACCESS  read-write 
   STATUS      current 
   DESCRIPTION 
      " The message code to be checked against the packet. If the
      packet matches with the message code, then the packet will
      be dropped / allowed based on the action set in issAclL3FilterAction.
      The default value is 255. It means that message code is not 
      configured and need not be checked. Generally the value zero 
      will be given as default. But here, zero can be an ICMP Code 
      value. Hence 255 is given as the default value.
      Some ICMP message codes are :
           networkUnreachable(0),
           hostUnreachable(1),
           protocolUnreachable(2),
           portUnreachable(3),
           fragmentNeed(4),
           sourceRouteFail(5),
           destNetworkUnknown(6),
           destHostUnknown(7),
           srcHostIsolated(8),
           destNetworkAdminProhibited(9),
           destHostAdminProhibited(10),
           networkUnreachableTOS(11),
           hostUnreachableTOS(12),
           noICMPCode(255) 
      "
   DEFVAL   { 255 }
   ::= { issAclL3FilterEntry 5 }     
   
issAclL3FilteAddrType OBJECT-TYPE
    SYNTAX         InetAddressType
    MAX-ACCESS     read-create
    STATUS         current
    DESCRIPTION
       "The type of IP address used by this classifier entry.  While
       other types of addresses are defined in the InetAddressType

       textual convention, and DNS names, a classifier can only look at
       packets on the wire. Therefore, this object is limited to IPv4
       and IPv6 addresses."
    ::= { issAclL3FilterEntry 6 }


issAclL3FilterDstIpAddr OBJECT-TYPE
    SYNTAX         InetAddress
    MAX-ACCESS     read-create
    STATUS         current
    DESCRIPTION
       "The IP address to match against the packet's destination IP
       address. This may not be a DNS name, but may be an IPv4 or IPv6
       prefix.  issAclL3FilterDstIpAddrPrefixLength indicates the
       number of bits that are relevant."
    ::= { issAclL3FilterEntry 7 }
    
issAclL3FilterSrcIpAddr OBJECT-TYPE
    SYNTAX         InetAddress
    MAX-ACCESS     read-create
    STATUS         current
    DESCRIPTION
       "The IP address to match against the packet's source IP address.
       This may not be a DNS name, but may be an IPv4 or IPv6 prefix.
       issAclL3FilterSrcIpAddrPrefixLength indicates the number of
       bits that are relevant."
    ::= { issAclL3FilterEntry 8 }


issAclL3FilterDstIpAddrPrefixLength OBJECT-TYPE
    SYNTAX         InetAddressPrefixLength
    UNITS          "bits"
    MAX-ACCESS     read-create
    STATUS         current
    DESCRIPTION
       "The length of the CIDR Prefix carried in
       issAclL3FilterDstIpAddr. In IPv4 addresses, a length of 0
       indicates a match of any address; a length of 32 indicates a
       match of a single host address, and a length between 0 and 32
       indicates the use of a CIDR Prefix. IPv6 is similar, except that
       prefix lengths range from 0..128."
    DEFVAL         { 0 }
    ::= { issAclL3FilterEntry 9 }


issAclL3FilterSrcIpAddrPrefixLength OBJECT-TYPE
    SYNTAX         InetAddressPrefixLength
    UNITS          "bits"
    MAX-ACCESS     read-create
    STATUS         current
    DESCRIPTION

       "The length of the CIDR Prefix carried in
       issAclL3FilterSrcIpAddr. In IPv4 addresses, a length of 0
       indicates a match of any address; a length of 32 indicates a
       match of a single host address, and a length between 0 and 32
       indicates the use of a CIDR Prefix. IPv6 is similar, except that
       prefix lengths range from 0..128."
    DEFVAL         { 0 }
    ::= { issAclL3FilterEntry 10 }

issAclL3FilterMinDstProtPort OBJECT-TYPE
   SYNTAX      Unsigned32
   MAX-ACCESS  read-write
   STATUS      current
   DESCRIPTION
      "The minimum port in the destination port range. Please note 
       these ports are the TCP / UDP ports."
   DEFVAL   { 0 }
   ::= { issAclL3FilterEntry 11 }

issAclL3FilterMaxDstProtPort OBJECT-TYPE
   SYNTAX      Unsigned32
   MAX-ACCESS  read-write
   STATUS      current
   DESCRIPTION
      "The maximum port in the destination port range. Please note 
       these ports are the TCP / UDP ports."
   DEFVAL   { 65535 }
   ::= { issAclL3FilterEntry 12 }

issAclL3FilterMinSrcProtPort OBJECT-TYPE
   SYNTAX      Unsigned32
   MAX-ACCESS  read-write
   STATUS      current
   DESCRIPTION
      "The minimum port in the source port range. Please note 
       these ports are the TCP / UDP ports."
   DEFVAL   { 0 }
   ::= { issAclL3FilterEntry 13 }

