-- *****************************************************************
-- CISCO-IP-PROTOCOL-FILTER-MIB.my: Cisco IP Protocol Filter MIB 
-- file
--
-- June 2002, Francis Pang 
--
-- Copyright (c) 2002 , 2005 by Cisco Systems, Inc.  
-- All rights reserved.  
-- *****************************************************************
--
CISCO-IP-PROTOCOL-FILTER-MIB DEFINITIONS ::= BEGIN

IMPORTS
        MODULE-IDENTITY, 
        OBJECT-TYPE,
        Integer32,                     
        Unsigned32 ,                    
        Counter64
                FROM SNMPv2-SMI
        MODULE-COMPLIANCE,
        OBJECT-GROUP
                FROM SNMPv2-CONF
        InetAddressType,
        InetAddress,
        InetPortNumber
                FROM INET-ADDRESS-MIB
        RowStatus, 
        TruthValue,
        TEXTUAL-CONVENTION
                FROM SNMPv2-TC
        ifIndex
                FROM IF-MIB
        SnmpAdminString
                FROM SNMP-FRAMEWORK-MIB
        SyslogSeverity
                FROM CISCO-SYSLOG-MIB
        CfgFilterGroupName
                FROM CISCO-FILTER-GROUP-MIB
        ciscoMgmt
                FROM CISCO-SMI;


ciscoIpProtocolMIB MODULE-IDENTITY
        LAST-UPDATED    "200504200000Z"
        ORGANIZATION    "Cisco System Inc."
        CONTACT-INFO
                "       Cisco Systems
                        Customer Service

                Postal: 170 West Tasman Drive,
                        San Jose CA 95134-1706.  
                        USA

                   Tel: +1 800 553-NETS

                E-mail: cs-dot11@cisco.com"
        DESCRIPTION
                "The MIB module is for management of information 
                to support packet filtering on IP protocols.

                The cippfIpProfileTable allows users to create
                delete, and get information about filter profiles.
                Filter profiles are uniquely identified by the 
                profile names.  Filter profiles can either be of
                Simple or Extended usage types, and the usage type
                cannot be changed once it has been created. 

                The cippfIfIpProfileTable applies the filtering
                profiles to device interfaces running IP.  A filter
                profile can be applied to multiple interfaces.

                The cippfIpFilterTable contains ordered lists of
                IP filters for all the filtering profiles.  
                Filters and profiles are related if they are of 
                the same filter profile name.  Filters can only 
                be created if their associated filter profiles
                already exist in the cippfIpProfileTable. 
                Filters of the same profile name belongs to a 
                common profile.  

                The cippfIfIpProfileTable can be configured with
                information independent from the other.  However, 
                if the name of a profile in the cippfIfIpProfileTable
                matches that of any profile in the 
                cippfIpProfileTable and the profile name of any 
                filter entry in the cippfIpFilterTable, the profile 
                is 'active' and the filter entry is being applied 
                to IP traffic passing through the attached device 
                interfaces.  Therefore, any change to the filters 
                in the cippfIpFilterTable or the profile itself in 
                the cippfIpProfileTable will affect all the 
                attached interfaces."
        REVISION        "200504200000Z"
        DESCRIPTION
                "- Added 'extendedIPv6' enumeration in
                cippfIpProfileType.
                - Added following enumerations in
                cippfIfIpProfileDirection.
                     inboundIPv6  (3) 
                     outboundIPv6 (4).
         
                - Added following objects in cippfIpFilterTable:
                    cippfIpFilterSrcIPGroupName
                    cippfIpFilterDstIPGroupName
                    cippfIpFilterProtocolGroupName
                    cippfIpFilterSrcServiceGroupName
                    cippfIpFilterDstServiceGroupName
                    cippfIpFilterICMPGroupName.

                - Added following tables
                   cippfIpFilterExtTable.
                   cippfIpFilterStatsTable."
        REVISION       "200306160000Z"
        DESCRIPTION
                "Added following objects to cippfIpFilterTable:
                cippfIpFilterICMPType,cippfIpFilterEstablished,
                cippfIpFilterFragments,cippfIpFilterICMPCode.
                Updated the conformance statement."
        REVISION        "200207110000Z"
        DESCRIPTION
                "Initial version of this MIB module."
        ::= { ciscoMgmt 278 }


ciscoIpProtocolFilterMIBNotifs  OBJECT IDENTIFIER 
        ::= { ciscoIpProtocolMIB 0 }

ciscoIpProtocolFilterMIBObjects OBJECT IDENTIFIER 
        ::= { ciscoIpProtocolMIB 1 }

ciscoIpProtocolFilterMIBConform OBJECT IDENTIFIER 
        ::= { ciscoIpProtocolMIB 2 }

cippfIpFilterConfig             OBJECT IDENTIFIER 
        ::= { ciscoIpProtocolFilterMIBObjects 1 }

cippfIpFilterStats              OBJECT IDENTIFIER 
        ::= { ciscoIpProtocolFilterMIBObjects 2 }

-- Textual Conventions

CippfIpFilterProfileName ::= TEXTUAL-CONVENTION
        STATUS    current
        DESCRIPTION
                "Objects defined with this textual convention are
                used to identify IP protocol filter profiles.  
                The object value shall be an alphanumeric string."
        SYNTAX    OCTET STRING (SIZE (1..64))  

cippfIpProfileTable OBJECT-TYPE
        SYNTAX     SEQUENCE OF CippfIpProfileEntry
        MAX-ACCESS not-accessible
        STATUS     current
        DESCRIPTION
                "This table lists all the existing IP protocol 
                filter profiles.  These filter profiles contain 
                protocol filters used to filter IP traffic 
                through the device interfaces.  The IP protocol 
                filters associated with these profiles are 
                defined in the cippfIpFilterTable.  

                For profiles to be associated with filters, the 
                object value of the cippfIpProfileName of a 
                profile must matches that of the cippfIpProfileName
                of a filter entry in the cippfIpFilterTable.
                Filters of the same profile name belong to a
                common filter profile and are of the same usage
                type of the profile.

