-- *****************************************************************
-- WESTERMO-SW6-FIREWALL-MIB :
-- SNMP feature configuration of Westermo devices with SW6.
--
-- Copyright (c) 2020 by Westermo Network Technologies AB
-- All rights reserved.
-- *****************************************************************

-- *****************************************************************
-- This script has been tested using the SMI checker smilint
-- the tool can be downloaded at
-- http://www.ibr.cs.tu-bs.de/projects/libsmi/smilint.html
-- or use alternatively the online version at:
-- http://www.simpleweb.org/ietf/mibs/validate/
--
-- smilint -m -s -l 6 -i nameLength-32 ./WESTERMO-SW6-FIREWALL-MIB
-- Ensure that all needed MIBS are located in the SMIPATH.
-- *****************************************************************

-- **********************************************************************
-- * FIREWALL MIB
-- **********************************************************************

WESTERMO-SW6-FIREWALL-MIB DEFINITIONS ::= BEGIN

    IMPORTS
        MODULE-IDENTITY, OBJECT-TYPE,
        IpAddress, Integer32                   FROM SNMPv2-SMI
        DisplayString                          FROM SNMPv2-TC
        MODULE-COMPLIANCE, OBJECT-GROUP        FROM SNMPv2-CONF
    ;

-- **********************************************************************
-- *  MODULE IDENTITY
-- **********************************************************************
firewall MODULE-IDENTITY
    LAST-UPDATED "202608120000Z"

    ORGANIZATION "Westermo Network Technologies AB"
    CONTACT-INFO "E-mail: info@westermo.com"
    DESCRIPTION  "MIB Module for the Westermo RT-300 Radio Modem Device - Firewall definitions"

    REVISION     "202608120000Z"
    DESCRIPTION  "Release 6.12.1-0"

    ::= { iso(1) org(3) dod(6) internet(1) private(4) enterprises(1)
          westermo(16177) products(1) rt(400) feature(2) 1 }

-- **********************************************************************
-- *  Begin Major sections
-- * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

--  Configuration
--  =============

    configuration     OBJECT IDENTIFIER ::= { firewall 1 }

--  Conformance Information
--  =======================

    conformance           OBJECT IDENTIFIER ::= { firewall 10000 }
     groups               OBJECT IDENTIFIER ::= { conformance 1 }
      groupConfiguration  OBJECT IDENTIFIER ::= { groups 1 }

     compliances          OBJECT IDENTIFIER ::= { conformance 2 }

-- * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
-- *  End Major Sections
-- **********************************************************************



-- **********************************************************************
-- *  Begin Object Types
-- * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

    cfgFwEnabled OBJECT-TYPE
        SYNTAX INTEGER { disabled(0), enabled(1) }
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "L3 Firewall Disabled or Enabled

             Globally disable or enable the functionality of NAT `cfgFwNat`,
             Layer 3 filters `cfgFwFilter` and L3 mangle `cfgFwMangle`.

             **Note:** Layer 2 filters `cfgFwL2IpFilter` Layer 2 mangle are not
             related. They must be enabled globally with the parameter
             `cfgFwL2IpFilterEnabled`. respectively `cfgFwL2MangleEnabled`."
        ::= { configuration 1 }

-- =============================================================================

    cfgFwNat         OBJECT IDENTIFIER ::= { configuration 2 }

    cfgFwNatPortForwardTable OBJECT-TYPE
        SYNTAX SEQUENCE OF CfgFwNatPrtFwdTableSeq
        MAX-ACCESS not-accessible
        STATUS     current
        DESCRIPTION
            "Firewall Port Forward Rules Table (DNAT)"
        ::= { cfgFwNat 1 }

    cfgFwNatPortForwardTableEntry OBJECT-TYPE
        SYNTAX  CfgFwNatPrtFwdTableSeq
        MAX-ACCESS not-accessible
        STATUS     current
        DESCRIPTION
            "Firewall Port Forward Rules Table (DNAT)"
        INDEX {cfgFwNatPrtFwdIndex}
        ::= { cfgFwNatPortForwardTable 1 }

    CfgFwNatPrtFwdTableSeq ::=
        SEQUENCE {  cfgFwNatPrtFwdIndex Integer32,
                    cfgFwNatPrtFwdEnabled INTEGER,
                    cfgFwNatPrtFwdInterface DisplayString,
                    cfgFwNatPrtFwdProtocol INTEGER,
                    cfgFwNatPrtFwdSourceAddress DisplayString,
                    cfgFwNatPrtFwdSourcePortStart DisplayString,
                    cfgFwNatPrtFwdSourcePortEnd Integer32,
                    cfgFwNatPrtFwdDestinationAddress DisplayString,
                    cfgFwNatPrtFwdDestinationPortStart DisplayString,
                    cfgFwNatPrtFwdDestinationPortEnd Integer32,
                    cfgFwNatPrtFwdRedirectDestinationAddress IpAddress,
                    cfgFwNatPrtFwdRedirectDestinationPort Integer32,
                    cfgFwNatPrtFwdComment DisplayString
                 }

    cfgFwNatPrtFwdIndex OBJECT-TYPE
        SYNTAX Integer32 (0..255)
        MAX-ACCESS not-accessible
        STATUS     current
        DESCRIPTION
            "Entry Index of Port Forward Table"
        ::= { cfgFwNatPortForwardTableEntry 1 }

    cfgFwNatPrtFwdEnabled OBJECT-TYPE
        SYNTAX INTEGER { disabled(0), enabled(1) }
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Disable or Enable this Rule"
        ::= { cfgFwNatPortForwardTableEntry 2 }

     cfgFwNatPrtFwdInterface OBJECT-TYPE
        SYNTAX DisplayString (SIZE(1..255))
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Name of the Network Interface on Which the Rule Applies

             Defines on which interface traffic is comming in. Groups of
             interfaces may be matched by adding the character `+` at the end.

             **Examples:**

             * br0.vlan0
             * eth1
             * eth+
             * br0.vlan+
             * -1

             If you don't know the inbound interface and want to match all,
             set this parameter to `-1`."
        ::= { cfgFwNatPortForwardTableEntry 3 }

    cfgFwNatPrtFwdProtocol OBJECT-TYPE
        SYNTAX INTEGER { any(0), udp(1), tcp(2), udptcp(3) }
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Choose Which IP Protocol the Rule Matches

             Allowed protocols are:

             * **any(0):** Any ip protocol
             * **udp(1):** Only UDP protocol
             * **tcp(2):** Only TCP protocol
             * **udptcp(3):** UDP and TCP protocol"
        ::= { cfgFwNatPortForwardTableEntry 4 }

    cfgFwNatPrtFwdSourceAddress OBJECT-TYPE
        SYNTAX DisplayString (SIZE(7..19))
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Source Address to Match

             This is a specific IP address or a range in CIDR notation.

             An exclamation mark `!` before the address/network may be used to
             invert the sense of the rule, e.g `!192.168.0.0/24`.

             Use this parameter to restrict the source of traffic on which the
             rule is applied.

             **Examples:**

             * 172.17.29.7/32: Match the specific source IP 172.17.29.7
             * 0.0.0.0/0: Match all sources addresses
             * 192.168.0.0/24: Match the specified source network
             * !192.168.0.0/24: Match any source, except the specified network

             **Note:** Usually this should be `0.0.0.0/0`."
        ::= { cfgFwNatPortForwardTableEntry 5 }

    cfgFwNatPrtFwdSourcePortStart OBJECT-TYPE
        SYNTAX DisplayString (SIZE(1..6))
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Source Start Port to Match

             This parameter is active when `cfgFwNatPrtFwdProtocol` is set to
             **udp(1)**, **tcp(2)** or **udptcp(3)**.

             Specify a port or the start of a port range from which a connection
             originates.

             Set to `-1` to disable this parameter.

             An exclamation mark `!` before the port may be used to invert the
             sense of the rule, e.g `!80`.

             When used in a range, the inversion applies to the range.

             Use `cfgFwNatPrtFwdSourcePortEnd` to specify the end of the range.

             **Note:** Usually this should be `-1`."
        ::= { cfgFwNatPortForwardTableEntry 6 }

    cfgFwNatPrtFwdSourcePortEnd OBJECT-TYPE
        SYNTAX Integer32 (-1..65535)
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Source End Port to Match

             This parameter is active when `cfgFwNatPrtFwdProtocol` is set to
             **udp(1)**, **tcp(2)** or **udptcp(3)**.

             Specifies the end of a port range from which a connection
             originates.

             Set to `-1` to disable this parameter and only match the port
             specified in `cfgFwNatPrtFwdSourcePortStart`.

             **Note:** Usually this should be `-1`."
        ::= { cfgFwNatPortForwardTableEntry 7 }

    cfgFwNatPrtFwdDestinationAddress OBJECT-TYPE
        SYNTAX DisplayString (SIZE(7..19))
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Destination Address to Redirect

             This is a specific IP address or a range in CIDR notation.

             Use this parameter to restrict the destination of traffic on which
             the rule is applied.

             Set to `0.0.0.0/0` to match all destinations of inbound traffic on
             the interface specified in `cfgFwNatPrtFwdInterface`.

             An exclamation mark `!` before the destination may be used to
             invert the sense of the rule, e.g `!192.168.0.0/24`.

             When using static IPs set this to the configured address of the
             respective interface or alias you want to forward.

             Be aware, that setting `0.0.0.0/0` will redirect everything arriving
             on the configured interface, even if not sent to the device itself.

             **Examples:**

             * 172.17.29.7/32: Match the specific destination IP 172.17.29.7
             * 0.0.0.0/0: Match all destination addresses
             * 192.168.0.0/24: Match the specified destination network
             * !192.168.0.0/24: Match any destination, except this network

             **Note:** This should be `0.0.0.0/0` when using DHCP."
        ::= { cfgFwNatPortForwardTableEntry 8 }

    cfgFwNatPrtFwdDestinationPortStart OBJECT-TYPE
        SYNTAX DisplayString (SIZE(1..6))
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Destination Start Port to Redirect

             This parameter is active when `cfgFwNatPrtFwdProtocol` is set to
             **udp(1)**, **tcp(2)** or **udptcp(3)**.

             Specify the destination port or start of a port range.

             Set to `-1` to disable this parameter and match any port.

             An exclamation mark `!` before the port may be used to invert the
             sense of the rule, e.g `!80`.

             When used in a range, the inversion applies to the range.