issAclL3FilterMaxSrcProtPort OBJECT-TYPE
   SYNTAX      Unsigned32
   MAX-ACCESS  read-write
   STATUS      current
   DESCRIPTION
      "The maximum port in the source port range. Please note 
       these ports are the TCP / UDP ports."
   DEFVAL   { 65535 }
   ::= { issAclL3FilterEntry 14 }

issAclL3FilterInPortList OBJECT-TYPE 
   SYNTAX      PortList
   MAX-ACCESS  read-write 
   STATUS      current 
   DESCRIPTION 
      "Specifies the complete set of ports over which if the packet arrives
      this filter rule will be applicable.
      If the incoming port list is '0', the filter rule is applicable for all the 
      incoming ports.

      By default inport list is maintained as '0'." 
   ::= { issAclL3FilterEntry 15 }

issAclL3FilterOutPortList OBJECT-TYPE 
   SYNTAX      PortList
   MAX-ACCESS  read-write 
   STATUS      current 
   DESCRIPTION 
      "Specifies the complete set of ports over which if the packet goes out, 
      this filter rule will be applicable.
      If the outgoing port list is '0', the filter rule is applicable for all the 
      outgoing packets in all ports.
      By default outport list is maintained as '0'." 
   ::= { issAclL3FilterEntry 16 }

issAclL3FilterAckBit		OBJECT-TYPE
	SYNTAX	INTEGER	{
						establish(1),
						notEstablish(2),
					  	any(3)	
					}
	MAX-ACCESS	read-create
	STATUS		current
	DESCRIPTION
		" The TCP ACK bit to be checked against the packet. The default 
		value is 'any'(3). It means that ACK bit will not be checked 
            	to decide the action. "
	DEFVAL	{ any }
	::= { issAclL3FilterEntry 17 }

issAclL3FilterRstBit	 OBJECT-TYPE
	SYNTAX	INTEGER	{
						set(1),
						notSet(2),
				     	any(3)	
					}
	MAX-ACCESS	read-create
	STATUS		current
	DESCRIPTION
		" The TCP RST bit to be checked against the packet. The default 
		value is 'any'(3). It means that RST bit will not be checked to 
		decide the action. "
	DEFVAL	{ any }
	::= { issAclL3FilterEntry 18 }

issAclL3FilterTos		OBJECT-TYPE
	SYNTAX		Integer32 (-1..7)
	MAX-ACCESS	read-create
	STATUS		current
	DESCRIPTION
		" The IP TOS bit to be checked against the packet. This is a 
		single byte integer of which the last three bits (least 
      significant bits) indicate Delay, Throughput and Reliability 
      i.e 'uuuuudtr', u-unused, d-delay, t-throughput, r-reliability.
		For example '6' indicates low delay and high throughput. 
                A value of '-1' means, the Tos Field becomes dont care"
	DEFVAL	{ -1 }
	::= { issAclL3FilterEntry 19 }

issAclL3FilterDscp		OBJECT-TYPE
	SYNTAX		Integer32 (-1..63)
	MAX-ACCESS	read-create
	STATUS		current
	DESCRIPTION
		" The IP Dscp value to be checked against the packet. 
        A value of '-1' means, the Dscp Field becomes dont care."
	DEFVAL	{ -1 }
	::= { issAclL3FilterEntry 20 }

issAclL3FilterDirection OBJECT-TYPE 
   SYNTAX      INTEGER {
                          in (1),
                          out(2) 
                       } 
   MAX-ACCESS  read-write 
   STATUS      current 
   DESCRIPTION 
      "Specifies the direction of this filter to be applied. By Default the
      filter will be applied on ingress direction.
      When the direction of this filter is 'in', It is applied on specified
      ports of the issAclL3FilterInPortList.
      When the direction of this filter is 'out', It is applied on specified
      ports of the issAclL3FilterOutPortList."
   DEFVAL	{ in }
   ::= { issAclL3FilterEntry 21 }

issAclL3FilterAction OBJECT-TYPE 
   SYNTAX      INTEGER {
                  allow (1),
                  drop  (2),
                  redirect (3),
                  switchandcopytocpu (4),
                  dropandcopytocpu (5)
               }
   MAX-ACCESS  read-write 
   STATUS      current 
   DESCRIPTION 
      "Specifies the action to be taken on the packet if the filter
      rule matches.
      
      If the action is 'allow', the packet will be sent to the
      ports in 'out port list'. If the out port list is '0', 
      the port over which the packet is to be switched will be decided
      based on further processing on the packet.