                This table can only be used to create or delete
                filter profiles.  Deleting any profile in this
                table will also delete all the associated filters
                in the cippfIpFilterTable and cause the state of
                the associated 'active' filter profile in the
                cippfIfIpProfileTable to be changed to 'notReady'.  
                All of these deleted or changed entries are 
                associated by virtue of the same profile name."
        ::= { cippfIpFilterConfig 1 }

cippfIpProfileEntry OBJECT-TYPE
        SYNTAX     CippfIpProfileEntry
        MAX-ACCESS not-accessible
        STATUS     current
        DESCRIPTION
                "Each entry defines the type, state, and the last
                object index assigned to a filter of the filter
                profile."
        INDEX      { cippfIpProfileName }
        ::= { cippfIpProfileTable 1 }

CippfIpProfileEntry ::= SEQUENCE {
                cippfIpProfileName    CippfIpFilterProfileName,
                cippfIpProfileType    INTEGER,
                cippfIpProfileLastFilterIndex  
                                      Unsigned32,
                cippfIpProfileStatus  RowStatus }

cippfIpProfileName OBJECT-TYPE
        SYNTAX     CippfIpFilterProfileName
        MAX-ACCESS not-accessible 
        STATUS     current
        DESCRIPTION
                "This is the unique IP protocol filter profile 
                identifier.  If this value is the same as the 
                cippfIpProfileName in the cippfIpFilterTable
                and the cippfIfIpProfileName in 
                cippfIfIpFilterTable, they are all referring
                to the same filter profile."
        ::= { cippfIpProfileEntry 1 }

cippfIpProfileType OBJECT-TYPE
        SYNTAX     INTEGER {
                        simple       (1),
                        extended     (2),
                        extendedIPv6 (3)
                   }
        MAX-ACCESS read-create 
        STATUS     current
        DESCRIPTION
                "This object determines the usage type this filter
                profile.  This usage type cannot be changed after 
                the profile has been created.  

                The usage type simple(1) implies that the valid
                objects of each filter entry in the profile in
                the cippfIpFilterTable only include:
                    cippfIpFilterIndex,
                    cippfIpFilterOrderPosition,
                    cippfIpFilterAction,
                    cippfIpFilterAddressType,
                    cippfIpFilterSrcAddress,
                    cippfIpFilterSrcMask,
                    cippfIpFilterLogEnabled,
                    cippfIpFilterStatus.
                This means that only the above objects will be
                used to create the protocol filter, and all 
                other objects will be ignored during filter
                creation.

                The usage extended(2) implies that all objects
                defined in the cippfIpFilterTable are valid
                for any filter entry in the corresponding 
                profile.

                The usage extendedIPv6(3) implies that this
                is a IPv6 profile and all objects defined 
                in the cippfIpFilterTable are valid for any
                filter entry in the corresponding profile."
        DEFVAL     { extended }
        ::= { cippfIpProfileEntry 2 }

cippfIpProfileLastFilterIndex OBJECT-TYPE
        SYNTAX     Unsigned32 (0..2147483647)
        MAX-ACCESS read-only 
        STATUS     current
        DESCRIPTION
                "This value is the same as the last
                cippfIpFilterIndex value assigned to a filter of
                this profile."
        ::= { cippfIpProfileEntry 3 }

cippfIpProfileStatus OBJECT-TYPE
        SYNTAX     RowStatus
        MAX-ACCESS read-create
        STATUS     current
        DESCRIPTION
                "This object controls and reflects the status of rows
                in this table.  To create a filter profile of a 
                particular usage type, the NMS must do a multivarbind
                set containing both cippfIpProfileStatus and 
                cippfIpProfileType.

                Creation of rows must be done via 'createAndGo' for 
                all profiles. When the agent successfully creates the 
                filter profile, this object is set to 'active' by the
                agent.

                To delete a row, set this object value to 'destroy'."
        ::= { cippfIpProfileEntry 4 }


cippfIfIpProfileTable OBJECT-TYPE
        SYNTAX     SEQUENCE OF CippfIfIpProfileEntry
        MAX-ACCESS not-accessible
        STATUS     current
        DESCRIPTION
                "This table lists all the IP protocol filter
                profiles being applied to IP traffic on the
                device interfaces.  An IP protocol filter profile
                can be shared by multiple interfaces.  The filter
                profiles are defined in the cippfIpProfileTable,
                and filters of these profiles are defined in the
                cippfIpFilterTable.

                Protocol filter profiles and their associated 
                filters can be 'attached to' or 'removed from' 
                in-bound or out-bound interfaces.  Both existing
                and non-existing protocol filter profiles can be
                'attached to' the interfaces.  However, the
                cippfIfIpProfileStatus will only become 'active'
                if the filter profile exists in the 
                cippfIpProfileTable, and the filters will then
                be applied to the IP traffic through the interface.
                Modification of any filters associated with a 
                shared profile will affect all interfaces sharing 
                that profile.

                Each interface can only be attached with one protocol
                filter profile on the in-bound direction and one on
                the out-bound direction."
        ::= { cippfIpFilterConfig 2 }

cippfIfIpProfileEntry OBJECT-TYPE
        SYNTAX     CippfIfIpProfileEntry
        MAX-ACCESS not-accessible
        STATUS     current
        DESCRIPTION
                "Each entry attaches an IP traffic filter profile 
                to a particular device interface and a specific 
                traffic direction.  The interface can be of any 
                ifType supporting and running IP." 
        INDEX      { 
                ifIndex, 
                cippfIfIpProfileDirection }
        ::= { cippfIfIpProfileTable 1 }

CippfIfIpProfileEntry ::= SEQUENCE {
                cippfIfIpProfileDirection  INTEGER, 
                cippfIfIpProfileName       CippfIpFilterProfileName,
                cippfIfIpProfileStatus     RowStatus }

cippfIfIpProfileDirection OBJECT-TYPE
        SYNTAX     INTEGER {
                        inbound      (1),
                        outbound     (2),
                        inboundIPv6  (3),
                        outboundIPv6 (4) 
                   }
        MAX-ACCESS not-accessible
        STATUS     current
        DESCRIPTION
                "This object determines whether this filter 
                profile is applied to inbound or outbound
                traffic of a particular interface.
                The possible value(s) are:
                  inbound      - inbound traffic. 
                  outbound     - outbound traffic.
                  inboundIPv6  - IPv6 inbound traffic.
                  outboundIPv6 - IPv6 outbound traffic."
        ::= { cippfIfIpProfileEntry 1 }

cippfIfIpProfileName OBJECT-TYPE
        SYNTAX     CippfIpFilterProfileName
        MAX-ACCESS read-create
        STATUS     current
        DESCRIPTION
                "This is the unique IP protocol filter profile 
                identifier.  This value must be the same as one of
                the existing cippfIpProfileName object values 
                in the cippfIpProfileTable for this profile and the 
                cippfIfIpProfileStatus of value 'createAndGo' to 
                become 'active'.  
 