             Use `cfgFwNatPrtFwdDestinationPortEnd` to specify the end of the
             range."
        ::= { cfgFwNatPortForwardTableEntry 9 }

    cfgFwNatPrtFwdDestinationPortEnd OBJECT-TYPE
        SYNTAX Integer32 (-1..65535)
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Destination End Port to Redirect

             This parameter is active when `cfgFwNatPrtFwdProtocol` is set to
             **udp(1)**, **tcp(2)** or **udptcp(3)**.

             Specifies the end of a port range to which a connection is destined.

             Set to `-1` to disable this parameter and only match the port
             specified in `cfgFwNatPrtFwdDestinationPortStart`.

             **Note:** Usually this should be `-1`."
        ::= { cfgFwNatPortForwardTableEntry 10 }

    cfgFwNatPrtFwdRedirectDestinationAddress OBJECT-TYPE
        SYNTAX IpAddress
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Redirect Traffic to this Redirection Destination Address

             Frames matched by this rule have their destination address
             rewritten to the value specified here."
        ::= { cfgFwNatPortForwardTableEntry 11 }

    cfgFwNatPrtFwdRedirectDestinationPort OBJECT-TYPE
        SYNTAX Integer32 (-1..65535)
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Redirect Traffic to this Destination Port

             This parameter is active when `cfgFwNatPrtFwdProtocol` is set to
             **udp(1)**, **tcp(2)** or **udptcp(3)**.

             Frames matched by this rule have their destination port
             rewritten to the value specified here.

             **Note:** Even when a range of ports is matched, the destination
                       port is rewritten to the single port specified here."
        ::= { cfgFwNatPortForwardTableEntry 12 }

    cfgFwNatPrtFwdComment OBJECT-TYPE
        SYNTAX DisplayString (SIZE(0..255))
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "User Comment

             This parameter has no operational function.
             It allows to store a comment about the use of this port forward."
        ::= { cfgFwNatPortForwardTableEntry 13 }

-- -----------------------------------------------------------------------------

    cfgFwNatOutboundTable OBJECT-TYPE
        SYNTAX SEQUENCE OF CfgFwNatOutTableSeq
        MAX-ACCESS not-accessible
        STATUS     current
        DESCRIPTION
            "Firewall Outbound NAT Rules Table (SNAT)"
        ::= { cfgFwNat 2 }

    cfgFwNatOutboundTableEntry OBJECT-TYPE
        SYNTAX  CfgFwNatOutTableSeq
        MAX-ACCESS not-accessible
        STATUS     current
        DESCRIPTION
            "Firewall Outbound NAT Rules Table (SNAT)"
        INDEX {cfgFwNatOutIndex}
        ::= { cfgFwNatOutboundTable 1 }

    CfgFwNatOutTableSeq ::=
        SEQUENCE {  cfgFwNatOutIndex Integer32,
                    cfgFwNatOutEnabled INTEGER,
                    cfgFwNatOutInterface DisplayString,
                    cfgFwNatOutProtocol INTEGER,
                    cfgFwNatOutSourceAddress DisplayString,
                    cfgFwNatOutSourcePortStart DisplayString,
                    cfgFwNatOutSourcePortEnd Integer32,
                    cfgFwNatOutDestinationAddress DisplayString,
                    cfgFwNatOutDestinationPortStart DisplayString,
                    cfgFwNatOutDestinationPortEnd Integer32,
                    cfgFwNatOutSourceRewriteAddress IpAddress,
                    cfgFwNatOutSourceRewritePort Integer32,
                    cfgFwNatOutComment DisplayString
                 }

    cfgFwNatOutIndex OBJECT-TYPE
        SYNTAX Integer32 (0..255)
        MAX-ACCESS not-accessible
        STATUS     current
        DESCRIPTION
            "Table Entry Index"
        ::= { cfgFwNatOutboundTableEntry 1 }

    cfgFwNatOutEnabled OBJECT-TYPE
        SYNTAX INTEGER { disabled(0), enabled(1) }
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Disable or Enable this Rule"
        ::= { cfgFwNatOutboundTableEntry 2 }

     cfgFwNatOutInterface OBJECT-TYPE
        SYNTAX DisplayString (SIZE(1..255))
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Name of the Network Interface on Which the Rule Applies

             Matches traffic leaving on this interface.

             Needs to be set to an interface name if you are using DHCP. Set to
             `-1` if you don't know on which interface traffic will be leaving,
             and match the traffic with `cfgFwNatOutDestinationAddress` instead.

             Groups of interfaces may be matched by adding the character `+` at
             the end. E.g. `eth+` to match the interfaces eth0, eth1.

             An exclamation mark `!` before the interface may be used to invert
             the sense of the rule, e.g `!wlan0`."
        ::= { cfgFwNatOutboundTableEntry 3 }

    cfgFwNatOutProtocol OBJECT-TYPE
        SYNTAX INTEGER { any(0), udp(1), tcp(2), udptcp(3) }
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Choose Which IP Protocol the Rule Matches

             Allowed protocols are:

             * **any(0):** Any ip protocol
             * **udp(1):** Only UDP protocol
             * **tcp(2):** Only TCP protocol
             * **udptcp(3):** UDP and TCP protocol"
        ::= { cfgFwNatOutboundTableEntry 4 }

    cfgFwNatOutSourceAddress OBJECT-TYPE
        SYNTAX DisplayString (SIZE(7..19))
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Source Address to Match

             This is a specific IP address or a range in CIDR notation.

             An exclamation mark `!` before the address/network may be used to
             invert the sense of the rule, e.g `!192.168.0.0/24`.

             Use this parameter to restrict the source of traffic on which the
             rule is applied.

             **Examples:**

             * 172.17.29.7/32: Match the specific source IP 172.17.29.7
             * 0.0.0.0/0: Match all sources addresses
             * 192.168.0.0/24: Match the specified source network
             * !192.168.0.0/24: Match any source, except the specified network

             **Note:** Usually this should be `0.0.0.0/0`."
        ::= { cfgFwNatOutboundTableEntry 5 }

    cfgFwNatOutSourcePortStart OBJECT-TYPE
        SYNTAX DisplayString (SIZE(1..6))
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Source Start Port to Match

             This parameter is active when `cfgFwNatOutProtocol` is set to
             **udp(1)**, **tcp(2)** or **udptcp(3)**.

             Specify a port or the start of a port range from which a connection
             originates.

             Set to `-1` to disable this parameter.

             An exclamation mark `!` before the port may be used to invert the
             sense of the rule, e.g `!80`.

             When used in a range, the inversion applies to the range.

             Use `cfgFwNatOutSourcePortEnd` to specify the end of the range.

             **Note:** Usually this should be `-1`."
        ::= { cfgFwNatOutboundTableEntry 6 }

    cfgFwNatOutSourcePortEnd OBJECT-TYPE
        SYNTAX Integer32 (-1..65535)
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Source End Port to Match

             This parameter is active when `cfgFwNatOutProtocol` is set to
             **udp(1)**, **tcp(2)** or **udptcp(3)**.

             Specifies the end of a port range from which a connection
             originates.

             Set to `-1` to disable this parameter and only match the port
             specified in `cfgFwNatOutSourcePortStart`.

             **Note:** Usually this should be `-1`."
        ::= { cfgFwNatOutboundTableEntry 7 }

    cfgFwNatOutDestinationAddress OBJECT-TYPE
        SYNTAX DisplayString (SIZE(7..19))
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Destination Address to Match

             This is a specific IP address or a range in CIDR notation.

             Use this parameter to restrict the destination of traffic on which
             the rule is applied.

             Set to `0.0.0.0/0` to match all destinations of outbound traffic on
             the interface specified in `cfgFwNatOutInterface`.

             An exclamation mark `!` before the destination may be used to
             invert the sense of the rule, e.g `!192.168.0.0/24`.

             **Examples:**

             * 172.17.29.7/32: Match the specific destination IP 172.17.29.7
             * 0.0.0.0/0: Match all destination addresses
             * 192.168.0.0/24: Match the specified destination network
             * !192.168.0.0/24: Match any destination, except this network"
        ::= { cfgFwNatOutboundTableEntry 8 }

    cfgFwNatOutDestinationPortStart OBJECT-TYPE
        SYNTAX DisplayString (SIZE(1..6))
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Destination Start Port to Match

             This parameter is active when `cfgFwNatOutProtocol` is set to
             **udp(1)**, **tcp(2)** or **udptcp(3)**.

             Specify the destination port or start of a port range.

             Set to `-1` to disable this parameter and match any port.

             An exclamation mark `!` before the port may be used to invert the
             sense of the rule, e.g `!80`.

             When used in a range, the inversion applies to the range.

             Use `cfgFwNatOutDestinationPortEnd` to specify the end of the
             range.

             **Note:** Usually this should be `-1`."
        ::= { cfgFwNatOutboundTableEntry 9 }

    cfgFwNatOutDestinationPortEnd OBJECT-TYPE
        SYNTAX Integer32 (-1..65535)
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Destination End Port to Redirect

             This parameter is active when `cfgFwNatOutProtocol` is set to
             **udp(1)**, **tcp(2)** or **udptcp(3)**.

             Specifies the end of a port range to which a connection is destined.

             Set to `-1` to disable this parameter and only match the port
             specified in `cfgFwNatOutDestinationPortStart`.

             **Note:** Usually this should be `-1`."
        ::= { cfgFwNatOutboundTableEntry 10 }

    cfgFwNatOutSourceRewriteAddress OBJECT-TYPE
        SYNTAX IpAddress
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Source Rewrite Address

             Frames matched by this rule have their source address
             rewritten to the value specified here.

             When this parameter is set to `0.0.0.0`, the address is rewritten
             to the configured primary (first) address of the interface.

             In case you are using DHCP where the address is unknown in advance,
             also set this parameter on `0.0.0.0`."
        ::= { cfgFwNatOutboundTableEntry 11 }

    cfgFwNatOutSourceRewritePort OBJECT-TYPE
        SYNTAX Integer32 (-1..65535)
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Source Rewrite Port

             This parameter is active when `cfgFwNatOutProtocol` is set to
             **udp(1)**, **tcp(2)** or **udptcp(3)**.

             Frames matched by this rule have their source port rewritten to the
             value specified here.

             Set this parameter to `-1` to disable source port rewriting.