      If the action is 'drop', the packet will be discarded.
      If the action is 'switch-and-copy-to-cpu', packet is switched and a copy of
      the packet is sent to the CPU.
      If the action is 'drop-and-copy-to-cpu', packet is not switched but only 
      sent to the CPU."

   DEFVAL  { allow } 
   ::= { issAclL3FilterEntry 22 }

issAclL3FilterMatchCount OBJECT-TYPE 
   SYNTAX      Counter32
   MAX-ACCESS  read-only 
   STATUS      current 
   DESCRIPTION 
      "Number of times this filter is matched."

   ::= { issAclL3FilterEntry 23 }
   
issAclL3FilterFlowId OBJECT-TYPE
    SYNTAX         Unsigned32 (0..1048575)
    MAX-ACCESS     read-create
    STATUS         current
    DESCRIPTION
       "The flow identifier in an IPv6 header."
    ::= { issAclL3FilterEntry 24 }

issAclL3FilterStatus OBJECT-TYPE 
   SYNTAX      RowStatus
   MAX-ACCESS  read-create 
   STATUS      current 
   DESCRIPTION 
        "This object indicates the status of this entry. An entry is
        created in this table when this object is SET to 'createAndWait'.
        The entry in this table is used when the status of this object 
        is SET 'active'. The entry in this table is not used when this 
        object is SET 'notInService'. An entry created in this table is
        be deleted when this object is SET 'destroy'. The entry status will be made 
        'active' only if either of In/Out PortList or In/Out PortChannelList are 
        configured in case of l3Filter."
   ::= { issAclL3FilterEntry 25 }
issAclL3FilterSubAction OBJECT-TYPE 
   SYNTAX      INTEGER {
                  none         (0),
                  modifyVlan   (1),
                  nestedVlan   (2),
                  modifyCVlan  (3)
               }
   MAX-ACCESS  read-write 
   STATUS      current 
   DESCRIPTION 
      "The  action to be taken on the incoming packet on the incoming packet
       value specified by this object is detailed below -
        none -  no action
        modifyVlan - Traffic matching ACL rule will have VLAN ID classified/modified 
                     to value specified by this object.
        nestedVlan -  Traffic matching ACL rule will have one additional VLAN Tag
                      added to the packet ( on top of existing VLAN tags, if any).
        modifyCVlan - Traffic matching ACL rule will have Customer VLAN ID
                      classified/modified to value specified by this object.
        Note - VLANID added is specified by mib object issAclL3FilterSubActionId." 
   DEFVAL  { none } 
   ::= { issAclL3FilterEntry 26 }

issAclL3FilterSubActionId OBJECT-TYPE 
   SYNTAX      Integer32 (0..4094)
   MAX-ACCESS  read-write 
   STATUS      current 
   DESCRIPTION 
      "Id to be used if the object as specified by  issAcl3FilterSubAction is either modifyvlan or nestedvlan only.
       Non-Zero value need to be specify when issAclL3FilterSubAction is modify or Nested        Vlan. Value of Zero need to be specify when issAclL3FilterSubAction is none" 
 
   DEFVAL  { 0 } 
   ::= { issAclL3FilterEntry 27 }

issAclL3FilterRedirectId OBJECT-TYPE
   SYNTAX      Integer32
   MAX-ACCESS  read-only
   STATUS      current
   DESCRIPTION
      "Specifies the redirect index associated with L3Filter entry."
   ::= { issAclL3FilterEntry 28 }

issAclL3FilterCreationMode OBJECT-TYPE
   SYNTAX      INTEGER {
                   internal (1),
                   external (2)
               }
   MAX-ACCESS  read-only
   STATUS      current
   DESCRIPTION
      "Specifies the filter created mode.
       internal: Indicates filter is created by the system internally.
       external: Indicates filter is created externally by user configuration.
       Filter table with the mode 'internal' is readonly, and cannot be deleted 
       by setting 'destroy' to table row status."
   DEFVAL  { external }
   ::= { issAclL3FilterEntry 29 }

issAclL3FilterInPortChannelList OBJECT-TYPE
   SYNTAX      PortList
   MAX-ACCESS  read-write
   STATUS      current
   DESCRIPTION
      "This object specifies the complete set of port channel interfaces over which
       the filter is applied for packets arriving at the ports in this list.

       By default InPortChannel list is '0'."
   ::= { issAclL3FilterEntry 30 }

issAclL3FilterOutPortChannelList OBJECT-TYPE
   SYNTAX      PortList
   MAX-ACCESS  read-write
   STATUS      current
   DESCRIPTION
      "This object specifies the complete set of portchannel interfaces over which the filter is applied
       for packets egress at ports in this list.
       This configuration is applicable only if issAclL3FilterDirection is configured as 'out'.
       By default the OutPortChannel list is '0'."
   ::= { issAclL3FilterEntry 31 }

issAclL3FilterStatsEnabledStatus OBJECT-TYPE
   SYNTAX      EnabledStatus
   MAX-ACCESS  read-write
   STATUS      current
   DESCRIPTION
      "This object specifies the status of L3 filter statistics collection.
       When set as enabled, the number of hits for the specific
       filter entry is collected and can be verified using the
       issAclL3FilterMatchCount object.
 	 