                If this object value does not match any existing
                cippfIpProfileName, an entry of this table
                can only be created with cippfIfIpProfileStatus in
                'createAndWait' state.  The entry can only be made
                'active' by the agent when the corresponding
                cippfIpProfileName is added to the 
                cippfIpProfileTable."
        ::= { cippfIfIpProfileEntry 2 }

cippfIfIpProfileStatus OBJECT-TYPE
        SYNTAX     RowStatus
        MAX-ACCESS read-create
        STATUS     current
        DESCRIPTION
                "This object controls and reflects the status of rows
                in this table.  To apply this filter profile or remove
                this filter profile, the NMS must do a multivarbind
                set containing both cippfIfIpProfileStatus and 
                cippfIfIpProfileName.

                Creation of rows may be done via 'createAndGo' for 
                profiles already exist in the cippfIpProfileTable,
                and the filter profile will only be effective when this
                object is set to 'active' by the agent.  

                Creation of rows may also be done via 'createAndWait'
                for profiles do not exist in the cippfIpProfileTable.
                This object will be set by the agent to 'notReady', and
                the filter profile will not participate in IP filtering.
                This object will only be set to 'active' when there is 
                a corresponding 'active' profile in the 
                cippfIpProfileTable.
               
                To remove a row, set this object value to 'destroy'."
        ::= { cippfIfIpProfileEntry 3 }


cippfIpFilterTable OBJECT-TYPE
        SYNTAX     SEQUENCE OF CippfIpFilterEntry
        MAX-ACCESS not-accessible
        STATUS     current
        DESCRIPTION
                "This table contains ordered lists of filters for 
                all the IP protocol filter profiles.  Device traffic
                filtering system applies filters of a filter profile 
                according to the filter order position.  IP packets 
                matching any filter will be processed according to 
                the matching action specified by the filter or they
                will be discarded if they do not match any filters.  

                Any IP packet through an interface can theoretically
                match multiple filters or rows of this table of the 
                same filter profile.  When applying a filter to a 
                packet, the cippfIfIpProfileTable is used to first
                identify the filter profile to use, then this table 
                is scanned according to filter profile name and 
                filter order position.  If the packet matches all 
                criteria for that row, the action defined in the 
                cippfIpFilterAction object of the row will be taken.  

                If the action for the matching filter is deny(1), 
                the packet is discarded and the processing is 
                completed.  If the action for the matching filter is
                permit(2), the packet is accepted and permitted to 
                be processed by the bridging or routing logic.  If 
                the packet matches no filter in this table, the 
                packet is always deny(1) and will be dropped.

                To create a filter, the cippfIpProfileName must
                already exists in the cippfIpProfileTable. No filter
                can be created without an existing filter in the 
                cippfIpProfileTable.  If the filter profile is 
                deleted from the cippfIpProfileTable, all the 
                associated filters in this table will also be 
                deleted."
        ::= { cippfIpFilterConfig 3 }

cippfIpFilterEntry OBJECT-TYPE
        SYNTAX     CippfIpFilterEntry
        MAX-ACCESS not-accessible
        STATUS     current
        DESCRIPTION
                "Each entry is an IP Protocol traffic filter within 
                an IP filter profile.  Entries with the same 
                cippfIpProfileName belong to the same IP filter 
                profile."
        INDEX      { 
                cippfIpProfileName, 
                cippfIpFilterIndex }
        ::= { cippfIpFilterTable 1 }

CippfIpFilterEntry ::= SEQUENCE {
                cippfIpFilterIndex           Unsigned32,
                cippfIpFilterOrderPosition   Unsigned32,
                cippfIpFilterAction          INTEGER,
                cippfIpFilterAddressType     InetAddressType,
                cippfIpFilterSrcAddress      InetAddress,
                cippfIpFilterSrcMask         InetAddress,
                cippfIpFilterDestAddress     InetAddress,
                cippfIpFilterDestMask        InetAddress,
                cippfIpFilterProtocol        Integer32,
                cippfIpFilterSrcPortLow      InetPortNumber,
                cippfIpFilterSrcPortHigh     InetPortNumber,
                cippfIpFilterDestPortLow     InetPortNumber,
                cippfIpFilterDestPortHigh    InetPortNumber,
                cippfIpFilterPrecedence      INTEGER,
                cippfIpFilterTos             Integer32,
                cippfIpFilterLogEnabled      TruthValue,
                cippfIpFilterStatus          RowStatus,
                cippfIpFilterICMPType        Integer32,
                cippfIpFilterTCPEstablished  TruthValue,
                cippfIpFilterFragments       TruthValue,
                cippfIpFilterICMPCode        Integer32,
                cippfIpFilterSrcIPGroupName       CfgFilterGroupName,
                cippfIpFilterDstIPGroupName       CfgFilterGroupName,
                cippfIpFilterProtocolGroupName    CfgFilterGroupName,
                cippfIpFilterSrcServiceGroupName  CfgFilterGroupName,
                cippfIpFilterDstServiceGroupName  CfgFilterGroupName,
                cippfIpFilterICMPGroupName        CfgFilterGroupName
        }
        

cippfIpFilterIndex OBJECT-TYPE
        SYNTAX     Unsigned32 (0..2147483647)
        MAX-ACCESS not-accessible
        STATUS     current
        DESCRIPTION
                "This index uniquely identifies the IP protocol filters
                within this table and among all filter profiles.  When
                a new filter is added and if this value is '0', the 
                filter will be appended as the last entry for the 
                corresponding profile in this table.  

                For any set operation, the cippfIpFilterIndex value 
                must match the index of an existing 'active' filter 
                for the set operation to be successful."
        ::= { cippfIpFilterEntry 1 }

cippfIpFilterOrderPosition OBJECT-TYPE
        SYNTAX     Unsigned32 (0..65535)
        MAX-ACCESS read-create 
        STATUS     current
        DESCRIPTION
                "This object is used to order the IP protocol filters
                within a filter profile.  The filter with the lowest
                order position number is applied first, that is 
                cippfIpFilterOrderPosition '1'.  The order position 
                number among all filters of a profile is always 
                consecutive.  The agent will automatically arrange 
                the order position to a consecutive manner for the 
                filter entries within the profile after each addition
                (when the created entry moves to 'active' state) and 
                modification or deletion (when the active entry moves
                out from 'active' state) of any filter.