             **Note:** Usually this should be `-1`."
        ::= { cfgFwNatOutboundTableEntry 12 }

    cfgFwNatOutComment OBJECT-TYPE
        SYNTAX DisplayString (SIZE(0..255))
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "User Comment

             This parameter has no operational function.
             It allows to store a comment about the use of this outbound rule."
        ::= { cfgFwNatOutboundTableEntry 13 }

-- -----------------------------------------------------------------------------

    cfgFwNatOneToOneTable OBJECT-TYPE
        SYNTAX SEQUENCE OF CfgFwNatOneToOneTableSeq
        MAX-ACCESS not-accessible
        STATUS     current
        DESCRIPTION
            "Netmap Table

             The netmap table allows to rewrite the source respective
             destination of a whole network.
             This is an advantage over the `cfgFwNatPortForwardTable` and
             `cfgFwNatOutboundTable` which only allow to rewrite a single source
             respective a single destination.

             It provides 3 types of operation:

             * Auto mode where inbound and outbound frames automatically have
               their source, respectively destination, rewritten.
             * DNAT mode where inbound frames to the specified
               `cfgFwNatOneToOneDestinationNet` have their destination rewritten
               to `cfgFwNatOneToOneRewriteNet`
             * SNAT mode where outbound frames from the the specified
               `cfgFwNatOneToOneSourceNet` have their source rewritten to
               `cfgFwNatOneToOneRewriteNet`."
        ::= { cfgFwNat 3 }

    cfgFwNatOneToOneTableEntry OBJECT-TYPE
        SYNTAX  CfgFwNatOneToOneTableSeq
        MAX-ACCESS not-accessible
        STATUS     current
        DESCRIPTION
            "Netmap Table Entry"
        INDEX {cfgFwNatOneToOneIndex}
        ::= { cfgFwNatOneToOneTable 1 }

    CfgFwNatOneToOneTableSeq ::=
        SEQUENCE {  cfgFwNatOneToOneIndex Integer32,
                    cfgFwNatOneToOneEnabled INTEGER,
                    cfgFwNatOneToOneType INTEGER,
                    cfgFwNatOneToOneInterface DisplayString,
                    cfgFwNatOneToOneSourceNet DisplayString,
                    cfgFwNatOneToOneDestinationNet DisplayString,
                    cfgFwNatOneToOneRewriteNet DisplayString,
                    cfgFwNatOneToOneComment DisplayString
                 }

    cfgFwNatOneToOneIndex OBJECT-TYPE
        SYNTAX Integer32 (0..255)
        MAX-ACCESS not-accessible
        STATUS     current
        DESCRIPTION
            "Table Entry Index"
        ::= { cfgFwNatOneToOneTableEntry 1 }

    cfgFwNatOneToOneEnabled OBJECT-TYPE
        SYNTAX INTEGER { disabled(0), enabled(1) }
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Disable or Enable this Rule"
        ::= { cfgFwNatOneToOneTableEntry 2 }

    cfgFwNatOneToOneType OBJECT-TYPE
        SYNTAX INTEGER { auto(0), dnat(1), snat(2) }
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Type of Rule

             This parameter defines the type of netmap:

             * **auto(0)**: A rule in auto mode creates automatically a DNAT
                            and an SNAT rule for the specified source,
                            destination and rewrite networks, also known as 1:1
                            NAT.
             * **dnat(1)**: A rule in DNAT mode rewrites the destination network
                            to the specified rewrite network.
             * **snat(2)**: A rule in SNAT mode rewrites the source network to
                            the specified rewrite network."
        ::= { cfgFwNatOneToOneTableEntry 3 }

    cfgFwNatOneToOneInterface OBJECT-TYPE
        SYNTAX DisplayString (SIZE(1..15))
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Interface

             Depending on the selected type in `cfgFwNatOneToOneType`:

             For the types **auto(0)** and **dnat(1)** it refers to the
             interface on which traffic ingresses (input interface).

             For the type **snat(2)** it refers to the interface on which
             traffic egresses (output interface).

             Set to `-1` to perform netmap on traffic ingressing/egressing on
             any interface, only constrained by the configuration in
             `cfgFwNatOneToOneSourceNet` and `cfgFwNatOneToOneDestinationNet`.

             Groups of interfaces can be matched by adding the character `+` at
             the end. E.g. `eth+` to match the interfaces eth0, eth1.

             **Examples:**

             * -1
             * br0.vlan0
             * br0.vlan+
             * wlan0
             * eth0"
        ::= { cfgFwNatOneToOneTableEntry 4 }

    cfgFwNatOneToOneSourceNet OBJECT-TYPE
        SYNTAX DisplayString (SIZE(9..18))
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Source Network

             This is a source network in CIDR notation.

             When `cfgFwNatOneToOneType` is set to **auto(0)** or **dnat(1)**,
             frames matched by this field are processed by this rule.

             Set to `0.0.0.0/0` to match all inbound traffic.

             When `cfgFwNatOneToOneType` is set to **snat(2)** the network
             specified here will be rewritten to the network specified in
             `cfgFwNatOneToOneRewriteNet`."
        ::= { cfgFwNatOneToOneTableEntry 5 }

    cfgFwNatOneToOneDestinationNet OBJECT-TYPE
        SYNTAX DisplayString (SIZE(9..18))
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Destination Network

             This is a destination network in CIDR notation.

             When `cfgFwNatOneToOneType` is set to **auto(0)** or **dnat(1)**,
             the network specified here will be rewritten to the network
             specified in `cfgFwNatOneToOneRewriteNet`.

             When `cfgFwNatOneToOneType` is set to **snat(2)**, only frames
             matched by this field are processed by this rule.

             Set to `0.0.0.0/0` to match all outbound traffic."
        ::= { cfgFwNatOneToOneTableEntry 6 }

    cfgFwNatOneToOneRewriteNet OBJECT-TYPE
        SYNTAX DisplayString (SIZE(9..18))
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Rewrite Network

             This is the network in CIDR notation to/from which frames are
             rewritten.

             Depending on the setting of `cfgFwNatOneToOneType`:

             * **auto(0)**: For inbound traffic `cfgFwNatOneToOneRewriteNet` is
                            the network to which the destination is rewritten to
                            `cfgFwNatOneToOneDestinationNet`.
                            For outbound traffic `cfgFwNatOneToOneRewriteNet` is
                            the network which matches the source that is
                            rewritten to `cfgFwNatOneToOneRewriteNet`.
             * **dnat(1)**: `cfgFwNatOneToOneRewriteNet` is the network to which
                            the dest. net (`cfgFwNatOneToOneDestinationNet`) is
                            rewritten to.
             * **snat(2)**: `cfgFwNatOneToOneRewriteNet` is the network to which
                            the source net (`cfgFwNatOneToOneSourceNet`) is
                            rewritten to."
        ::= { cfgFwNatOneToOneTableEntry 7 }

    cfgFwNatOneToOneComment OBJECT-TYPE
        SYNTAX DisplayString (SIZE(0..255))
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "User Comment

             This parameter has no operational function.
             It allows to store a comment about the use of this netmap rule."
        ::= { cfgFwNatOneToOneTableEntry 8 }

-- =============================================================================

    cfgFwL2IpFilter  OBJECT IDENTIFIER ::= { configuration 3 }

    cfgFwL2IpFilterEnabled OBJECT-TYPE
        SYNTAX INTEGER { disabled(0), enabled(1) }
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Globally Disable or Enabled the L2 Filter

             When enabled, filter rules will be installed on all bridges."
        ::= { cfgFwL2IpFilter 1 }

    cfgFwL2IpFilterDefaultAction OBJECT-TYPE
        SYNTAX INTEGER { accept(0), drop(1) }
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Global Default Action

             The default action that is performed on a filtering bridge.
             Two bridges can not have a different default action.

             Take care to not lock yourself out when the default action is set
             to  **drop(1)**'."
        ::= { cfgFwL2IpFilter 2 }

    cfgFwL2IpFilterTable OBJECT-TYPE
        SYNTAX  SEQUENCE OF CfgFwL2IpFilterTableSeq
        MAX-ACCESS not-accessible
        STATUS     current
        DESCRIPTION
            "L2 Filter

             The L2 filter allows to create filter rules on a bridge.
             Such a filter may be useful to prohibit traffic between clients of
             different APs."
        ::= { cfgFwL2IpFilter 3 }

    cfgFwL2IpFilterTableEntry OBJECT-TYPE
        SYNTAX  CfgFwL2IpFilterTableSeq
        MAX-ACCESS not-accessible
        STATUS     current
        DESCRIPTION
            "L2 Filter Entry"
        INDEX {cfgFwL2IpFltrIndex}
        ::= { cfgFwL2IpFilterTable 1 }

    CfgFwL2IpFilterTableSeq ::=
        SEQUENCE {  cfgFwL2IpFltrIndex Integer32,
                    cfgFwL2IpFltrEnabled INTEGER,
                    cfgFwL2IpFltrBridge Integer32,
                    cfgFwL2IpFltrAction INTEGER,
                    cfgFwL2IpFltrPriority Integer32,
                    cfgFwL2IpFltrSource DisplayString,
                    cfgFwL2IpFltrDestination DisplayString,
                    cfgFwL2IpFltrComment DisplayString,
                    cfgFwL2IpFltrProtocol Integer32,
                    cfgFwL2IpFltrSourcePort Integer32,
                    cfgFwL2IpFltrDestinationPort Integer32,
                    cfgFwL2IpFltrSourceMac DisplayString,
                    cfgFwL2IpFltrDestinationMac DisplayString,
                    cfgFwL2IpFltrEthertype DisplayString,
                    cfgFwL2IpFltrVlan DisplayString,
                    cfgFwL2IpFltrInputInterface DisplayString
                 }

    cfgFwL2IpFltrIndex OBJECT-TYPE
        SYNTAX Integer32 (0..255)
        MAX-ACCESS not-accessible
        STATUS     current
        DESCRIPTION
            "Table Entry Index"
        ::= { cfgFwL2IpFilterTableEntry 1 }

    cfgFwL2IpFltrEnabled OBJECT-TYPE
        SYNTAX INTEGER { disabled(0), enabled(1) }
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Disabled or Enabled this Rule

             Only enabled rules are installed on filtering bridges."
        ::= { cfgFwL2IpFilterTableEntry 2 }

    cfgFwL2IpFltrBridge OBJECT-TYPE
        SYNTAX Integer32 (-1..255)
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Bridge on Which the Rule is Created

             This rule is only created on the bridge selected here.