       When set as disabled, the number of hits for the filter entry is not
       collected."
   DEFVAL   { disabled }
   ::= { issAclL3FilterEntry 32 }

issAclClearL3FilterStats OBJECT-TYPE
   SYNTAX      TruthValue
   MAX-ACCESS  read-write
   STATUS      current
   DESCRIPTION
      "This object clears the hit count of the specific filter.
 	       
       When this object is set as 'true'(1), the hit count for the filter is 
       cleared and the object value is reset to 'false'(2). The get routine for
       this object always returns 'false'(2)."
   DEFVAL   { false }
   ::= { issAclL3FilterEntry 33 }

------------------------------------------------------------------------------------------
-- User Defined Filter Table for specifying user defined packet header elements
-- Also used for supporting AND/OR/NOT operations on existing ACL rules
-- and deriving new user defined ACL rules
------------------------------------------------------------------------------------------

issAclUserDefinedFilterTable  OBJECT-TYPE
   SYNTAX     SEQUENCE OF FsIssAclUserDefinedFilterEntry
   MAX-ACCESS not-accessible
   STATUS     current
   DESCRIPTION
       "A table to configure user defined filter rules in the system. This table is used for 
	  specifying the user defined packet header elements for application of filter rules.
	  This table could also be used for supporting AND, OR,NOT operations on existing filter
	  rules and deriving new user defined ACL rules."
    ::= { issAclUserDefinedFilter 1 }

issAclUserDefinedFilterEntry OBJECT-TYPE
   SYNTAX     FsIssAclUserDefinedFilterEntry
   MAX-ACCESS not-accessible
   STATUS     current
   DESCRIPTION
        "Specifies user defined filter entry indexed uniquely by issAclUserDefinedFilterId"
   INDEX { issAclUserDefinedFilterId }
   ::= { issAclUserDefinedFilterTable 1 }

FsIssAclUserDefinedFilterEntry ::=
   SEQUENCE {
       issAclUserDefinedFilterId                      IndexInteger,
       issAclUserDefinedFilterPktType                 INTEGER,
       issAclUserDefinedFilterOffSetBase              Integer32,
       issAclUserDefinedFilterOffSetValue             OCTET STRING,
       issAclUserDefinedFilterOffSetMask              OCTET STRING,
       issAclUserDefinedFilterPriority                Integer32, 
       issAclUserDefinedFilterAction                  INTEGER, 
       issAclUserDefinedFilterInPortList              PortList, 
       issAclUserDefinedFilterIdOneType               INTEGER,
       issAclUserDefinedFilterIdOne                   Unsigned32,
       issAclUserDefinedFilterIdTwoType               INTEGER,
       issAclUserDefinedFilterIdTwo                   Unsigned32,
       issAclUserDefinedFilterSubAction              INTEGER,
       issAclUserDefinedFilterSubActionId            Integer32,
       issAclUserDefinedFilterRedirectId              Integer32,
       issAclUserDefinedFilterStatus                  RowStatus,
       issAclUserDefinedFilterMatchCount              Counter32,
       issAclUserDefinedFilterStatsEnabledStatus      EnabledStatus,
       issAclClearUserDefinedFilterStats              TruthValue

          }
issAclUserDefinedFilterId OBJECT-TYPE
   SYNTAX      IndexInteger
   MAX-ACCESS  not-accessible
   STATUS      current
   DESCRIPTION
         "Index to uniquely identify the User defined filter table entry."
   ::= { issAclUserDefinedFilterEntry 1 }


issAclUserDefinedFilterPktType OBJECT-TYPE
   SYNTAX   INTEGER {
          userDef(0),     -- user defined packet type
          ethernet(1),     -- ethernet packet
          ipv4(2),        -- packet type is IPv4
          ipv6(3),        -- packet type is IPv6
          ipv4tcp(4),     -- packet type is IPv4 TCP 
          ipv6tcp(5),      -- packet type is IPv6 TCP
          ipv4udp(6),     -- packet type is IPv4 UDP 
          ipv6udp(7),     -- packet type is IPv6 UDP 
          mpls(8),        -- packet type is MPLS 
          fragip(9)       -- fragmented IPv4/v6 packet
   }