                For example, a new filter is added to an empty
                profile with the cippfIpFilterOrderPosition '2' , 
                the filter will be actually positioned to 
                cippfIpFilterOrderPosition '1' by the agent. 
                Moreover, if there are 3 filters in the profile 
                and their order positions are 1, 2, and 3.  Adding 
                a new filter with any cippfIpFilterOrderPosition 
                greater than '3' will produce the same effect.  The 
                new filter will actually be in position '4' because 
                the agent maintains the filters in consecutive order.

                When a filter is removed from a profile, the filters
                following this filter will be moved forward and 
                decrement their order position numbers.  For example, 
                if there are 6 filters in the profile and their 
                order positions are 1, 2, 3, 4, 5, 6.  Deleting
                the filter of cippfIpFilterOrderPosition '4' will
                cause the existing filters of 
                cippfIpFilterOrderPosition '5' and '6' to change
                to '4' and '5' respectively.

                When a filter is added to the order position of an
                existing filter of the same profile, the existing
                filter entry and all subsequent entries following it
                will increment their cippfIpFilterOrderPosition.  
                This essentially move the existing filters towards
                the end of the filter profile.  

                For example, if there are 6 filters in the profile, 
                and their cippfIpFilterOrderPosition values are 1, 
                2, 3, 4, 5, 6.  If the user would like to add a new
                one and specifies '4' to be the 
                cippfIpFilterOrderPosition of the new filter, the 
                existing filters of cippfIpFilterOrderPosition
                values 4, 5, 6 will become 5, 6, 7.  

                The cippfIpFilterOrderPosition value '0' is a
                special number meaning to append the filter
                to the last filter of the profile. Continue with
                our previous example, if another new filter is added
                and the user specifies the cippfIpFilterOrderPosition 
                to be '0'.  The new filter will actually be created  
                with cippfIpFilterOrderPosition equal to 8.  

                Finally, moving a filter within a profile will have 
                the same effect of first deleting and then adding the 
                filter to the new position.  For example, if the 
                filter of cippfIpFilterOrderPosition 2 is moved to 4,
                the filters originally at the 
                cippfIpFilterOrderPosition 3 and 4 will be moved 
                forward to 2 and 3 respectively and filters of all 
                other cippfIpFilterOrderPosition values will remain 
                unchanged."
        DEFVAL     { 0 }
        ::= { cippfIpFilterEntry 2 }

cippfIpFilterAction OBJECT-TYPE
        SYNTAX     INTEGER {
                        deny(1),
                        permit(2) }
        MAX-ACCESS read-create
        STATUS     current
        DESCRIPTION
                "If it is set to deny(1), all packets matching 
                this filter will be discarded and scanning of the 
                remainder of the filter list will be aborted.  If 
                it is set to permit(2), all packets matching this
                filter will be allowed for further bridging or
                routing processing."
        DEFVAL     { deny }
        ::= { cippfIpFilterEntry 3 }

cippfIpFilterAddressType OBJECT-TYPE
        SYNTAX InetAddressType
        MAX-ACCESS read-create
        STATUS current
        DESCRIPTION 
                "This is the IP address type of for the
                cippfIpFilterSrcAddress, cippfIpFilterSrcMask, 
                cippfIpFilterDestAddress, and cippfIpFilterDestMask."
        ::= { cippfIpFilterEntry 4 }

cippfIpFilterSrcAddress OBJECT-TYPE
        SYNTAX     InetAddress
        MAX-ACCESS read-create
        STATUS     current
        DESCRIPTION
                "The source IP address to be matched for this filter. 
                A value of zero causes all source address to match.
                The object value has to be consistent with the type
                specified in cippfIpFilterAddressType."
        DEFVAL     { "0" }
        ::= { cippfIpFilterEntry 5 }

cippfIpFilterSrcMask OBJECT-TYPE
        SYNTAX     InetAddress
        MAX-ACCESS read-create
        STATUS     current
        DESCRIPTION
                "This is the wildcard mask for the 
                cippfIpFilterSrcAddress bits that must match.  0 bits
                in the mask indicate the corresponding bits in the 
                cippfIpFilterSrcAddress must match in order for the
                matching to be successful, and 1 bits are don't care
                bits in the matching.  A value of zero causes only IP
                packets of source address the same as 
                cippfIpFilterSrcAddress to match.  This object value
                has to be consistent with the type specified in 
                cippfIpFilterAddressType."
        DEFVAL     { 'ffffffff'H } -- 255.255.255.255
        ::= { cippfIpFilterEntry 6 }

cippfIpFilterDestAddress OBJECT-TYPE
        SYNTAX     InetAddress
        MAX-ACCESS read-create
        STATUS     current
        DESCRIPTION
                "The destination IP address to be matched for this 
                filter.  A value of zero causes all source address 
                to match.  The object value has to be consistent 
                with the type specified in cippfIpFilterAddressType."
        DEFVAL     { "0" }
        ::= { cippfIpFilterEntry 7 }

cippfIpFilterDestMask OBJECT-TYPE
        SYNTAX     InetAddress
        MAX-ACCESS read-create
        STATUS     current
        DESCRIPTION
                "This is the wildcard mask for the 
                cippfIpFilterDestAddress bits that must match.  0 
                bits in the mask indicate the corresponding bits 
                in the cippfIpFilterDestAddress must match in order 
                for the matching to be successful, and 1 bits are 
                don't care bits in the matching.  A value of zero 
                causes only IP packets of source address the same as 
                cippfIpFilterSrcAddress to match.  This object value
                has to be consistent with the type specified in 
                cippfIpFilterAddressType."
        DEFVAL     { 'ffffffff'H } -- 255.255.255.255
        ::= { cippfIpFilterEntry 8 }

cippfIpFilterProtocol OBJECT-TYPE
        SYNTAX     Integer32 (-1..255)
        MAX-ACCESS read-create
        STATUS     current
        DESCRIPTION
                "This filter protocol object matches the Internet
                Protocol Number in the packets.  These IP numbers
                are defined in the Network Working Group Request 
                for Comments (RFC) documents.  For example,  
                Cisco commonly used protocol includes:
                    1 - Internet Control Message Protocol
                    2 - Internet Gateway Message Protocol
                    4 - IP in IP tunneling
                    6 - Transmission Control Protocol
                    9 - Cisco's IGRP routing protocol
                   17 - User Datagram Protocol
                   47 - Cisco's GRE tunneling
                   50 - Encapsulation Security Payload
                   51 - Authentication Header Protocol
                   88 - Cisco's EIGRP routing protocol
                   89 - OSPF routing protocol
                   94 - KA9Q NOS compatible IP over IP tunneling
                  103 - Protocol Independent Multicast
                  108 - Payload Compression Protocol
                Setting this object to '-1' will make the 
                filtering match any IP number."
        REFERENCE
                "RFC-790, ASSIGNED NUMBERS, September 1981, Section
                ASSIGNED INTERNET PROTOCOL NUMBERS."
        DEFVAL     { -1 }
        ::= { cippfIpFilterEntry 9 }