             Take care when setting `cfgFwL2IpFilterDefaultAction` to
             **drop(1)** that you have a rule on your management bridge allowing
             access to the management interface."
        ::= { cfgFwL2IpFilterTableEntry 3 }

    cfgFwL2IpFltrAction OBJECT-TYPE
        SYNTAX INTEGER { accept(0), drop(1) }
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Action to Perform

             * **accept(0)**: let the frame continue to be processed
             * **drop(1)**: drop the frame immediatelly"
        ::= { cfgFwL2IpFilterTableEntry 4 }

    cfgFwL2IpFltrPriority OBJECT-TYPE
        SYNTAX Integer32 (1..65535)
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Filter Priority

             When multiple rules match, the rule with the highest priority is
             applied.

             Multiple overlapping rules with the same priority have undefined
             behaviour, thus are not allowed."
        ::= { cfgFwL2IpFilterTableEntry 5 }

    cfgFwL2IpFltrSource OBJECT-TYPE
        SYNTAX DisplayString (SIZE(7..18))
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Source Network/IP On Which The Rule Matches (CIDR Notation)

             When `cfgFwL2IpFilterMode` is set to **full(1)**, then this field
             only has an effect when `cfgFwL2IpFltrEthertype` is set to `0800`,
             `0806` or `8035`.

             When `cfgFwL2IpFltrEthertype` is set to `0800` this is an IP or
             network.

             When `cfgFwL2IpFltrEthertype` is set to `0806` or `8035` it is the
             source address or a range of source addresses of an ARP/RARP
             frame (ARP_SPA)."
        ::= { cfgFwL2IpFilterTableEntry 6 }

    cfgFwL2IpFltrDestination OBJECT-TYPE
        SYNTAX DisplayString (SIZE(7..18))
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Destination Network/IP On Which The Rule Matches (CIDR Notation)

             When `cfgFwL2IpFilterMode` is set to **full(1)**, then this field
             only has an effect when `cfgFwL2IpFltrEthertype` is set to `0800`,
             `0806` or `8035`.

             When `cfgFwL2IpFltrEthertype` is set to `0800` this is an IP or
             network.

             When `cfgFwL2IpFltrEthertype` is set to `0806` or `8035` it is the
             target address or a range of target addresses of an ARP/RARP
             frame (ARP_TPA)."
        ::= { cfgFwL2IpFilterTableEntry 7 }

    cfgFwL2IpFltrComment OBJECT-TYPE
        SYNTAX DisplayString (SIZE(0..255))
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "User Comment

             This parameter has no operational function.
             It allows to store a comment about the use of this l2 filter rule."
        ::= { cfgFwL2IpFilterTableEntry 8 }

    cfgFwL2IpFltrProtocol OBJECT-TYPE
        SYNTAX Integer32 (-1..255)
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "IP Protocol On Which The Rule Matches

             Set to `-1`, to not use the protocol to match.

             When `cfgFwL2IpFltrEthertype` is set to `0800`, this field may
             be used to match a specific IP protocol.

             **Examples:**

             * **-1**: any protocol
             * **1**: ICMP
             * **2**: IGMP
             * **6**: TCP
             * **17**: UDP
             * **50**: ESP (IPsec)
             * **51**: AH (IPsec)
             * **112**: VRRP / CARP

             For a full list of available protocols see
             https://en.wikipedia.org/wiki/List_of_IP_protocol_numbers

             When `cfgFwL2IpFltrEthertype` is set to `0806` or `8035`, this
             field may be used to match the OP code of an ARP frame.

             **Examples:**

             * **-1**: any OP code
             * **1**: request
             * **2**: response
             * **3**: request reverse
             * **4**: response reverse"
        ::= { cfgFwL2IpFilterTableEntry 9 }

    cfgFwL2IpFltrSourcePort OBJECT-TYPE
        SYNTAX Integer32 (-1..65535)
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "The Source Port On Which The Rule Matches

             Set to `-1`, to not use the source port to match.

             When `cfgFwL2IpFltrEthertype` is set to `0800` and
             `cfgFwL2IpFltrProtocol` is `6` (TCP) or `17` (UDP), this field
             may be used to match a specific source port."
        ::= { cfgFwL2IpFilterTableEntry 10 }

    cfgFwL2IpFltrDestinationPort OBJECT-TYPE
        SYNTAX Integer32 (-1..65535)
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "The Destination Port On Which The Rule Matches

             Set to `-1`, to not use the destination port to match.

             When `cfgFwL2IpFltrEthertype` is set to `0800` and
             `cfgFwL2IpFltrProtocol` is `6` (TCP) or `17` (UDP), this field
             may be used to match a specific source port."
        ::= { cfgFwL2IpFilterTableEntry 11 }

    cfgFwL2IpFltrSourceMac OBJECT-TYPE
        SYNTAX DisplayString (SIZE(35))
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "The Source MAC Addresses On Which The Rule Matches

             This is a MAC address and a mask in the form of
             `xx:xx:xx:xx:xx:xx/yy:yy:yy:yy:yy:yy`.

             **Examples:**

             * `00:00:00:00:00:00/00:00:00:00:00:00` match any source
             * `00:14:5a:02:04:4c/ff:ff:ff:ff:ff:ff` exact match of the source
               address 00:14:5a:02:04:4c
             * `00:14:5a:00:00:00/ff:ff:ff:00:00:00` match any source addresses
               with the vendor OUI `00:14:5a`"
        ::= { cfgFwL2IpFilterTableEntry 12 }

    cfgFwL2IpFltrDestinationMac OBJECT-TYPE
        SYNTAX DisplayString (SIZE(35))
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "The Destination MAC Addresses On Which The Rule Matches

             This is a MAC address and a mask in the form of
             `xx:xx:xx:xx:xx:xx/yy:yy:yy:yy:yy:yy`.

             **Examples:**

             * `00:00:00:00:00:00/00:00:00:00:00:00` match any destination
             * `01:00:00:00:00:00/01:00:00:00:00:00` match all frames with
               a multicast destination (including broadcast)
             * `00:14:5a:02:04:4c/ff:ff:ff:ff:ff:ff` exact match of the
               destination address 00:14:5a:02:04:4c
             * `00:14:5a:00:00:00/ff:ff:ff:00:00:00` match any destination
               addresses with the vendor OUI `00:14:5a`"
        ::= { cfgFwL2IpFilterTableEntry 13 }

    cfgFwL2IpFltrEthertype OBJECT-TYPE
        SYNTAX DisplayString (SIZE(4))
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "The Ethertype On Which The Rule Matches

             This is an ethertype in the form of `XXXX` where each X is a
             hexadecimal character [0-9A-Fa-f].

             Default is `0800`, which represents IPv4.

             Set to `0000`, to match any ethertype.

             **Examples:**

             * 0000: any
             * 0800: IPv4
             * 0806: ARP
             * 8035: RARP
             * 86DD: IPv6
             * 8847: MPLS unicast
             * 8848: MPLS multicast
             * 8892: Profinet

             For a full list of IANA assigned ethertypes see
             https://www.iana.org/assignments/ieee-802-numbers/ieee-802-numbers.xhtml"
        ::= { cfgFwL2IpFilterTableEntry 14 }

    cfgFwL2IpFltrVlan OBJECT-TYPE
        SYNTAX DisplayString (SIZE(1..13))
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "The VLAN On Which The Rule Matches

             Set to `-1`, to not use the VLAN to match.

             This field has two modes of operation:

             * When set to a decimal number between 0 and 4094, this matches
               on the VLAN number in the 802.1Q header when present.
               Can only be used to match tagged frames.
             * When set in the format `0x0000/0x0000` matches the raw vlan_tci.
               ```
               +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
               |15|14|13|12|11|10| 9| 8| 7| 6| 5| 4| 3| 2| 1| 0|
               +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
               |  PCP   |P |               VID                 |
               +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
               ```
               Bits 0-11 (VID) are the vlan number.
               Bit 12 (P) represents the existence of a vlan header.
               Bits 13-15 (PCP) are the vlan priority.
               The first part before the / is the value to match on.
               The second part after the / is the mask applied on the value.
               This can be used to match tagged or untagged frames, ranges of
               vlans or the priority.

             **Examples:**

             * `-1`: Disable matching on VLAN
             * `200`: Match on VLAN 200
             * `0x0000/0x1000`: Match frames with no 802.1Q header
             * `0x1000/0x1000`: Match any frame with a 802.1Q header
             * `0x5000/0xf000`: Match frames with priority 2 in any VLAN
             * `0x0000/0x0fff`: Match frames with no 802.1Q header or tagged
                                with VLAN 0 and any priority
             * `0x0000/0xefff`: Match frames with no 802.1Q header or tagged
                                with VLAN 0 and priority 0

             **NOTE:** Frames that ingress on an access ports are not considered
                       part of the assigned vlan yet. Local VLAN interfaces are
                       access ports, e.g. br0.vlan7."
        ::= { cfgFwL2IpFilterTableEntry 15 }

    cfgFwL2IpFltrInputInterface OBJECT-TYPE
        SYNTAX DisplayString (SIZE(1..15))
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "The Ingress Interface On Which The Rule Matches

             The name of the interface on which a frame ingresses.

             Set to `any`, to match any interface.

             **Examples:**

             * **any**
             * **wlan0**
             * **eth0**"
        ::= { cfgFwL2IpFilterTableEntry 16 }

    cfgFwL2IpFilterMode OBJECT-TYPE
        SYNTAX INTEGER { ip(0), full(1) }
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Filter Mode

             The filtering bridge provides two modes of operation:

             * **ip(0)**: A simplified mode to filter IP traffic. All non-IP
                          traffic is allowed.
             * **full(1)**: The full mode allows to filter on any kind of header
                            information present."
        ::= { cfgFwL2IpFilter 4 }

-- =============================================================================

    cfgFwFilter         OBJECT IDENTIFIER ::= { configuration 4 }

    cfgFwFltDefaultPolicyInput OBJECT-TYPE
        SYNTAX INTEGER { drop(0), accept(1) }
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "The Default Filter Policy on the Input Path"
        ::= { cfgFwFilter 1 }

    cfgFwFltDefaultPolicyForward OBJECT-TYPE
        SYNTAX INTEGER { drop(0), accept(1) }
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "The Default Filter Policy on the Forward Path"
        ::= { cfgFwFilter 2 }

    cfgFwFltDefaultPolicyOutput OBJECT-TYPE
        SYNTAX INTEGER { drop(0), accept(1) }
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "The Default Filter Policy on the Output Path"
        ::= { cfgFwFilter 3 }

    cfgFwFltLogDefaultDrop OBJECT-TYPE
        SYNTAX INTEGER { disabled(0), enabled(1) }
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Disable or Enable Logging of the Default Drop Policy

             When this option is set to **enabled(1)**, all frames that are
             dropped by the default policy on a chain are logged."
        ::= { cfgFwFilter 4 }

    cfgFwFltLogDefaultAccept OBJECT-TYPE
        SYNTAX INTEGER { disabled(0), enabled(1) }
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Disable or Enable Logging of the Default Accept Policy

             When this option is set to **enabled(1)**, all frames that are
             accepted by the default policy on a chain are logged."
        ::= { cfgFwFilter 5 }

    cfgFwFltInputSynLimit OBJECT-TYPE
        SYNTAX DisplayString (SIZE(1..13))
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Input Syn Frame Limit

             This parameter is active when `cfgFwFltInputSynLimitBurst` has a
             value greater than 0.

