ALTIGA-SDI-ACE-STATS-MIB

All MIBs › ALTIGA-SDI-ACE-STATS-MIB

Organization: Cisco Systems, Inc.

Last Updated: 2002-09-05

Category: VPN and Security, Vendor: Altiga

Description: Altiga (Cisco VPN 3000) SDI/ACE server statistics MIB for monitoring RSA SecurID token authentication activity.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is ALTIGA-SDI-ACE-STATS-MIB?

ALTIGA-SDI-ACE-STATS-MIB is a proprietary MIB from Altiga Networks (Cisco VPN 3000 Series Concentrator) for monitoring integration with RSA SecurID (SDI/ACE) two-factor authentication servers used for VPN login. It exposes a table of configured ACE servers -- address, port, priority, retry count, timeout, and group ID -- alongside per-server authentication success and failure counters. This MIB is centered on software/authentication-service health: a rising ratio of alACEServerAuthFailures to alACEServerAuthSuccesses signals problems reaching the RSA server, token synchronization issues, or user error, while the server table's priority ordering lets an admin confirm failover among redundant ACE servers is behaving as configured. It depends on RSA/SDI's proprietary ACE authentication protocol and is part of the Altiga family of statistics MIBs alongside the event, filter, L2TP, and multilink modules. It is deployed on Cisco/Altiga VPN 3000 Concentrators configured for RSA SecurID token-based remote-access authentication, generally starting with an ALTIGA-SDI-ACE-STATS-MIB download to load its object definitions into a MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in ALTIGA-SDI-ACE-STATS-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Cisco/Altiga VPN 3000 Series concentrator

Monitoring Examples

An administrator would poll alACEServerTable entries keyed by alACEPrimaryIndex and alACEServerIndex, watching alACEServerAuthFailures rise sharply against alACEServerAuthSuccesses as a sign of an RSA ACE server outage or widespread token desynchronization. Checking alACEServerPriority and alACEServerAddress confirms the concentrator is failing over to the correct backup SecurID server. Reviewing alACEServerTimeout and alACEServerRetries helps verify the retry behavior matches the deployed authentication policy.

What Can Be Monitored

RSA/ACE authentication successes and failures
configured ACE server address/port/priority
server retry and timeout settings
authentication server group assignment

Imported Objects

From ALTIGA-GLOBAL-REG

alACEServerMibModule

OBJECT-IDENTITY

From ALTIGA-MIB

alACEServerGroup	OBJECT-IDENTITY
alACEServerStats	OBJECT-IDENTITY

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Gauge32
Integer32
IpAddress
MODULE-IDENTITY
OBJECT-TYPE

How to Use in IPNetwork Monitor

Example using alACEServerRetries OID:

Select a Cisco (Altiga) VPN 3000 Series Concentrator (legacy) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type alACEServerRetries into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. It reports the number of retries for this server. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
altigaACEStatsMibModule	1.3.6.1.4.1.3076.1.1.50.1			The Altiga SDI ACE Server Statistics MIB models counters and objects that are of management interest for SDI ACE Server. Acronyms The following acronyms are used in this document: ACE: Access Control Encryption MIB: Management Information Base PIN: Personal Identification Number SDI: Security Dynamics Technologies, Inc
altigaACEStatsMibConformance	1.3.6.1.4.1.3076.1.1.50.1.1
altigaACEStatsMibCompliances	1.3.6.1.4.1.3076.1.1.50.1.1.1
altigaACEStatsMibCompliance	1.3.6.1.4.1.3076.1.1.50.1.1.1.1			The compliance statement for agents which implement the Altiga ACE Server Statistics MIB.
altigaACEServerGroup	1.3.6.1.4.1.3076.2.1.1.1.45.1			The objects for ACE-STATS.
alCfgACEGlobal	1.3.6.1.4.1.3076.2.1.2.45.1
alACEServerTable	1.3.6.1.4.1.3076.2.1.2.45.2		not-accessible	The list of authentication servers.
alACEServerEntry	1.3.6.1.4.1.3076.2.1.2.45.2.1		not-accessible	An entry in the alAuthServerTable.
I32 alACEPrimaryIndex	1.3.6.1.4.1.3076.2.1.2.45.2.1.1	Integer32	read-only	The index of the configured primary server
I32 alACEServerIndex	1.3.6.1.4.1.3076.2.1.2.45.2.1.2	Integer32	read-only	The index of this server into the server list
I32 alACEServerPriority	1.3.6.1.4.1.3076.2.1.2.45.2.1.3	Integer32	read-only	The priority as computed by loadbalancing
IP alACEServerAddress	1.3.6.1.4.1.3076.2.1.2.45.2.1.4	IpAddress	read-only	Resolved address from the ACE Server.
I32 alACEServerPort	1.3.6.1.4.1.3076.2.1.2.45.2.1.5	Integer32	read-only	Port over ride for this entry
C32 alACEServerRetriesEx	1.3.6.1.4.1.3076.2.1.2.45.2.1.6	Counter32	read-only	Number of retries for this server.
C32 alACEServerTimeout	1.3.6.1.4.1.3076.2.1.2.45.2.1.7	Counter32	read-only	Timeout, in seconds to access this server.
G32 alACEServerGroupId	1.3.6.1.4.1.3076.2.1.2.45.2.1.8	Gauge32	read-only	The group that this authentication server entry belongs to.
C32 alACEServerAuthSuccesses	1.3.6.1.4.1.3076.2.1.2.45.2.1.9	Counter32	read-only	number of auth successes.
C32 alACEServerAuthFailures	1.3.6.1.4.1.3076.2.1.2.45.2.1.10	Counter32	read-only	number of failures for this server.
C32 alACEServerBadCodeSent	1.3.6.1.4.1.3076.2.1.2.45.2.1.11	Counter32	read-only	number of Bad Code sent to this server.
C32 alACEServerBadPinSent	1.3.6.1.4.1.3076.2.1.2.45.2.1.12	Counter32	read-only	number of Bad Pin sent to this server.

RFC description

Manages SDI ACE Server authentication statistics and counters for Altiga VPN appliances.

Start monitoring Cisco (Altiga) VPN 3000 Series Concentrators (legacy) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download ALTIGA-SDI-ACE-STATS-MIB