AT-PAE-MIB

All MIBs › AT-PAE-MIB

Organization: Allied Telesis, Inc

Last Updated: 2007-01-15

Category: RADIUS and AAA, Vendor: Allied Telesis

Description: Manages IEEE 802.1X Port Access Entity authentication, RADIUS authentication settings, and supplicant status on Allied Telesis switches.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is AT-PAE-MIB?

AT-PAE-MIB is an Allied Telesis private enterprise MIB that implements IEEE 802.1X Port Access Entity (PAE) authentication management for Allied Telesis switches. It exposes per-port authentication configuration and state data, including PAE port capabilities and protocol version, RADIUS-backed backend authentication state, and supplicant identification. In a monitoring context it is used mainly to track the software-level authentication status of each switch port - whether the PAE and backend authentication state machines report a port as authenticated, held, or failed - rather than physical hardware health. It mirrors and extends the structure of the standard IEEE8021-PAE-MIB within Allied Telesis's own object tree. It is typically deployed in enterprise wired-access environments using 802.1X port-based network access control on Allied Telesis AlliedWare Plus switches. Engineers can download the AT-PAE-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in AT-PAE-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Allied Telesis managed switch

Monitoring Examples

An administrator would poll atrDot1xPaePortTable/atrDot1xPaePortEntry indexed by atrDot1xPaePortNumber to check atrDot1xPaePortProtocolVersion and atrDot1xPaePortCapabilities, then cross-reference atrDot1xAuthConfigTable's atrDot1xAuthPaeState and atrDot1xAuthBackendAuthState to confirm a port reached the authenticated state. A port stuck in connecting or reporting a failed backend state usually points to a RADIUS server problem or supplicant misconfiguration, and atrDot1xPaePortSuppMacAddress identifies the affected client. The admin can invoke atrDot1xPaePortReauthenticate to force re-authentication of a specific port and watch the state change.

What Can Be Monitored

802.1X port authentication state
backend authentication state
port protocol version/capabilities
supplicant MAC address
forced reauthentication

Imported Objects

From AT-SMI-MIB

modules

OBJECT-IDENTITY

From IF-MIB

InterfaceIndex

From SNMPv2-SMI

Counter32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
TimeTicks
Unsigned32

From SNMPv2-TC

DisplayString
MacAddress
TEXTUAL-CONVENTION
TruthValue

How to Use in IPNetwork Monitor

Example using atrDot1xAuthEapolFramesRx OID:

Select an Allied Telesis managed switch or router as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type atrDot1xAuthEapolFramesRx into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. The number of valid EAPOL frames of any type that have been received by this Authenticator. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
ATR atrDot1xAuthAdminControlledDirections	1.3.6.1.4.1.207.8.4.4.4.118.1.1.2.1.1.3	AtrPaeControlledDirections	read-only	The current value of the administrative controlled directions parameter for the Port.
ATR atrDot1xAuthAuthControlledPortControl	1.3.6.1.4.1.207.8.4.4.4.118.1.1.2.1.1.6	AtrPaeControlledPortControl	read-write	The current value of the controlled Port control parameter for the Port.
ATR atrDot1xAuthAuthControlledPortStatus	1.3.6.1.4.1.207.8.4.4.4.118.1.1.2.1.1.5	AtrPaeControlledPortStatus	read-only	The current value of the controlled Port status parameter for the Port.
INT atrDot1xAuthBackendAuthState	1.3.6.1.4.1.207.8.4.4.4.118.1.1.2.1.1.2	INTEGER	read-only	The current state of the Backend Authentication state machine.
atrDot1xAuthConfigEntry	1.3.6.1.4.1.207.8.4.4.4.118.1.1.2.1.1		not-accessible	The configuration information for an Authenticator PAE.
atrDot1xAuthConfigTable	1.3.6.1.4.1.207.8.4.4.4.118.1.1.2.1		not-accessible	A table that contains the configuration objects for the Authenticator PAE associated with each port. An entry appears in this table for each port that may authenticate access to itself.
C32 atrDot1xAuthEapLengthErrorFramesRx	1.3.6.1.4.1.207.8.4.4.4.118.1.1.2.2.1.10	Counter32	read-only	The number of EAPOL frames that have been received by this Authenticator in which the Packet Body Length field is invalid.
C32 atrDot1xAuthEapolFramesRxEx	1.3.6.1.4.1.207.8.4.4.4.118.1.1.2.2.1.1	Counter32	read-only	The number of valid EAPOL frames of any type that have been received by this Authenticator.
C32 atrDot1xAuthEapolFramesTx	1.3.6.1.4.1.207.8.4.4.4.118.1.1.2.2.1.2	Counter32	read-only	The number of EAPOL frames of any type that have been transmitted by this Authenticator.
C32 atrDot1xAuthEapolLogoffFramesRx	1.3.6.1.4.1.207.8.4.4.4.118.1.1.2.2.1.4	Counter32	read-only	The number of EAPOL Logoff frames that have been received by this Authenticator.
C32 atrDot1xAuthEapolReqFramesTx	1.3.6.1.4.1.207.8.4.4.4.118.1.1.2.2.1.8	Counter32	read-only	The number of EAP Request frames (other than Rq/Id frames) that have been transmitted by this Authenticator.
C32 atrDot1xAuthEapolReqIdFramesTx	1.3.6.1.4.1.207.8.4.4.4.118.1.1.2.2.1.7	Counter32	read-only	The number of EAP Req/Id frames that have been transmitted by this Authenticator.
C32 atrDot1xAuthEapolRespFramesRx	1.3.6.1.4.1.207.8.4.4.4.118.1.1.2.2.1.6	Counter32	read-only	The number of valid EAP Response frames (other than Resp/Id frames) that have been received by this Authenticator.
C32 atrDot1xAuthEapolRespIdFramesRx	1.3.6.1.4.1.207.8.4.4.4.118.1.1.2.2.1.5	Counter32	read-only	The number of EAP Resp/Id frames that have been received by this Authenticator.
C32 atrDot1xAuthEapolStartFramesRx	1.3.6.1.4.1.207.8.4.4.4.118.1.1.2.2.1.3	Counter32	read-only	The number of EAPOL Start frames that have been received by this Authenticator.
NTF atrDot1xAuthenticated	1.3.6.1.4.1.207.8.4.4.4.118.1.1.3.1			Triggered when a supplicant is authenticated on a port.
STR atrDot1xAuthGuestVlan	1.3.6.1.4.1.207.8.4.4.4.118.1.1.2.1.1.20	DisplayString	read-write	This value defines a temporary VLAN to assign to a port while there is no 802.1X host connected to it.
C32 atrDot1xAuthInvalidEapolFramesRx	1.3.6.1.4.1.207.8.4.4.4.118.1.1.2.2.1.9	Counter32	read-only	The number of EAPOL frames that have been received by this Authenticator in which the frame type is not recognised.
T/F atrDot1xAuthKeyTxEnabled	1.3.6.1.4.1.207.8.4.4.4.118.1.1.2.1.1.14	TruthValue	read-only	The value of the keyTransmissionEnabled constant currently in use by the Authenticator PAE state machine.
INT atrDot1xAuthLastAuthReason	1.3.6.1.4.1.207.8.4.4.4.118.1.1.2.1.1.17	INTEGER	read-only	Should the supplicant have failed authentication, this records the reason for the last failure. Never is returned in the case the supplicant has never failed.
U32 atrDot1xAuthLastEapolFrameVersion	1.3.6.1.4.1.207.8.4.4.4.118.1.1.2.2.1.11	Unsigned32	read-only	The protocol version number carried in the most recently received EAPOL frame.
U32 atrDot1xAuthMaxReq	1.3.6.1.4.1.207.8.4.4.4.118.1.1.2.1.1.11	Unsigned32	read-write	The value of the maxReq constant currently in use by the Backend Authentication state machine.
T/F atrDot1XAuthMibReset	1.3.6.1.4.1.207.8.4.4.4.118.1.1.2.1.1.21	TruthValue	read-write	Only valid in Multi-Supplicant mode, this parameter defines whether to age out MIB information stored for old supplicants.