             This is the rate at which ACCEPT-tokens are added to the bucket for
             the TCP SYN flood protection on the INPUT chain.

             In the form of rate[/second|/minute|/hour|/day]

             The maximum rate is 10'000/second, respective 600'000/minute,
             36'000'000/hour and 864'000'000/day.

             **Examples:**

             * 1/second
             * 5/minute
             * 100/hour
             * 10000/day"
        ::= { cfgFwFilter 6 }

    cfgFwFltInputSynLimitBurst OBJECT-TYPE
        SYNTAX Integer32 (0..10000)
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Input Syn Frame Limit Burst

             This is the size of the bucket containing ACCEPT-tokens, for the
             TCP syn flood protection on the INPUT chain.
             Each new TCP SYN frame consumes 1 token. When the bucket has zero
             tokens, new TCP SYN frames are dropped.

             New tokens are added to the bucket at the rate specified in
             `cfgFwFltInputSynLimit`.

             Set to `0` to disable the INPUT TCP SYN rate limiter.

             This value is also the amount of tokens in the bucket at start."
        ::= { cfgFwFilter 7 }

-- -----------------------------------------------------------------------------

    cfgFwFilterRulesTable OBJECT-TYPE
        SYNTAX SEQUENCE OF CfgFwFilterRulesTableSeq
        MAX-ACCESS not-accessible
        STATUS     current
        DESCRIPTION
            "Firewall Filter Rules Table"
        ::= { cfgFwFilter 10 }

    cfgFwFilterRulesTableEntry OBJECT-TYPE
        SYNTAX  CfgFwFilterRulesTableSeq
        MAX-ACCESS not-accessible
        STATUS     current
        DESCRIPTION
            "Firewall Filter Rules Table"
        INDEX {cfgFwFltRIndex}
        ::= { cfgFwFilterRulesTable 1 }

    CfgFwFilterRulesTableSeq ::=
        SEQUENCE {  cfgFwFltRIndex Integer32,
                    cfgFwFltREnabled INTEGER,
                    cfgFwFltRChain INTEGER,
                    cfgFwFltRAction INTEGER,
                    cfgFwFltRInputInterface DisplayString,
                    cfgFwFltROutputInterface DisplayString,
                    cfgFwFltRProtocol Integer32,
                    cfgFwFltRSourceAddress DisplayString,
                    cfgFwFltRSourcePortStart DisplayString,
                    cfgFwFltRSourcePortEnd Integer32,
                    cfgFwFltRDestinationAddress DisplayString,
                    cfgFwFltRDestinationPortStart DisplayString,
                    cfgFwFltRDestinationPortEnd Integer32,
                    cfgFwFltRComment DisplayString,
                    cfgFwFltRIcmpType Integer32,
                    cfgFwFltRIcmpCode Integer32,
                    cfgFwFltRLog INTEGER,
                    cfgFwFltRLimit DisplayString,
                    cfgFwFltRLimitBurst Integer32
                 }

    cfgFwFltRIndex OBJECT-TYPE
        SYNTAX Integer32 (0..255)
        MAX-ACCESS not-accessible
        STATUS     current
        DESCRIPTION
            "Table Entry Index"
        ::= { cfgFwFilterRulesTableEntry 1 }

    cfgFwFltREnabled OBJECT-TYPE
        SYNTAX INTEGER { disabled(0), enabled(1) }
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Disable or Enable This Rule"
        ::= { cfgFwFilterRulesTableEntry 2 }

    cfgFwFltRChain OBJECT-TYPE
        SYNTAX INTEGER { none(0), input(1), forward(2), output(3) }
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Chain on Which Action is Performed"
        ::= { cfgFwFilterRulesTableEntry 3 }

    cfgFwFltRAction OBJECT-TYPE
        SYNTAX INTEGER { drop(0), accept(1) }
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Action to be Performed

             * **drop(0):** New frames that match this rule are dropped
             * **accept(1):** New frames that match this rule are accepted"
        ::= { cfgFwFilterRulesTableEntry 4 }

    cfgFwFltRInputInterface OBJECT-TYPE
        SYNTAX DisplayString (SIZE(1..16))
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Name of the Input Interface to Match

             This parameter may be used when `cfgFwFltRChain` is set to
             **input(1)** or **forward(2)**.

             Groups of interfaces can be matched by adding the character '+' at
             the end. E.g. eth+ to match the interfaces eth0, eth1 and eth2.

             Set to `-1` to not use this parameter."
        ::= { cfgFwFilterRulesTableEntry 5 }

    cfgFwFltROutputInterface OBJECT-TYPE
        SYNTAX DisplayString (SIZE(1..16))
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Name of the Output Interface to Match

             This parameter may be used when `cfgFwFltRChain` is set to
             **forward(2)** or **output(3)**.

             Groups of interfaces can be matched by adding the character '+' at
             the end. E.g. eth+ to match the interfaces eth0, eth1 and eth2.

             Set to `-1` to not use this parameter."
        ::= { cfgFwFilterRulesTableEntry 6 }

    cfgFwFltRProtocol OBJECT-TYPE
        SYNTAX Integer32 (-1..255)
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Choose Which IP Protocol the Rule Matches

             For a list of the currently existing protocols see:
             https://en.wikipedia.org/wiki/List_of_IP_protocol_numbers

             **Examples:**

             * **any(-1)**: Match any ip protocol
             * **icmp(1)**
             * **igmp(2)**
             * **tcp(6)**
             * **udp(17)**
             * **gre(47)**
             * **esp(50)**
             * **ah(51)**
             * **ospf(89)**
             * **vrrp / carp(112)**
             * **l2tp(115)**"
        ::= { cfgFwFilterRulesTableEntry 7 }

    cfgFwFltRSourceAddress OBJECT-TYPE
        SYNTAX DisplayString (SIZE(1..20))
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Source Address to Match

             This can be a specific ip address or a range in CIDR notation.
             Set to 0.0.0.0/0 to match all sources.
             Set to 172.17.29.7/32 to match the specific IP 172.17.29.7.
             You can use ! to invert the sense of the rule,
             e.g. `!192.168.0.0/24`."
        ::= { cfgFwFilterRulesTableEntry 8 }

    cfgFwFltRSourcePortStart OBJECT-TYPE
        SYNTAX DisplayString (SIZE(1..20))
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Source Start Port to Match

             Specify the port or start of a port range from which a connection
             originates.
             Can only be used with tcp or udp.
             You can use ! to invert the sense of the rule: E.g. !80.
             When used in a range, the inversion applies to the range.

             Set to -1 to not use this parameter."
        ::= { cfgFwFilterRulesTableEntry 9 }

    cfgFwFltRSourcePortEnd OBJECT-TYPE
        SYNTAX Integer32 (-1..65535)
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Source End Port to Match

             When matching multiple ports, this value is the end of the range.
             Can only be used with tcp or udp.

             Set to -1 when no range is to be matched."
        ::= { cfgFwFilterRulesTableEntry 10 }

    cfgFwFltRDestinationAddress OBJECT-TYPE
        SYNTAX DisplayString (SIZE(1..20))
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Destination Address to Match

             This can be a specific ip address or a range in CIDR notation.
             Set to 0.0.0.0/0 to match all destinations.
             Set to 172.17.29.7/32 to match the specific IP 172.17.29.7.
             You can use ! to invert the sense of the rule,
             e.g. `!192.168.0.0/24`."
        ::= { cfgFwFilterRulesTableEntry 11 }

    cfgFwFltRDestinationPortStart OBJECT-TYPE
        SYNTAX DisplayString (SIZE(1..20))
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Destination Start Port to Match

             Specify the port or start of a port range to which a connection is
             going.
             Can only be used with tcp or udp.
             You can use ! to invert the sense of the rule: E.g. !80.
             When used in a range, the inversion applies to the range.

             Set to -1 to not use this parameter."
        ::= { cfgFwFilterRulesTableEntry 12 }

    cfgFwFltRDestinationPortEnd OBJECT-TYPE
        SYNTAX Integer32 (-1..65535)
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Destination End Port to Match

             When matching multiple ports, this value is the end of the range.
             Can only be used with tcp or udp.

             Set to -1 when no range is to be matched."
        ::= { cfgFwFilterRulesTableEntry 13 }

    cfgFwFltRComment OBJECT-TYPE
        SYNTAX DisplayString (SIZE(0..255))
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "User Comment

             This parameter has no operational function.
             It allows to store a comment about the use of this filter rule."
        ::= { cfgFwFilterRulesTableEntry 14 }

    cfgFwFltRIcmpType OBJECT-TYPE
        SYNTAX Integer32 (-1..255)
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "ICMP Type

             When `cfgFwFltRProtocol` is set to **icmp(1)** this parameter may
             be used to filter specific ICMP types.

             Set to `-1` to match any type.

             For a list of types officially assigned by IANA see:
             https://www.iana.org/assignments/icmp-parameters/icmp-parameters.xhtml

             **Examples:**

             * **any(-1)**
             * **echo reply(0)**
             * **destination unreachable(3)**
             * **redirect(5)**
             * **echo(8)**
             * **ttl exceeded(11)**

             When blocking type 3, be aware that this breaks PMTUD (Path MTU
             Discovery)."
        ::= { cfgFwFilterRulesTableEntry 15 }

    cfgFwFltRIcmpCode OBJECT-TYPE
        SYNTAX Integer32 (-1..255)
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "ICMP Code

             When `cfgFwFltRProtocol` is set to **icmp(1)** this parameter may
             be used to filter specific ICMP codes.

             Depending on `cfgFwFltRIcmpType` different types have different
             codes. This parameter has no function when `cfgFwFltRIcmpType` is
             set to **any(-1)**.