   MAX-ACCESS  read-write
   STATUS      current
   DESCRIPTION 
      "This object specifies the type of packet for which packet-filter match needs to be applied on incoming traffic."
   DEFVAL {0}  
   ::= { issAclUserDefinedFilterEntry 2 }

issAclUserDefinedFilterOffSetBase OBJECT-TYPE
   SYNTAX      Integer32
   MAX-ACCESS  read-write
   STATUS      current
   DESCRIPTION 
      "This object specifies the offset base from the start of packet header ( beginning of full packet) for which the match needs to 
	 be applied on incoming traffic. A value of 0 indicates Start of L2 Header, value 1      indicates start of L3 Header, value 2 start of L4 Header, value 3 start of IPv6 start header, value 4 start from Ethertype and value 5 indicated start from MPLS Header(minus2). Other value are correctly invlaid and reserved for future use." 
   DEFVAL  { 0 }
   ::= { issAclUserDefinedFilterEntry 3 }

issAclUserDefinedFilterOffSetValue OBJECT-TYPE
   SYNTAX      OCTET STRING (SIZE (0..128))
   MAX-ACCESS  read-write
   STATUS      current
   DESCRIPTION 
      "This object specifies the offset value for which packet-filter match needs to be applied on incoming traffic. A value
       of zero indicates that this field is dont-care. The offset value is a contiguous set of 128 bytes from the OffSetBase.
	 For specifying non-contiguous elements in the packet header, the OffSetValue is ANDed with the OffsetMask to result in
	 the appropriate match on non-contiguous elements of the packet header."    
   ::= { issAclUserDefinedFilterEntry 4 }

issAclUserDefinedFilterOffSetMask OBJECT-TYPE
   SYNTAX      OCTET STRING (SIZE (0..128))
   MAX-ACCESS  read-write
   STATUS      current
   DESCRIPTION 
      "This object specifies the mask for the offset value. The actual user defined value to be used for matching incoming
       traffic is obtained after ANDing the OffsetValue and OffsetMask. A value of 0 indicates that this field is dont-care."
     
   ::= { issAclUserDefinedFilterEntry 5 }

issAclUserDefinedFilterPriority OBJECT-TYPE 
   SYNTAX      Integer32 (1..255)
   MAX-ACCESS  read-write 
   STATUS      current 
   DESCRIPTION 
      "The priority of the filter can be used to decide which filter rule
       is applicable when 
          --> the packet matches with more than one filter rules
          --> All the filter rules result in 'allow'ing the packet

      Higher value of 'UserDefined filter priority' implies a higher priority.
      Usage of 'UserDefinedFilterPriority' is implementation dependant."
   DEFVAL  { 1 }
   ::= { issAclUserDefinedFilterEntry 6 }

issAclUserDefinedFilterAction OBJECT-TYPE 
   SYNTAX      INTEGER {
                  allow    (1),
                  drop     (2),
                  redirect (3),
		  and      (4),
		  or       (5),
		  not      (6)
               }
   MAX-ACCESS  read-write 
   STATUS      current 
   DESCRIPTION 
      "Action value allow/drop/redirect specify the action to be taken on the packet if the filter rule matches.
     -->  If the action is 'allow', the packet will be sent to the
      	     ports as specified by issRedirectInterfaceGrpPortList. 

     -->  If the action is 'drop', the packet will be discarded.

     -->  If the action is 'redirect', the packet will be switched based on the redirect rule.
	Action value and/or/not specify the operation that is applied on base 
    access filter rules to derive a new user defined ACL rule. 
    For the below actions, the user defined offset values are not used for packet
	match.
	--> and : Apply AND operation on base filter rules identified uniquely by  <issAclUserDefinedFilterIdOneType, issAclUserDefinedFilterIdOne> AND  <issAclUserDefinedFilterIdTwoType,  issAclUserDefinedFilterIdTwo > to derive new user defined filter rule.
	--> or  : Apply OR operation on base filter rules identified uniquely by  <issAclUserDefinedFilterIdOneType, issAclUserDefinedFilterIdOne> AND  <issAclUserDefinedFilterIdTwoType,  issAclUserDefinedFilterIdTwo > The FilterAction corresponding to  issAclUserDefinedFilterIdOne will be applied on  issAclUserDefinedFilterIdTwo.
	--> not  : Apply NOT operation on base filter rule identified uniquely by  <issAclUserDefinedFilterIdOneType, issAclUserDefinedFilterIdOne> to derive new user defined filter rule."