cippfIpFilterSrcPortLow OBJECT-TYPE
        SYNTAX     InetPortNumber 
        MAX-ACCESS read-create
        STATUS     current
        DESCRIPTION
                "If cippfIpFilterProtocol is udp or tcp, this is 
                the inclusive lower bound of the transport-layer 
                source port range that is to be matched, otherwise
                it is ignored during matching.  This value must be 
                equal to or less than the value specified for this
                entry in cippfIpFilterSrcPortHigh."
        DEFVAL     { 0 }
        ::= { cippfIpFilterEntry 10 }

cippfIpFilterSrcPortHigh OBJECT-TYPE
        SYNTAX     InetPortNumber 
        MAX-ACCESS read-create
        STATUS     current
        DESCRIPTION
                "If cippfIpFilterProtocol is udp or tcp, this is
                the inclusive upper bound of the transport-layer 
                source port range that is to be matched, otherwise 
                it is ignored during matching.  This value must be
                equal to or greater than the value specified for 
                this entry in cippfIpFilterSrcPortLow.  If this
                value is '0', the udp or tcp port number is
                ignored during matching."
        DEFVAL     { 65535 }
        ::= { cippfIpFilterEntry 11 }

cippfIpFilterDestPortLow OBJECT-TYPE
        SYNTAX     InetPortNumber 
        MAX-ACCESS read-create
        STATUS     current
        DESCRIPTION
                "If cippfIpFilterProtocol is udp or tcp, this is 
                the inclusive lower bound of the transport-layer
                destination port range that is to be matched, 
                otherwise it is ignored during matching.  This 
                value must be equal to or less than the value 
                specified for this entry in 
                cippfIpFilterDestPortHigh."
        DEFVAL     { 0 }
        ::= { cippfIpFilterEntry 12 }

cippfIpFilterDestPortHigh OBJECT-TYPE
        SYNTAX     InetPortNumber 
        MAX-ACCESS read-create
        STATUS     current
        DESCRIPTION
                "If cippfIpFilterProtocol is udp or tcp, this is
                the inclusive upper bound of the transport-layer 
                destination port range that is to be matched, 
                otherwise it is ignored during matching.  This 
                value must be equal to or greater than the value
                specified for this entry in 
                cippfIpFilterDestPortLow.  If this value is '0', 
                the udp or tcp port number is ignored during 
                matching."
        DEFVAL     { 65535 }
        ::= { cippfIpFilterEntry 13 }

cippfIpFilterPrecedence OBJECT-TYPE
        SYNTAX     INTEGER {
                        any(-1),
                        routine(0),  
                        priority(1),  
                        immediate(2),  
                        flash(3),       
                        flashOverride(4),
                        critical(5),    
                        internet(6),     
                        network(7) }     
        MAX-ACCESS read-create
        STATUS     current
        DESCRIPTION
                "The IP traffic precedence parameters in each packet
                are used to guide the selection of the actual 
                service parameters when transmitting a datagram 
                through a particular network.  Most network treats 
                high precedence traffic as more important than other 
                traffic.  The IP Precedence value ranges from '0' to 
                '7', with '7' the highest precedence and '0' the 
                lowest precedence. 

                This object sets criteria for matching the IP packet 
                precedence parameter.  The object value '-1' means to
                match packets of any IP precedence.  In other words,
                the IP precedence parameter will not to checked if
                this object is '-1'.  The precedence level are:

                  routine(0)       - Routine traffic precedence
                  priority(1)      - Priority traffic precedence
                  immediate(2)     - Immediate traffic precedence  
                  flash(3)         - Flash traffic precedence  
                  flashOverride(4) - Flash-override traffic 
                                     precedence  
                  critical(5)      - Critical precedence
                  internet(6)      - Internetwork control traffic 
                                     precedence  
                  network(7) - Network control traffic precedence."
        REFERENCE
                "RFC-791, INTERNET PROTOCOL DARPA INTERNET PROGRAM 
                PROTOCOL SPECIFICATION, September 1981, Section 3.1, 
                Internet Header Format."
        DEFVAL     { any }
        ::= { cippfIpFilterEntry 14 }

cippfIpFilterTos  OBJECT-TYPE
        SYNTAX     Integer32 (-1..15) 
        MAX-ACCESS read-create
        STATUS     current
        DESCRIPTION
                "This is the value to match to the Type of 
                Service (TOS) of the packet.  The TOS values
                ranges from '0' to '15'.  The value '-1' matches 
                any TOS value."
        DEFVAL     { -1 }
        ::= { cippfIpFilterEntry 15 }

cippfIpFilterLogEnabled OBJECT-TYPE
        SYNTAX     TruthValue
        MAX-ACCESS read-create
        STATUS     current
        DESCRIPTION
                "This object specifies whether filtered packets 
                will be logged by the filtering subsystem or not.  
                If it is true(1), then all packets will be logged.  
                If it is false(2), then no packet will be logged."
        DEFVAL     { false }
        ::= { cippfIpFilterEntry 16 }

cippfIpFilterStatus OBJECT-TYPE
        SYNTAX     RowStatus
        MAX-ACCESS read-create
        STATUS     current
        DESCRIPTION
                "This object controls and reflects the status of 
                rows in this table.  Creation of rows must be done 
                via 'createAndGo' and this object will become 'active'
                if the NMS performs a multivarbind set containing 
                this object and the cippfIpFilterOrderPosition.  The
                default matching action of a new filter is deny(1).  
                Any object in a row can be modified any time when 
                the row is in the 'active' state.