             Set to `-1` to match any code.

             For a list of codes of each type officially assigned by IANA see:
             https://www.iana.org/assignments/icmp-parameters/icmp-parameters.xhtml

             **Examples:**

             * **any(-1)**
             * **Protocol Unreachable(2)** of type destination unreachable(3)
             * **Redirect Datagram for the Host(1)** of type redirect(5)"
        ::= { cfgFwFilterRulesTableEntry 16 }

    cfgFwFltRLog OBJECT-TYPE
        SYNTAX INTEGER { disabled(0), enabled(1) }
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Enable Logging For This Rule

             Configures whether frames handled by this rule are logged."
        ::= { cfgFwFilterRulesTableEntry 17 }

    cfgFwFltRLimit OBJECT-TYPE
        SYNTAX DisplayString (SIZE(1..13))
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Rule Frame Limit

             This parameter is active when `cfgFwFltRAction` is set to
             **accept(1)** and `cfgFwFltRLimitBurst` has a value greater than 0.

             This is the rate at which ACCEPT-tokens are added to the bucket for
             this rules.

             In the form of rate[/second|/minute|/hour|/day]

             The maximum rate is 10'000/second, respective 600'000/minute,
             36'000'000/hour and 864'000'000/day.

             **Examples:**

             * 1/second
             * 5/minute
             * 100/hour
             * 10000/day"
        ::= { cfgFwFilterRulesTableEntry 18 }

    cfgFwFltRLimitBurst OBJECT-TYPE
        SYNTAX Integer32 (0..10000)
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Rule Frame Limit Burst

             This parameter is active when `cfgFwFltRAction` is set to
             **accept(1)**.

             This is the size of the bucket containing ACCEPT-tokens, for this
             rule.
             Each new frame consumes 1 token. When the bucket has zero tokens,
             new frames are dropped.

             New tokens are added to the bucket at the rate specified in
             `cfgFwFltRLimit`.

             Set to `0` to disable the rate limiter.

             This value is also the amount of tokens in the bucket at start."
        ::= { cfgFwFilterRulesTableEntry 19 }

-- -----------------------------------------------------------------------------

    cfgFwMangle         OBJECT IDENTIFIER ::= { configuration 5 }

    cfgFwMangleTable OBJECT-TYPE
        SYNTAX SEQUENCE OF CfgFwMangleTableSeq
        MAX-ACCESS not-accessible
        STATUS     current
        DESCRIPTION
            "Firewall Mangle Table

             Iptables mangle rules allow to modify frames that are received,
             transmitted or forwarded."
        ::= { cfgFwMangle 1 }

    cfgFwMangleTableEntry OBJECT-TYPE
        SYNTAX  CfgFwMangleTableSeq
        MAX-ACCESS not-accessible
        STATUS     current
        DESCRIPTION
            "Firewall Mangle Table"
        INDEX {cfgFwMnglIndex}
        ::= { cfgFwMangleTable 1 }

    CfgFwMangleTableSeq ::=
        SEQUENCE {  cfgFwMnglIndex Integer32,
                    cfgFwMnglEnabled INTEGER,
                    cfgFwMnglChain INTEGER,
                    cfgFwMnglAction INTEGER,
                    cfgFwMnglValue DisplayString,
                    cfgFwMnglInputInterface DisplayString,
                    cfgFwMnglOutputInterface DisplayString,
                    cfgFwMnglSourceAddress DisplayString,
                    cfgFwMnglDestinationAddress DisplayString,
                    cfgFwMnglComment DisplayString,
                    cfgFwMnglProtocol Integer32,
                    cfgFwMnglSourcePortStart DisplayString,
                    cfgFwMnglSourcePortEnd Integer32,
                    cfgFwMnglDestinationPortStart DisplayString,
                    cfgFwMnglDestinationPortEnd Integer32,
                    cfgFwMnglDscp DisplayString
                 }

    cfgFwMnglIndex OBJECT-TYPE
        SYNTAX Integer32 (0..255)
        MAX-ACCESS not-accessible
        STATUS     current
        DESCRIPTION
            "Table Entry Index"
        ::= { cfgFwMangleTableEntry 1 }

    cfgFwMnglEnabled OBJECT-TYPE
        SYNTAX INTEGER { disabled(0), enabled(1) }
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Disable or Enable This Rule"
        ::= { cfgFwMangleTableEntry 2 }

    cfgFwMnglChain OBJECT-TYPE
        SYNTAX INTEGER { input(1), forward(2), output(3), prerouting(4), postrouting(5) }
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Chain on Which Mangle Action is Performed

             Depending on the selected chain, `cfgFwMnglInputInterface` and/or
             `cfgFwMnglOutputInterface` may become active."
        ::= { cfgFwMangleTableEntry 3 }

    cfgFwMnglAction OBJECT-TYPE
        SYNTAX INTEGER { none(0), setmss(1), ttlset(2), setdscp(3), setmark(4), clampMssToPmtu(5) }
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Action to be Performed

             * **none(0)**: No action is performed.
             * **setmss(1)**: Sets the MSS to the value in `cfgFwMnglValue`.
             * **ttlset(2)**: Sets the TTL to the value in `cfgFwMnglValue`.
             * **setdscp(3)**: Sets the DSCP field in the IP header to the value in `cfgFwMnglValue`.
             * **setmark(4)**: Sets the mark of the frame to the value in `cfgFwMnglValue`.
             * **clampMssToPmtu(5)**: Clamps the MSS to the detected value of the PMTU."
        ::= { cfgFwMangleTableEntry 4 }

    cfgFwMnglValue OBJECT-TYPE
        SYNTAX DisplayString (SIZE(1..10))
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Value to be Set

             Depending on the mode of `cfgFwMnglAction` this value has a
             different meaning.

             * **setmss(1)**: Set the MSS of TCP SYN frames to the specified
                              value. This value should not be greater then the
                              value of the MTU - 40. The value has a range of 28
                              to 8960.
             * **ttlset(2)**: Set the TTL of frames to the specified value.
                              The value has a range of 0 to 255. When a value
                              of 0 is set, this frame can not be routed.
             * **setdscp(3)**: Set the DSCP of frames to the specified value.
                               The DSCP in hexadecimal form 00-FF without 0x.
                               Must be a multiple of 4 (the lowest 2 bits 0).
             * **setmark(4)**: Set the mark of frames to the specified value.
                               The value has a range of 0 to 4294967295."

        ::= { cfgFwMangleTableEntry 5 }

    cfgFwMnglInputInterface OBJECT-TYPE
        SYNTAX DisplayString (SIZE(1..16))
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Name of the Input Interface to Match

             This parameter may be used when `cfgFwMnglChain` is set to
             **input(1)**, **forward(2)** and **prerouting(4)**.

             Groups of interfaces can be matched by adding the character '+' at
             the end. E.g. `eth+` to match the interfaces eth0, eth1 and eth2.

             Set to `-1` to not use this parameter."
        ::= { cfgFwMangleTableEntry 6 }

    cfgFwMnglOutputInterface OBJECT-TYPE
        SYNTAX DisplayString (SIZE(1..16))
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Name of the Output Interface to Match

             This parameter may be used when `cfgFwMnglChain` is set to
             **forward(2)**, **output(3)** and **postrouting(5)**.

             Groups of interfaces can be matched by adding the character '+' at
             the end. E.g. `eth+` to match the interfaces eth0, eth1 and eth2.

             Set to `-1` to not use this parameter."
        ::= { cfgFwMangleTableEntry 7 }

    cfgFwMnglSourceAddress OBJECT-TYPE
        SYNTAX DisplayString (SIZE(1..20))
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Source Address to Match

             This can be a specific ip address or a range in CIDR notation.
             Set to `0.0.0.0/0` to match all sources.
             Set to `172.17.29.7/32` to match the specific IP 172.17.29.7.
             You may use ! to invert the sense of the rule,
             e.g. `!192.168.0.0/24`."
        ::= { cfgFwMangleTableEntry 8 }

    cfgFwMnglDestinationAddress OBJECT-TYPE
        SYNTAX DisplayString (SIZE(1..20))
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Destination Address to Match

             This can be a specific ip address or a range in CIDR notation.
             Set to `0.0.0.0/0` to match all destinations.
             Set to `172.17.29.7/32` to match the specific IP 172.17.29.7.
             You may use ! to invert the sense of the rule,
             e.g. `!192.168.0.0/24`."
        ::= { cfgFwMangleTableEntry 9 }

    cfgFwMnglComment OBJECT-TYPE
        SYNTAX DisplayString (SIZE(0..255))
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "User Comment

             This parameter has no operational function.
             It allows to store a comment about the use of this mangle rule."
        ::= { cfgFwMangleTableEntry 10 }

    cfgFwMnglProtocol OBJECT-TYPE
        SYNTAX Integer32 (-1..255)
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Choose Which IP Protocol the Rule Matches

             For a list of the currently existing protocols see:
             https://en.wikipedia.org/wiki/List_of_IP_protocol_numbers

             **Examples:**

             * **any(-1)**: Match any ip protocol
             * **icmp(1)**
             * **igmp(2)**
             * **tcp(6)**
             * **udp(17)**
             * **gre(47)**
             * **esp(50)**
             * **ah(51)**
             * **ospf(89)**
             * **vrrp / carp(112)**
             * **l2tp(115)**"
        ::= { cfgFwMangleTableEntry 11 }

    cfgFwMnglSourcePortStart OBJECT-TYPE
        SYNTAX DisplayString (SIZE(1..20))
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Source Start Port to Match

             Specify the port or start of a port range from which a connection
             originates.
             Can only be used with tcp or udp.
             You can use ! to invert the sense of the rule: E.g. !80.
             When used in a range, the inversion applies to the range.

             Set to `-1` to not use this parameter."
        ::= { cfgFwMangleTableEntry 12 }

    cfgFwMnglSourcePortEnd OBJECT-TYPE
        SYNTAX Integer32 (-1..65535)
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Source End Port to Match

             When matching multiple ports, this value is the end of the range.
             Can only be used with tcp or udp.

             Set to `-1` when no range is to be matched."
        ::= { cfgFwMangleTableEntry 13 }

    cfgFwMnglDestinationPortStart OBJECT-TYPE
        SYNTAX DisplayString (SIZE(1..20))
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Destination Start Port to Match

             Specify the port or start of a port range to which a connection is
             going.
             Can only be used with tcp or udp.
             You can use ! to invert the sense of the rule: E.g. !80.
             When used in a range, the inversion applies to the range.