   DEFVAL  { allow } 
   ::= { issAclUserDefinedFilterEntry 7 }

issAclUserDefinedFilterInPortList OBJECT-TYPE 
   SYNTAX      PortList
   MAX-ACCESS  read-write 
   STATUS      current 
   DESCRIPTION 
      "Specifies the complete set of ports over which this filter is applied
       for packets ingress at ports in this list. Filter will be applied in
       chip when port list is not null.
       If the In port list is '0', the filter rule will not be installed in hardware.
       By default inport list is maintained as '0'." 
   ::= { issAclUserDefinedFilterEntry 8 }

issAclUserDefinedFilterIdOneType OBJECT-TYPE
   SYNTAX         INTEGER { macbased (1), ipbased (2) } 
   MAX-ACCESS     read-write
   STATUS         current
   DESCRIPTION
        "This Object specifies the type of the Base ACL rule 1 that is used for 
         deriving new ACL rule."
   ::= { issAclUserDefinedFilterEntry 9 }

issAclUserDefinedFilterIdOne OBJECT-TYPE
   SYNTAX    Unsigned32 (0..65535)
   MAX-ACCESS     read-write
   STATUS         current
   DESCRIPTION
        "This Object specifies the ID of the Base ACL rule 1 (MAC-based or IP-based) that is used for 
         deriving new ACL rule."
   ::= { issAclUserDefinedFilterEntry 10 }

issAclUserDefinedFilterIdTwoType OBJECT-TYPE
   SYNTAX         INTEGER { macbased (1) , ipbased (2) } 
   MAX-ACCESS     read-write
   STATUS         current
   DESCRIPTION
        "This Object specifies the type of the Base ACL rule 2 that is used for 
         deriving new ACL rule."
   ::= { issAclUserDefinedFilterEntry 11 }

issAclUserDefinedFilterIdTwo OBJECT-TYPE
   SYNTAX    Unsigned32 (0..65535)
   MAX-ACCESS     read-write
   STATUS         current
   DESCRIPTION
        "This Object specifies the ID of the Base ACL rule 2 (MAC-based or IP-based) that is used for 
         deriving new ACL rule."
   ::= { issAclUserDefinedFilterEntry 12 }

issAclUserDefinedFilterSubAction OBJECT-TYPE 
   SYNTAX      INTEGER {
                  none         (0),
                  modifyVlan   (1),
                  nestedVlan   (2)
               }
   MAX-ACCESS  read-write 
   STATUS      current 
   DESCRIPTION 
      "The action to be taken on the incoming packet is detailed below -
       none       - no action
       modifyVlan - Traffic matching ACL rule will have VLAN ID classified/modified 
                     to value specified by this object.
                     The direction of VLAN ID modification is determined as follows -
       nestedVlan - Traffic matching ACL rule will have one additional VLAN Tag 
                     added to the packet ( on top of existing VLAN tags, if any). 
                     
       NOte  -       VLANID added is specified by issAclUserDefinedFilterSubActionId." 
   DEFVAL  { none }
   ::= { issAclUserDefinedFilterEntry 13 }

issAclUserDefinedFilterSubActionId OBJECT-TYPE 
   SYNTAX      Integer32 (0..4094)
   MAX-ACCESS  read-write 
   STATUS      current 
   DESCRIPTION 
      "Id to be used if the object as specified by  issAclUserDefinedFilterSubAction is either modifyvlan or nestedvlan only.
       Non-Zero value need to be specify when issAclUserDefinedFilterSubAction is modify 
       or Nested Vlan. Value of Zero need to be specify 
       when issAclUserDefinedFilterSubAction is none." 

        
   DEFVAL  { 0 } 
   ::= { issAclUserDefinedFilterEntry 14 }

issAclUserDefinedFilterRedirectId OBJECT-TYPE
   SYNTAX      Integer32
   MAX-ACCESS  read-only
   STATUS      current
   DESCRIPTION
      "Specifies the redirect index associated with UserDefinedFilter entry."
   ::= { issAclUserDefinedFilterEntry 15 }

issAclUserDefinedFilterStatus OBJECT-TYPE 
   SYNTAX      RowStatus
   MAX-ACCESS  read-create 
   STATUS      current 
   DESCRIPTION 
        "This object indicates the status of this entry. An entry is
        created in this table when this object is SET to 'createAndWait'.
        The entry in this table is used when the status of this object 
        is SET 'active'. The entry in this table is not used when this 
        object is SET 'notInService'. An entry created in this table is
        be deleted when this object is SET 'destroy'."
   ::= { issAclUserDefinedFilterEntry 16 }

issAclUserDefinedFilterMatchCount OBJECT-TYPE
   SYNTAX      Counter32
   MAX-ACCESS  read-only
   STATUS      current
   DESCRIPTION
      "This object specifies the number of times the filter is matched."

   ::= { issAclUserDefinedFilterEntry 17 }

issAclUserDefinedFilterStatsEnabledStatus OBJECT-TYPE
   SYNTAX      EnabledStatus
   MAX-ACCESS  read-write
   STATUS      current
   DESCRIPTION
      "This object specifies the status of User Defined filter statistics collection.
       When set as enabled, the number of hits for the specific
       filter entry is collected and can be verified using the
       issAclUserDefinedFilterMatchCount object.
 	 