                Removal of a row can be done via setting this
                object to 'destroy'." 
        ::= { cippfIpFilterEntry 17 }
        
cippfIpFilterICMPType OBJECT-TYPE
        SYNTAX     Integer32 (-1..255)
        MAX-ACCESS read-create
        STATUS     current
        DESCRIPTION
                "This filter specifies the ICMP message type to be
                matched. Setting this object to '-1' will make the 
                filtering match any ICMP message type."
        REFERENCE
                "RFC-792 INTERNET CONTROL MESSAGE PROTOCOL"
        DEFVAL     { -1 }
        ::= { cippfIpFilterEntry 18 }
        
cippfIpFilterTCPEstablished OBJECT-TYPE
        SYNTAX     TruthValue
        MAX-ACCESS read-create
        STATUS     current
        DESCRIPTION
                "This filter if 'true' specifies that for TCP protocol,
                in an established connection, a match occurs if the TCP
                datagram has the ACK,FIN,PSH,RST,SYN or URG control
                bits set. If 'false' a match will occur for any TCP
                datagram. "
        DEFVAL     {false}
        ::= { cippfIpFilterEntry 19 }
        
cippfIpFilterFragments OBJECT-TYPE
        SYNTAX     TruthValue
        MAX-ACCESS read-create
        STATUS     current
        DESCRIPTION
                "If 'true', this filter applies only to the second
                and further fragments of fragmented packets. 
                If 'false', the filter will only match head 
                fragments or unfragmented packets. 
                Note: Second and subsequent fragments do not contain
                source or destination ports info, therefore cannot
                be filtered on that basis."
        DEFVAL    {false}
        ::= { cippfIpFilterEntry 20 }

cippfIpFilterICMPCode OBJECT-TYPE
        SYNTAX     Integer32 (-1..255)
        MAX-ACCESS read-create
        STATUS     current
        DESCRIPTION
                "This filter specifies the ICMP message code to be
                matched. Setting this object to '-1' will make the 
                filtering match any ICMP code."
        REFERENCE
                "RFC-792 INTERNET CONTROL MESSAGE PROTOCOL"
        DEFVAL     { -1 }
        ::= { cippfIpFilterEntry 21 }

cippfIpFilterSrcIPGroupName OBJECT-TYPE
        SYNTAX     CfgFilterGroupName
        MAX-ACCESS read-create
        STATUS     current
        DESCRIPTION
                "This object identifies the filter group 
                containing information about source IP 
                addresses and masks that need  to be matched
                for this filter.  This value must match an entry
                in cfgFilterGroupTable whose cfgFilterGroupType
                value is set to 'network' and must match an entry 
                in cfgFilterNetworkGroupTable.
                This object cannot be set if any of the following 
                objects are set:
                    cippfIpFilterSrcAddress 
                    cippfIpFilterSrcMask.

                This object is not instantiated if not applicable."
        REFERENCE
            "Refer following tables in CISCO-FILTER-GROUP-MIB:
                cfgFilterGroupTable
                cfgFilterNetworkGroupTable."
        DEFVAL { "" }
        ::= { cippfIpFilterEntry 22 }

cippfIpFilterDstIPGroupName OBJECT-TYPE
        SYNTAX     CfgFilterGroupName
        MAX-ACCESS read-create
        STATUS     current
        DESCRIPTION
                "This object identifies the filter group 
                containing information about destination IP
                addresses and masks that need  to be matched
                for this filter.  This value must match an entry
                in cfgFilterGroupTable whose cfgFilterGroupType
                value is set to 'network' and must match an entry 
                in cfgFilterNetworkGroupTable.
                This object cannot be set if any of the following 
                objects are set:
                    cippfIpFilterDestAddress 
                    cippfIpFilterDestMask.

                This object is not instantiated if not applicable."
        REFERENCE
            "Refer following tables in CISCO-FILTER-GROUP-MIB:
                cfgFilterGroupTable
                cfgFilterNetworkGroupTable."
        DEFVAL { "" }
        ::= { cippfIpFilterEntry 23 }

cippfIpFilterProtocolGroupName OBJECT-TYPE
        SYNTAX     CfgFilterGroupName
        MAX-ACCESS read-create
        STATUS     current
        DESCRIPTION
                "This object identifies the filter group 
                containing information about internet protocol
                numbers.  This value must match an entry
                in cfgFilterGroupTable whose cfgFilterGroupType
                value is set to 'service' and must match an entry 
                in cfgFilterServiceGroupTable.
                This object cannot be set if any of the following 
                objects are set:
                    cippfIpFilterProtocol.

                This object is not instantiated if not applicable."
        REFERENCE
            "Refer following tables in CISCO-FILTER-GROUP-MIB:
                cfgFilterGroupTable
                cfgFilterProtocolGroupTable."
        DEFVAL { "" }
        ::= { cippfIpFilterEntry 24 }

cippfIpFilterSrcServiceGroupName OBJECT-TYPE
        SYNTAX     CfgFilterGroupName
        MAX-ACCESS read-create
        STATUS     current
        DESCRIPTION
                "This object identifies the filter group 
                containing information about port(TCP/UDP)
                numbers.  This value must match an entry
                in cfgFilterGroupTable whose cfgFilterGroupType
                value is set to 'service' and must match an entry 
                in cfgFilterServiceGroupTable.
                This object cannot be set if any of the following 
                objects are set:
                    cippfIpFilterSrcPortLow
                    cippfIpFilterSrcPortHigh

                This object is not instantiated if not applicable."
        REFERENCE
            "Refer following tables in CISCO-FILTER-GROUP-MIB:
                cfgFilterGroupTable
                cfgFilterServiceGroupTable."
        DEFVAL { "" }
        ::= { cippfIpFilterEntry 25 }

cippfIpFilterDstServiceGroupName OBJECT-TYPE
        SYNTAX     CfgFilterGroupName
        MAX-ACCESS read-create
        STATUS     current
        DESCRIPTION
                "This object identifies the filter group 
                containing information about port(TCP/UDP)
                numbers.  This value must match an entry
                in cfgFilterGroupTable whose cfgFilterGroupType
                value is set to 'service' and must match an entry 
                in cfgFilterServiceGroupTable.
                This object cannot be set if any of the following 
                objects are set:
                    cippfIpFilterDestPortLow
                    cippfIpFilterDestPortHigh

                This object is not instantiated if not applicable."
        REFERENCE
            "Refer following tables in CISCO-FILTER-GROUP-MIB:
                cfgFilterGroupTable
                cfgFilterServiceGroupTable."
        DEFVAL { "" }
        ::= { cippfIpFilterEntry 26 }

cippfIpFilterICMPGroupName OBJECT-TYPE
        SYNTAX     CfgFilterGroupName
        MAX-ACCESS read-create
        STATUS     current
        DESCRIPTION
                "This object identifies the filter group containing
                information about ICMP message.  This value must 
                match an entry in cfgFilterGroupTable whose 
                cfgFilterGroupType value is set to 'icmp' and must 
                match an entry in cfgFilterICMPGroupTable.
                This object cannot be set if any of the following 
                objects are set:
                    cippfIpFilterICMPType 
                    cippfIpFilterICMPCode.