             Set to `-1` to not use this parameter."
        ::= { cfgFwMangleTableEntry 14 }

    cfgFwMnglDestinationPortEnd OBJECT-TYPE
        SYNTAX Integer32 (-1..65535)
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Destination End Port to Match

             When matching multiple ports, this value is the end of the range.
             Can only be used with tcp or udp.

             Set to `-1` when no range is to be matched."
        ::= { cfgFwMangleTableEntry 15 }

    cfgFwMnglDscp OBJECT-TYPE
        SYNTAX DisplayString (SIZE(2..2))
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "DSCP to Match

             The DSCP field in the IP header used to specify a priority of
             a frame.

             The DSCP in hexadecimal form 00-FF without 0x.
             Must be a multiple of 4 (the lowest 2 bits 0).

             Set to `-1` when no DSCP is to be matched."
        ::= { cfgFwMangleTableEntry 16 }

-- -----------------------------------------------------------------------------

    cfgFwL2Mangle     OBJECT IDENTIFIER ::= { configuration 6 }

    cfgFwL2MangleEnabled OBJECT-TYPE
        SYNTAX INTEGER { disabled(0), enabled(1) }
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Globally Disable or Enabled L2 Mangling

             When enabled, mangle rules will be installed on all bridges."
        ::= { cfgFwL2Mangle 1 }

    cfgFwL2MangleTable OBJECT-TYPE
        SYNTAX  SEQUENCE OF CfgFwL2MangleTableSeq
        MAX-ACCESS not-accessible
        STATUS     current
        DESCRIPTION
            "L2 Mangle

             The L2 mangling allows to create mangle rules on a bridge.
             Such rules may be used to adjust various header fields of the
             forwarded frames."
        ::= { cfgFwL2Mangle 3 }

    cfgFwL2MangleTableEntry OBJECT-TYPE
        SYNTAX  CfgFwL2MangleTableSeq
        MAX-ACCESS not-accessible
        STATUS     current
        DESCRIPTION
            "L2 Mangle Entry"
        INDEX {cfgFwL2MnglIndex}
        ::= { cfgFwL2MangleTable 1 }

    CfgFwL2MangleTableSeq ::=
        SEQUENCE {  cfgFwL2MnglIndex Integer32,
                    cfgFwL2MnglEnabled INTEGER,
                    cfgFwL2MnglBridge Integer32,
                    cfgFwL2MnglAction INTEGER,
                    cfgFwL2MnglPriority Integer32,
                    cfgFwL2MnglSource DisplayString,
                    cfgFwL2MnglDestination DisplayString,
                    cfgFwL2MnglComment DisplayString,
                    cfgFwL2MnglProtocol Integer32,
                    cfgFwL2MnglSourcePort Integer32,
                    cfgFwL2MnglDestinationPort Integer32,
                    cfgFwL2MnglSourceMac DisplayString,
                    cfgFwL2MnglDestinationMac DisplayString,
                    cfgFwL2MnglEthertype DisplayString,
                    cfgFwL2MnglVlan DisplayString,
                    cfgFwL2MnglInputInterface DisplayString,
                    cfgFwL2MnglValue DisplayString
                 }

    cfgFwL2MnglIndex OBJECT-TYPE
        SYNTAX Integer32 (0..255)
        MAX-ACCESS not-accessible
        STATUS     current
        DESCRIPTION
            "Table Entry Index"
        ::= { cfgFwL2MangleTableEntry 1 }

    cfgFwL2MnglEnabled OBJECT-TYPE
        SYNTAX INTEGER { disabled(0), enabled(1) }
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Disabled or Enabled this Rule

             Only enabled rules are installed on mangling bridges."
        ::= { cfgFwL2MangleTableEntry 2 }

    cfgFwL2MnglBridge OBJECT-TYPE
        SYNTAX Integer32 (0..255)
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Bridge on Which the Rule is Created

             This rule is only created on the bridge specified here."
        ::= { cfgFwL2MangleTableEntry 3 }

    cfgFwL2MnglAction OBJECT-TYPE
        SYNTAX INTEGER { none(0), setdscp(1) }
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Action to Perform

             * **none(0)**: No action, implicitly disabled the rule
             * **setdscp(1)**: Set the 6-bit DSCP field of IP frames"
        ::= { cfgFwL2MangleTableEntry 4 }

    cfgFwL2MnglPriority OBJECT-TYPE
        SYNTAX Integer32 (1..65535)
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Mangle Priority

             When multiple rules match, the rule with the highest priority is
             applied.

             Multiple overlapping rules with the same priority have undefined
             behaviour, thus are not allowed."
        ::= { cfgFwL2MangleTableEntry 5 }

    cfgFwL2MnglSource OBJECT-TYPE
        SYNTAX DisplayString (SIZE(7..18))
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Source Network/IP On Which The Rule Matches (CIDR Notation)

             This field only has an effect when `cfgFwL2MnglEthertype` is set to
             `0800`, `0806` or `8035`.

             When `cfgFwL2MnglEthertype` is set to `0800` this is an IP or
             network.

             When `cfgFwL2MnglEthertype` is set to `0806` or `8035` it is the
             source address or a range of source addresses of an ARP/RARP
             frame (ARP_SPA)."
        ::= { cfgFwL2MangleTableEntry 6 }

    cfgFwL2MnglDestination OBJECT-TYPE
        SYNTAX DisplayString (SIZE(7..18))
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "Destination Network/IP On Which The Rule Matches (CIDR Notation)

             This field only has an effect when `cfgFwL2MnglEthertype` is set to
             `0800`, `0806` or `8035`.

             When `cfgFwL2MnglEthertype` is set to `0800` this is an IP or
             network.

             When `cfgFwL2MnglEthertype` is set to `0806` or `8035` it is the
             target address or a range of target addresses of an ARP/RARP
             frame (ARP_TPA)."
        ::= { cfgFwL2MangleTableEntry 7 }

    cfgFwL2MnglComment OBJECT-TYPE
        SYNTAX DisplayString (SIZE(0..255))
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "User Comment

             This parameter has no operational function.
             It allows to store a comment about the use of this l2 mangle rule."
        ::= { cfgFwL2MangleTableEntry 8 }

    cfgFwL2MnglProtocol OBJECT-TYPE
        SYNTAX Integer32 (-1..255)
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "IP Protocol On Which The Rule Matches

             Set to `-1`, to not use the protocol to match.

             When `cfgFwL2MnglEthertype` is set to `0800`, this field may
             be used to match a specific IP protocol.

             **Examples:**

             * **-1**: any protocol
             * **1**: ICMP
             * **2**: IGMP
             * **6**: TCP
             * **17**: UDP
             * **50**: ESP (IPsec)
             * **51**: AH (IPsec)
             * **112**: VRRP / CARP

             For a full list of available protocols see
             https://en.wikipedia.org/wiki/List_of_IP_protocol_numbers

             When `cfgFwL2MnglEthertype` is set to `0806` or `8035`, this
             field may be used to match the OP code of an ARP frame.

             **Examples:**

             * **-1**: any OP code
             * **1**: request
             * **2**: response
             * **3**: request reverse
             * **4**: response reverse"
        ::= { cfgFwL2MangleTableEntry 9 }

    cfgFwL2MnglSourcePort OBJECT-TYPE
        SYNTAX Integer32 (-1..65535)
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "The Source Port On Which The Rule Matches

             Set to `-1`, to not use the source port to match.

             When `cfgFwL2MnglEthertype` is set to `0800` and
             `cfgFwL2MnglProtocol` is `6` (TCP) or `17` (UDP), this field
             may be used to match a specific source port."
        ::= { cfgFwL2MangleTableEntry 10 }

    cfgFwL2MnglDestinationPort OBJECT-TYPE
        SYNTAX Integer32 (-1..65535)
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "The Destination Port On Which The Rule Matches

             Set to `-1`, to not use the destination port to match.

             When `cfgFwL2MnglEthertype` is set to `0800` and
             `cfgFwL2MnglProtocol` is `6` (TCP) or `17` (UDP), this field
             may be used to match a specific source port."
        ::= { cfgFwL2MangleTableEntry 11 }

    cfgFwL2MnglSourceMac OBJECT-TYPE
        SYNTAX DisplayString (SIZE(35))
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "The Source MAC Addresses On Which The Rule Matches

             This is a MAC address and a mask in the form of
             `xx:xx:xx:xx:xx:xx/yy:yy:yy:yy:yy:yy`.

             **Examples:**

             * `00:00:00:00:00:00/00:00:00:00:00:00` match any source
             * `00:14:5a:02:04:4c/ff:ff:ff:ff:ff:ff` exact match of the source
               address 00:14:5a:02:04:4c
             * `00:14:5a:00:00:00/ff:ff:ff:00:00:00` match any source addresses
               with the vendor OUI `00:14:5a`"
        ::= { cfgFwL2MangleTableEntry 12 }

    cfgFwL2MnglDestinationMac OBJECT-TYPE
        SYNTAX DisplayString (SIZE(35))
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "The Destination MAC Addresses On Which The Rule Matches

             This is a MAC address and a mask in the form of
             `xx:xx:xx:xx:xx:xx/yy:yy:yy:yy:yy:yy`.

             **Examples:**

             * `00:00:00:00:00:00/00:00:00:00:00:00` match any destination
             * `01:00:00:00:00:00/01:00:00:00:00:00` match all frames with
               a multicast destination (including broadcast)
             * `00:14:5a:02:04:4c/ff:ff:ff:ff:ff:ff` exact match of the
               destination address 00:14:5a:02:04:4c
             * `00:14:5a:00:00:00/ff:ff:ff:00:00:00` match any destination
               addresses with the vendor OUI `00:14:5a`"
        ::= { cfgFwL2MangleTableEntry 13 }

    cfgFwL2MnglEthertype OBJECT-TYPE
        SYNTAX DisplayString (SIZE(4))
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "The Ethertype On Which The Rule Matches

             This is an ethertype in the form of `XXXX` where each X is a
             hexadecimal character [0-9A-Fa-f].

             Default is `0800`, which represents IPv4.

             Set to `0000`, to match any ethertype.