       When set as disabled, the number of hits for the filter entry is not
       collected."
   DEFVAL   { disabled }
   ::= { issAclUserDefinedFilterEntry 18 }

issAclClearUserDefinedFilterStats OBJECT-TYPE
   SYNTAX      TruthValue
   MAX-ACCESS  read-write
   STATUS      current
   DESCRIPTION
      "This object clears the hit count of the specific filter.
 	       
       When this object is set as 'true'(1), the hit count for the filter is 
       cleared and the object value is reset to 'false'(2). The get routine for
       this object always returns 'false'(2)."
   DEFVAL   { false }
   ::= { issAclUserDefinedFilterEntry 19 }




----------------------------------------
-- Redirect Interface Group Table
----------------------------------------

issRedirectInterfaceGrpTable  OBJECT-TYPE
   SYNTAX     SEQUENCE OF FsRedirectInterfaceGrpEntry
   MAX-ACCESS not-accessible
   STATUS     current
   DESCRIPTION
        "An interface group is a collection of physical ports ( or ) trunks that
        are grouped together for distributing traffic received on an ingress interface.
        Based on the access-list match on an incoming interface, traffic is distributed 
        among the member ports of an interface-group/virtual trunk." 
    ::= { issRedirectInterfaceGrp 1 }

issRedirectInterfaceGrpEntry OBJECT-TYPE
   SYNTAX     FsRedirectInterfaceGrpEntry
   MAX-ACCESS not-accessible
   STATUS     current
   DESCRIPTION
        "There is one entry in this table for each created Interface-Group. An interface-group/virtual trunk is 
	 uniquely identified by the object 'issRedirectInterfaceGrpId'."
   INDEX { issRedirectInterfaceGrpId }
   ::= { issRedirectInterfaceGrpTable 1 }

FsRedirectInterfaceGrpEntry ::=
   SEQUENCE {
         issRedirectInterfaceGrpId                      IndexInteger,
         issRedirectInterfaceGrpFilterType              INTEGER,
         issRedirectInterfaceGrpFilterId                Unsigned32,
         issRedirectInterfaceGrpDistByte                Integer32,
         issRedirectInterfaceGrpPortList                PortList,
         issRedirectInterfaceGrpType                    INTEGER,
         issRedirectInterfaceGrpUdbPosition             Integer32,
         issRedirectInterfaceGrpStatus                  RowStatus
          }
issRedirectInterfaceGrpId OBJECT-TYPE
   SYNTAX      IndexInteger
   MAX-ACCESS  not-accessible
   STATUS      current
   DESCRIPTION
         "Index to the Redirect Interface Group table entry. Uniquely identifies the interface-group."
   ::= { issRedirectInterfaceGrpEntry 1 }


issRedirectInterfaceGrpFilterType OBJECT-TYPE
   SYNTAX      INTEGER {
                l2filter      (0),
                l3filter      (1),
                userdefined   (2)
        }
   MAX-ACCESS  read-write
   STATUS      current
   DESCRIPTION
 	" This object specifies the type of the access-control list. The type could take the value 'l2filter' for MAC-based
	  ACLs and 'l3filter' for IP-based ACLs. It takes the value 'userdefined' for filtering based on user-defined 
          filters."
   ::= { issRedirectInterfaceGrpEntry 2 }


issRedirectInterfaceGrpFilterId OBJECT-TYPE
   SYNTAX    Unsigned32 (1..65535)
   MAX-ACCESS     read-write
   STATUS         current
   DESCRIPTION
        "This Object specifies the ID of the MAC-based, IP-based or UserDefined access control list/filter-rule, the details of 
         which should be matched against the incoming packet. The corresponding ACL/filter-rule can be applied to 
         this Interface Redirect Group only if the following objects are set with values mentioned below -
         a. 'issAclL2FilterAction'/'issAclL3FilterAction' -  redirect."
   ::= { issRedirectInterfaceGrpEntry 3 }

issRedirectInterfaceGrpDistByte OBJECT-TYPE
   SYNTAX       Integer32 (0..140)  
   MAX-ACCESS  read-write
   STATUS      current
   DESCRIPTION
 	"Specifies the  Distribution Byte that needs to be used for deriving the traffic distribution hash-logic for the 
	 set of interfaces in the interface-group/virtual-trunk. The output of the hash-logic is an egress 
	 interface from amongst the member ports of a virtual trunk. Traffic would get redirected to this egress interface. 
       'udb' can take any value between (0..128). If srcip is selected, then Source IP in the packet header would be 
       used for distributing traffic. For encapsulated IP packets, inner IP can be used for traffic distribution." 
   ::= { issRedirectInterfaceGrpEntry 4 }