                This object is not instantiated if not applicable."
        REFERENCE
            "Refer following tables in CISCO-FILTER-GROUP-MIB:
                cfgFilterGroupTable
                cfgFilterICMPGroupTable."
        DEFVAL { "" }
        ::= { cippfIpFilterEntry 27 }

cippfIpFilterExtTable OBJECT-TYPE
        SYNTAX     SEQUENCE OF CippfIpFilterExtEntry
        MAX-ACCESS not-accessible
        STATUS     current
        DESCRIPTION
                "This table is an extension to cippfIpFilterTable.
                This table is used for configuring the objects
                that are used for reporting the information about
                filters and reporting the logs.  These objects
                do not change the match criteria for the filter
                but assist in troubleshooting the matched criteria."
        ::= { cippfIpFilterConfig 4 }

cippfIpFilterExtEntry OBJECT-TYPE
        SYNTAX     CippfIpFilterExtEntry
        MAX-ACCESS not-accessible
        STATUS     current
        DESCRIPTION
                "An entry in filter extension table. Each entry
                contains information on the description of the 
                filter and logging related objects."
        AUGMENTS { cippfIpFilterEntry }
        ::= { cippfIpFilterExtTable 1 }

CippfIpFilterExtEntry ::= SEQUENCE {
                cippfIpFilterExtDescription     SnmpAdminString, 
                cippfIpFilterExtLogLevel        SyslogSeverity,
                cippfIpFilterExtLogInterval     Unsigned32 
        }

cippfIpFilterExtDescription OBJECT-TYPE
        SYNTAX     SnmpAdminString
        MAX-ACCESS read-create
        STATUS     current
        DESCRIPTION
                "This object is used for configuring
                description of the filter."
        DEFVAL     { "" }
        ::= { cippfIpFilterExtEntry 1 }

cippfIpFilterExtLogLevel OBJECT-TYPE
        SYNTAX     SyslogSeverity
        MAX-ACCESS read-create
        STATUS     current
        DESCRIPTION
                "This object is used for specifying the log level
                (severity) used in syslog for this filter."
        DEFVAL     { info }
        ::= { cippfIpFilterExtEntry 2 }

cippfIpFilterExtLogInterval OBJECT-TYPE
        SYNTAX     Unsigned32
        UNITS      "seconds"
        MAX-ACCESS read-create
        STATUS     current
        DESCRIPTION
                "This object is used for configuring the time 
                interval at which the syslog message for this 
                filter to be generated."
        DEFVAL     { 300 }
        ::= { cippfIpFilterExtEntry 3 }

cippfIpFilterStatsTable OBJECT-TYPE
    SYNTAX     SEQUENCE OF CippfIpFilterStatsEntry
    MAX-ACCESS not-accessible
    STATUS     current
    DESCRIPTION
        "This table defines a set of statistics related to 
        packet filter.  The statistics related to matched 
        filters are available here."
    ::= { cippfIpFilterStats 1 }

cippfIpFilterStatsEntry OBJECT-TYPE
    SYNTAX     CippfIpFilterStatsEntry
    MAX-ACCESS not-accessible
    STATUS     current
    DESCRIPTION
        "An entry in IP Filter stats table. An entry exists
        in this table for every entry in cippfIpFilterTable."
    INDEX{ 
        cippfIpProfileName, 
        cippfIpFilterIndex
    }
    ::= { cippfIpFilterStatsTable 1 }

CippfIpFilterStatsEntry ::= SEQUENCE {
        cippfIpFilterHits    Counter64
    }

cippfIpFilterHits OBJECT-TYPE
    SYNTAX     Counter64
    MAX-ACCESS read-only
    STATUS     current
    DESCRIPTION
        "This object specifies the number of packets that
        are matched the packet filter configuration in
        cippfIpFilterTable."
    ::= { cippfIpFilterStatsEntry 1 }


-- *****************************************************************
-- Conformance information  
-- *****************************************************************

ciscoIpProtocolFilterMIBCompl
        OBJECT IDENTIFIER ::= { ciscoIpProtocolFilterMIBConform 1 }

ciscoIpProtocolFilterMIBGroups
        OBJECT IDENTIFIER ::= { ciscoIpProtocolFilterMIBConform 2 }


-- *****************************************************************
-- Compliance statements  
-- *****************************************************************

ciscoIpProtocolMIBCompliance MODULE-COMPLIANCE
        STATUS    deprecated  -- superceeded by 
                              -- ciscoIpProtocolMIBComplianceRev1
        DESCRIPTION
                "The compliance statement for entities implementing
                the Cisco IP Protocol Filter MIB.

                OBJECT  cippfIpFilterAddressType 
                SYNTAX  InetAddressType { ipv4(1) }
                DESCRIPTION
                        An implementation is only required to 
                        support IPv4 addresses.

                OBJECT  cippfIpFilterSrcAddress 
                SYNTAX  InetAddress (SIZE(4))
                DESCRIPTION
                        An implementation is only required to 
                        support IPv4 addresses.

                OBJECT  cippfIpFilterDestAddress 
                SYNTAX  InetAddress (SIZE(4))
                DESCRIPTION
                        An implementation is only required to 
                        support IPv4 addresses."
        MODULE  
                MANDATORY-GROUPS { 
                        ciscoIpProtocolFilteringGroup }
        ::= { ciscoIpProtocolFilterMIBCompl 1 }
        
ciscoIpProtocolMIBComplianceRev1 MODULE-COMPLIANCE
        STATUS    deprecated  -- superceeded by 
                              -- ciscoIpProtocolMIBComplianceRev2
        DESCRIPTION
                "The compliance statement for entities implementing
                the Cisco IP Protocol Filter MIB.

                OBJECT  cippfIpFilterAddressType 
                SYNTAX  InetAddressType { ipv4(1) }
                DESCRIPTION
                        An implementation is only required to 
                        support IPv4 addresses.

                OBJECT  cippfIpFilterSrcAddress 
                SYNTAX  InetAddress (SIZE(4))
                DESCRIPTION
                        An implementation is only required to 
                        support IPv4 addresses.

                OBJECT  cippfIpFilterDestAddress 
                SYNTAX  InetAddress (SIZE(4))
                DESCRIPTION
                        An implementation is only required to 
                        support IPv4 addresses.
                         