             **Examples:**

             * 0000: any
             * 0800: IPv4
             * 0806: ARP
             * 8035: RARP
             * 86DD: IPv6
             * 8847: MPLS unicast
             * 8848: MPLS multicast
             * 8892: Profinet

             For a full list of IANA assigned ethertypes see
             https://www.iana.org/assignments/ieee-802-numbers/ieee-802-numbers.xhtml"
        ::= { cfgFwL2MangleTableEntry 14 }

    cfgFwL2MnglVlan OBJECT-TYPE
        SYNTAX DisplayString (SIZE(1..13))
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "The VLAN On Which The Rule Matches

             Set to `-1`, to not use the VLAN to match.

             This field has two modes of operation:

             * When set to a decimal number between 0 and 4094, this matches
               on the VLAN number in the 802.1Q header when present.
               Can only be used to match tagged frames.
             * When set in the format `0x0000/0x0000` matches the raw vlan_tci.
               ```
               +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
               |15|14|13|12|11|10| 9| 8| 7| 6| 5| 4| 3| 2| 1| 0|
               +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
               |  PCP   |P |               VID                 |
               +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
               ```
               Bits 0-11 (VID) are the vlan number.
               Bit 12 (P) represents the existence of a vlan header.
               Bits 13-15 (PCP) are the vlan priority.
               The first part before the / is the value to match on.
               The second part after the / is the mask applied on the value.
               This can be used to match tagged or untagged frames, ranges of
               vlans or the priority.

             **Examples:**

             * `-1`: Disable matching on VLAN
             * `200`: Match on VLAN 200
             * `0x0000/0x1000`: Match frames with no 802.1Q header
             * `0x1000/0x1000`: Match any frame with a 802.1Q header
             * `0x5000/0xf000`: Match frames with priority 2 in any VLAN
             * `0x0000/0x0fff`: Match frames with no 802.1Q header or tagged
                                with VLAN 0 and any priority
             * `0x0000/0xefff`: Match frames with no 802.1Q header or tagged
                                with VLAN 0 and priority 0

             **NOTE:** Frames that ingress on an access ports are not considered
                       part of the assigned vlan yet. Local VLAN interfaces are
                       access ports, e.g. br0.vlan7."
        ::= { cfgFwL2MangleTableEntry 15 }

    cfgFwL2MnglInputInterface OBJECT-TYPE
        SYNTAX DisplayString (SIZE(1..15))
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "The Ingress Interface On Which The Rule Matches

             The name of the interface on which a frame ingresses.

             Set to `any`, to match any interface.

             **Examples:**

             * **any**
             * **wlan0**
             * **eth0**"
        ::= { cfgFwL2MangleTableEntry 16 }

    cfgFwL2MnglValue OBJECT-TYPE
        SYNTAX DisplayString (SIZE(1..2))
        MAX-ACCESS read-write
        STATUS     current
        DESCRIPTION
            "The Value to be set by the Action

             Depending on the setting of `cfgFwL2MnglAction` the accepted format
             of this field is different.

             * **setdscp(1)**: The DSCP in hexadecimal form 00-FF without 0x.
                               Must be a multiple of 4 (the lowest 2 bits 0)"
        ::= { cfgFwL2MangleTableEntry 17 }


-- * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
-- *  End of   Object Types
-- **********************************************************************

-- **********************************************************************
-- *  Begin GROUPS
-- * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

    groupCfgFirewall OBJECT-GROUP
        OBJECTS {
            cfgFwEnabled
             }
        STATUS current
        DESCRIPTION
            "Firewall Settings"
        ::= { groupConfiguration 1 }

    groupCfgFirewallPortForward OBJECT-GROUP
        OBJECTS {
            cfgFwEnabled,
            cfgFwNatPrtFwdEnabled,
            cfgFwNatPrtFwdInterface,
            cfgFwNatPrtFwdProtocol,
            cfgFwNatPrtFwdSourceAddress,
            cfgFwNatPrtFwdSourcePortStart,
            cfgFwNatPrtFwdSourcePortEnd,
            cfgFwNatPrtFwdDestinationAddress,
            cfgFwNatPrtFwdDestinationPortStart,
            cfgFwNatPrtFwdDestinationPortEnd,
            cfgFwNatPrtFwdRedirectDestinationAddress,
            cfgFwNatPrtFwdRedirectDestinationPort,
            cfgFwNatPrtFwdComment
             }
        STATUS current
        DESCRIPTION
            "Port Forward Settings"
        ::= { groupConfiguration 2 }

    groupCfgFirewallOutboundNat OBJECT-GROUP
        OBJECTS {
            cfgFwNatOutEnabled,
            cfgFwNatOutInterface,
            cfgFwNatOutProtocol,
            cfgFwNatOutSourceAddress,
            cfgFwNatOutSourcePortStart,
            cfgFwNatOutSourcePortEnd,
            cfgFwNatOutDestinationAddress,
            cfgFwNatOutDestinationPortStart,
            cfgFwNatOutDestinationPortEnd,
            cfgFwNatOutSourceRewriteAddress,
            cfgFwNatOutSourceRewritePort,
            cfgFwNatOutComment
             }
        STATUS current
        DESCRIPTION
            "Outbound NAT Settings"
        ::= { groupConfiguration 3 }

    groupCfgFirewallOneToOneNat OBJECT-GROUP
        OBJECTS {
            cfgFwNatOneToOneEnabled,
            cfgFwNatOneToOneType,
            cfgFwNatOneToOneInterface,
            cfgFwNatOneToOneSourceNet,
            cfgFwNatOneToOneDestinationNet,
            cfgFwNatOneToOneRewriteNet,
            cfgFwNatOneToOneComment
             }
        STATUS current
        DESCRIPTION
            "One to One NAT Settings"
        ::= { groupConfiguration 4 }

    groupCfgFirewallL2IpFilter OBJECT-GROUP
        OBJECTS {
            cfgFwL2IpFilterEnabled,
            cfgFwL2IpFilterDefaultAction,
            cfgFwL2IpFltrEnabled,
            cfgFwL2IpFltrBridge,
            cfgFwL2IpFltrAction,
            cfgFwL2IpFltrPriority,
            cfgFwL2IpFltrSource,
            cfgFwL2IpFltrDestination,
            cfgFwL2IpFltrComment,
            cfgFwL2IpFltrProtocol,
            cfgFwL2IpFltrSourcePort,
            cfgFwL2IpFltrDestinationPort,
            cfgFwL2IpFltrSourceMac,
            cfgFwL2IpFltrDestinationMac,
            cfgFwL2IpFltrEthertype,
            cfgFwL2IpFltrVlan,
            cfgFwL2IpFltrInputInterface,
            cfgFwL2IpFilterMode
             }
        STATUS current
        DESCRIPTION
            "L2 Filter Settings"
        ::= { groupConfiguration 5 }

    groupCfgFirewallFilter OBJECT-GROUP
        OBJECTS {
            cfgFwFltDefaultPolicyInput,
            cfgFwFltDefaultPolicyForward,
            cfgFwFltDefaultPolicyOutput,
            cfgFwFltLogDefaultDrop,
            cfgFwFltLogDefaultAccept,
            cfgFwFltInputSynLimit,
            cfgFwFltInputSynLimitBurst,
            cfgFwFltREnabled,
            cfgFwFltRChain,
            cfgFwFltRAction,
            cfgFwFltRInputInterface,
            cfgFwFltROutputInterface,
            cfgFwFltRProtocol,
            cfgFwFltRSourceAddress,
            cfgFwFltRSourcePortStart,
            cfgFwFltRSourcePortEnd,
            cfgFwFltRDestinationAddress,
            cfgFwFltRDestinationPortStart,
            cfgFwFltRDestinationPortEnd,
            cfgFwFltRComment,
            cfgFwFltRIcmpType,
            cfgFwFltRIcmpCode,
            cfgFwFltRLog,
            cfgFwFltRLimit,
            cfgFwFltRLimitBurst
             }
        STATUS current
        DESCRIPTION
            "Firewall Filter Settings."
        ::= { groupConfiguration 6 }

    groupCfgFirewallMangle OBJECT-GROUP
        OBJECTS {
            cfgFwMnglEnabled,
            cfgFwMnglChain,
            cfgFwMnglAction,
            cfgFwMnglValue,
            cfgFwMnglInputInterface,
            cfgFwMnglOutputInterface,
            cfgFwMnglSourceAddress,
            cfgFwMnglDestinationAddress,
            cfgFwMnglComment,
            cfgFwMnglProtocol,
            cfgFwMnglSourcePortStart,
            cfgFwMnglSourcePortEnd,
            cfgFwMnglDestinationPortStart,
            cfgFwMnglDestinationPortEnd,
            cfgFwMnglDscp
             }
        STATUS current
        DESCRIPTION
            "Firewall Mangle Settings."
        ::= { groupConfiguration 7 }

    groupCfgFirewallL2Mangle OBJECT-GROUP
        OBJECTS {
            cfgFwL2MangleEnabled,
            cfgFwL2MnglEnabled,
            cfgFwL2MnglBridge,
            cfgFwL2MnglAction,
            cfgFwL2MnglPriority,
            cfgFwL2MnglSource,
            cfgFwL2MnglDestination,
            cfgFwL2MnglComment,
            cfgFwL2MnglProtocol,
            cfgFwL2MnglSourcePort,
            cfgFwL2MnglDestinationPort,
            cfgFwL2MnglSourceMac,
            cfgFwL2MnglDestinationMac,
            cfgFwL2MnglEthertype,
            cfgFwL2MnglVlan,
            cfgFwL2MnglInputInterface,
            cfgFwL2MnglValue
             }
        STATUS current
        DESCRIPTION
            "L2 Mangle Settings"
        ::= { groupConfiguration 8 }

-- * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
-- *  End GROUPS
-- **********************************************************************

-- **********************************************************************
-- *  Begin COMPLIANCE STATEMENTS
-- * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

    compliance MODULE-COMPLIANCE
    STATUS current
    DESCRIPTION
        "Implementation Requirements for DT50 bindings"
    MODULE  -- this module
        MANDATORY-GROUPS {
            groupCfgFirewall,
            groupCfgFirewallPortForward,
            groupCfgFirewallOutboundNat,
            groupCfgFirewallOneToOneNat,
            groupCfgFirewallL2IpFilter,
            groupCfgFirewallFilter,
            groupCfgFirewallMangle,
            groupCfgFirewallL2Mangle
        }
    ::= { compliances 1 }

-- * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
-- *  End COMPLIANCE STATEMENTS
-- **********************************************************************

-- * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
-- *  End of MIB DEFINITION
-- **********************************************************************
END


-- **********************************************************************
-- **********************************************************************