issRedirectInterfaceGrpPortList OBJECT-TYPE
   SYNTAX         PortList
   MAX-ACCESS     read-write
   STATUS         current
   DESCRIPTION
        "Each octet in this object specifies the IfIndex of a physical interface or manually aggregated trunk.Based on the value specified by issRedirectInterfaceGrpType This PortList specifies either of the below.
        -> if issRedirectInterfaceGrpType is portList it specifies 
           List of interfaces that comprise the redirect interface-group with Most Significant Bit Represents
           Lowest Port. 
        -> if issRedirectInterfaceGrpType is port then it specifies Single interface with Least Significant Octets
           taking up the interface Value ."  
   ::= { issRedirectInterfaceGrpEntry 5 }


issRedirectInterfaceGrpType OBJECT-TYPE
   SYNTAX         INTEGER { port (1) , portList (2) }
   MAX-ACCESS     read-write
   STATUS         current
   DESCRIPTION
        "This object specifies whether the redirected interface is a single port
        or portlist.If the value of this object is port(1) then the redirected 
        interface is a single interface .If the value of this object is 
        portlist(2) then the redirected interface consists of a group of ports."  
   ::= { issRedirectInterfaceGrpEntry 6 }

issRedirectInterfaceGrpUdbPosition OBJECT-TYPE 
   SYNTAX      Integer32 (0..128)
   MAX-ACCESS  read-write 
   STATUS      current 
   DESCRIPTION 
      "This object indicates the User defined postion of a byte in
	  the packet when the value of the object as specified by 
	  issRedirectInterfaceGrpDistByte is udb." 
   DEFVAL  { 0 }
   ::= { issRedirectInterfaceGrpEntry 7 }
issRedirectInterfaceGrpStatus OBJECT-TYPE
   SYNTAX      RowStatus
   MAX-ACCESS  read-create
   STATUS      current
   DESCRIPTION
	"This object indicates the status of this entry. An entry is
  	 created in this table when this object is SET to 'createAndWait'.
	 The entry is 'not-ready' when the mandatory parameters are not specified.
	 Following objects are mandatory parameters that need to be set before this object
	 can be SET to 'active' -
	 a. issRedirectInterfaceGrpFilterId
	 b. issRedirectInterfaceGrpPortList 
         The entry in this table is used when the status of this object is 
         SET to 'active'. The entry in this table is not used when this object is SET to 'notInService'. 
         An entry created in this table is deleted when this object is SET to 'destroy'."
   ::= { issRedirectInterfaceGrpEntry 8 }

-------------------------------------------------------------------
--SCALAR OBJECT 
-------------------------------------------------------------------

issRedirectInterfaceGrpIdNextFree OBJECT-TYPE
   SYNTAX       IndexIntegerNextFree
   MAX-ACCESS   read-only
   STATUS       current
   DESCRIPTION
   "This object value the next free index (issRedirectInterfaceGrpId)  
    to be used for creation of redirect interface entry, or a 
    zero to indicate that none exist"
   ::= { issRedirectIdNextFree 1 }
-- Traffic Control Group ------------------------------------------ --

issAclTrafficSeperationCtrl OBJECT-TYPE 
   SYNTAX      INTEGER {
                  systemdefault (1), 
                  userconfig (2)
               }
   MAX-ACCESS  read-write
   STATUS      deprecated 
   DESCRIPTION 
      "This object provides control to administrator, to have system default or 
       user defined ACL/QoS rules to carry control traffic to CPU.

       system-default: ACL/QoS rules for all the control packets will be 
       automatically installed by the ISS software at system init time.Either a
       'switch-and-copy-to-cpu'filter (or) 'drop-and-copy-to-cpu' filter will be
       installed, as appropriate, for getting the control packets to CPU, for 
       processing.

       user-config: The ACL/QoS rules for receiving all the control packets to 
       CPU for processing, will NOT be automatically installed by the the ISS 
       software.The administrator is expected to install required rules for the
       control packets as requried.

       If the configuration is changed from 'systemdefault' to 'userconfig' 
       option, then all the default ACL/QoS rules for carrying protocol control
       packets to CPU are removed.Then user has to install the specific ACL/QoS
       rules, to carry the intended control packets to CPU for the processing.

       If the configuration is changed from 'userconfig' to 'systemdefault',
       all the default ACL/QoS rules are installed. Already existing(if any) 
       user configured ACL rules in the system are not removed.

       Above two options can be configured during system runtime.
       
       This object is deprecated, corresponding functionality can be
       realised by issTrafficSeperationCtrl from fsiss.mib"

   DEFVAL      { systemdefault }
   ::= { issAclTrafficControl 1 } 
END