                OBJECT  cippfIpFilterOrderPosition
                MIN-ACCESS read-only 
                DESCRIPTION
                        Write access is not required.
                        
                OBJECT  cippfIpProfileType
                MIN-ACCESS read-only 
                DESCRIPTION
                        Write access is not required. "        
                
        MODULE  
                MANDATORY-GROUPS { 
                        ciscoIpProtocolFilteringGroup }
                        
                GROUP ciscoIpProtocolFilterGroup2
                DESCRIPTION
                    "Implementation of this group is optional."
        ::= { ciscoIpProtocolFilterMIBCompl 2 }

ciscoIpProtocolMIBComplianceRev2 MODULE-COMPLIANCE
        STATUS    current
        DESCRIPTION
                "The compliance statement for entities implementing
                the Cisco IP Protocol Filter MIB."
        MODULE  
                MANDATORY-GROUPS { 
                        ciscoIpProtocolFilteringGroup,
                        ciscoIpProtocolFilterStatsGroup
                }        

        OBJECT  cippfIpFilterAddressType 
        -- SYNTAX  InetAddressType { ipv4(1) }
        SYNTAX  INTEGER { ipv4(1) }
        DESCRIPTION
            "An implementation is only required to 
            support IPv4 addresses."

        OBJECT  cippfIpFilterSrcAddress 
        SYNTAX  InetAddress (SIZE(4))
        DESCRIPTION
            "An implementation is only required to 
            support IPv4 addresses."

        OBJECT  cippfIpFilterDestAddress 
        SYNTAX  InetAddress (SIZE(4))
        DESCRIPTION
            "An implementation is only required to 
            support IPv4 addresses."
                         
        OBJECT  cippfIpFilterOrderPosition
        MIN-ACCESS read-only 
        DESCRIPTION
            "Write access is not required."
                        
        OBJECT  cippfIpProfileType
        MIN-ACCESS read-only 
        DESCRIPTION
            "Write access is not required. "        
                
        GROUP ciscoIpProtocolFilterGroup2
        DESCRIPTION
            "Implementation of this group is optional."

        GROUP ciscoIpProtocolFilterExtGroup
        DESCRIPTION
            "Implementation of this group is mandatory
            for those systems where additional objects
            supported for each filter."

        GROUP ciscoIpProtocolFilterObjectGroup
        DESCRIPTION
            "Implementation of this group is mandatory
            for those systems where filter groups
            are supported in IP filters."

        OBJECT     cippfIpFilterSrcIPGroupName
        MIN-ACCESS not-accessible
        DESCRIPTION
            "This object is not required to be implemented
            if filter group is not supported."

        OBJECT     cippfIpFilterDstIPGroupName
        MIN-ACCESS not-accessible
        DESCRIPTION
            "This object is not required to be implemented
            if filter group is not supported."

        OBJECT     cippfIpFilterSrcServiceGroupName
        MIN-ACCESS not-accessible
        DESCRIPTION
            "This object is not required to be implemented
            if filter group is not supported."

        OBJECT     cippfIpFilterDstServiceGroupName
        MIN-ACCESS not-accessible
        DESCRIPTION
            "This object is not required to be implemented
            if filter group is not supported."

        OBJECT     cippfIpFilterICMPGroupName
        MIN-ACCESS not-accessible
        DESCRIPTION
            "This object is not required to be implemented
            if filter group is not supported."
        ::= { ciscoIpProtocolFilterMIBCompl 3 }


-- *****************************************************************
-- Units of conformance  
-- *****************************************************************

ciscoIpProtocolFilteringGroup OBJECT-GROUP
        OBJECTS {
                cippfIpProfileType,        
                cippfIpProfileLastFilterIndex,
                cippfIpProfileStatus,        
                cippfIfIpProfileName,        
                cippfIfIpProfileStatus, 
                cippfIpFilterOrderPosition, 
                cippfIpFilterAction,
                cippfIpFilterAddressType,
                cippfIpFilterSrcAddress,
                cippfIpFilterSrcMask,      
                cippfIpFilterDestAddress,
                cippfIpFilterDestMask,    
                cippfIpFilterProtocol,
                cippfIpFilterSrcPortLow,
                cippfIpFilterSrcPortHigh,
                cippfIpFilterDestPortLow,
                cippfIpFilterDestPortHigh,
                cippfIpFilterPrecedence,
                cippfIpFilterTos,
                cippfIpFilterLogEnabled,
                cippfIpFilterStatus }
        STATUS    current
        DESCRIPTION
                "Configuration parameters for IP Protocol filters."
        ::= { ciscoIpProtocolFilterMIBGroups 1 }

ciscoIpProtocolFilterGroup2 OBJECT-GROUP
        OBJECTS {
                 cippfIpFilterICMPType,
                 cippfIpFilterTCPEstablished,
                 cippfIpFilterFragments,
                 cippfIpFilterICMPCode }
        STATUS    current
        DESCRIPTION
                "Configuration parameters for IP Protocol filters. "
        ::= { ciscoIpProtocolFilterMIBGroups 2 }

ciscoIpProtocolFilterExtGroup OBJECT-GROUP
        OBJECTS {
                 cippfIpFilterExtDescription,
                 cippfIpFilterExtLogLevel,
                 cippfIpFilterExtLogInterval
        }
        STATUS    current
        DESCRIPTION
                "Configuration parameters for logging 
                packet filters."
        ::= { ciscoIpProtocolFilterMIBGroups 4 }

ciscoIpProtocolFilterObjectGroup OBJECT-GROUP
        OBJECTS {
                cippfIpFilterSrcIPGroupName,
                cippfIpFilterDstIPGroupName,
                cippfIpFilterProtocolGroupName,
                cippfIpFilterSrcServiceGroupName,
                cippfIpFilterDstServiceGroupName,
                cippfIpFilterICMPGroupName
        }
        STATUS    current
        DESCRIPTION
                "Configuration parameters for filter groups
                in a protocol filter."
        ::= { ciscoIpProtocolFilterMIBGroups 5 }

ciscoIpProtocolFilterStatsGroup OBJECT-GROUP
        OBJECTS {
                cippfIpFilterHits
        }
        STATUS    current
        DESCRIPTION
                "This is a group containing objects
                related to packet filter."
        ::= { ciscoIpProtocolFilterMIBGroups 6 }


-- *****************************************************************
-- End of units of conformance  
-- *****************************************************************

END