ATR atrDot1xAuthOperControlledDirections	1.3.6.1.4.1.207.8.4.4.4.118.1.1.2.1.1.4	AtrPaeControlledDirections	read-only	The current value of the operational controlled directions parameter for the Port.
INT atrDot1xAuthPaeState	1.3.6.1.4.1.207.8.4.4.4.118.1.1.2.1.1.1	INTEGER	read-only	The current value of the Authenticator PAE state machine.
STR atrDot1xAuthPostAuthVlan	1.3.6.1.4.1.207.8.4.4.4.118.1.1.2.1.1.16	DisplayString	read-only	The VLAN name of the VLAN that this port belongs to since RADIUS authentication.
STR atrDot1xAuthPreAuthVlan	1.3.6.1.4.1.207.8.4.4.4.118.1.1.2.1.1.15	DisplayString	read-only	The VLAN name of the VLAN that this port belonged to prior to RADIUS authentication.
U32 atrDot1xAuthQuietPeriod	1.3.6.1.4.1.207.8.4.4.4.118.1.1.2.1.1.7	Unsigned32	read-write	The value, in seconds, of the quietPeriod constant currently in use by the Authenticator PAE state machine.
T/F atrDot1xAuthReAuthEnabled	1.3.6.1.4.1.207.8.4.4.4.118.1.1.2.1.1.13	TruthValue	read-write	The enable/disable control used by the Reauthentication Timer state machine (8.5.5.1).
U32 atrDot1xAuthReAuthPeriod	1.3.6.1.4.1.207.8.4.4.4.118.1.1.2.1.1.12	Unsigned32	read-write	The value, in seconds, of the reAuthPeriod constant currently in use by the Reauthentication Timer state machine.
T/F atrDot1XAuthSecureVlan	1.3.6.1.4.1.207.8.4.4.4.118.1.1.2.1.1.19	TruthValue	read-write	Only valid in Multi-Supplicant mode, this parameter defines whether to allow supplicants to authenticate on a port, when there is already an authenticated aupplicant on the port
U32 atrDot1xAuthServerTimeout	1.3.6.1.4.1.207.8.4.4.4.118.1.1.2.1.1.10	Unsigned32	read-write	The value, in seconds, of the serverTimeout constant currently in use by the Backend Authentication state machine.
atrDot1xAuthStatsEntry	1.3.6.1.4.1.207.8.4.4.4.118.1.1.2.2.1		not-accessible	The statistics information for an Authenticator PAE.
atrDot1xAuthStatsTable	1.3.6.1.4.1.207.8.4.4.4.118.1.1.2.2		not-accessible	A table that contains the statistics objects for the Authenticator PAE associated with each Port. An entry appears in this table for each port that may authenticate access to itself.
U32 atrDot1xAuthSuppTimeout	1.3.6.1.4.1.207.8.4.4.4.118.1.1.2.1.1.9	Unsigned32	read-write	The value, in seconds, of the suppTimeout constant currently in use by the Backend Authentication state machine.
INT atrDot1xAuthTrap	1.3.6.1.4.1.207.8.4.4.4.118.1.1.2.1.1.22	INTEGER	read-write	Specifies what events trigger an SNMP trap.
U32 atrDot1xAuthTxPeriod	1.3.6.1.4.1.207.8.4.4.4.118.1.1.2.1.1.8	Unsigned32	read-write	The value, in seconds, of the txPeriod constant currently in use by the Authenticator PAE state machine.
T/F atrDot1XAuthVlanAssignment	1.3.6.1.4.1.207.8.4.4.4.118.1.1.2.1.1.18	TruthValue	read-write	Specifies whether VLAN Assignment is to be performed on the port. When set to TRUE, the VLAN Assignment mechanism will run, when set to FALSE it will not.
NTF atrDot1xFailedAuth	1.3.6.1.4.1.207.8.4.4.4.118.1.1.3.3			Triggered when a supplicant is unable to be authorised on a port.
atrDot1xPaeAuthenticator	1.3.6.1.4.1.207.8.4.4.4.118.1.1.2
BIT atrDot1xPaePortCapabilities	1.3.6.1.4.1.207.8.4.4.4.118.1.1.1.2.1.3	Bits	read-only	Indicates the PAE functionality that this Port supports and that may be managed through this MIB.
atrDot1xPaePortEntry	1.3.6.1.4.1.207.8.4.4.4.118.1.1.1.2.1		not-accessible	The Port number, protocol version, and initialisation control for a Port.
T/F atrDot1xPaePortInitialise	1.3.6.1.4.1.207.8.4.4.4.118.1.1.1.2.1.4	TruthValue	read-write	The initialisation control for this Port. Setting this attribute TRUE causes the Port to be initialised. The attribute value reverts to FALSE once initialisation has completed.
NUM atrDot1xPaePortNumber	1.3.6.1.4.1.207.8.4.4.4.118.1.1.1.2.1.1	InterfaceIndex	read-only	The Port number associated with this Port.
U32 atrDot1xPaePortProtocolVersion	1.3.6.1.4.1.207.8.4.4.4.118.1.1.1.2.1.2	Unsigned32	read-only	The protocol version associated with this Port.
T/F atrDot1xPaePortReauthenticate	1.3.6.1.4.1.207.8.4.4.4.118.1.1.1.2.1.5	TruthValue	read-write	The reauthentication control for this port. Setting this attribute TRUE causes the Authenticator PAE state machine for the Port to reauthenticate the Supplicant. Setting this attribute FALSE has no effect. This attribute always returns FALSE when it is read.
MAC atrDot1xPaePortSuppMacAddress	1.3.6.1.4.1.207.8.4.4.4.118.1.1.1.2.1.6	MacAddress	read-only	The six character MAC Address of the attached supplicant.
atrDot1xPaePortTable	1.3.6.1.4.1.207.8.4.4.4.118.1.1.1.2		not-accessible	A table of system level information for each port supported by the Port Access Entity. An entry appears in this table for each port of this system.
atrDot1xPaeSystem	1.3.6.1.4.1.207.8.4.4.4.118.1.1.1
atrDot1xTraps	1.3.6.1.4.1.207.8.4.4.4.118.1.1.3
NTF atrDot1xUnauthenticated	1.3.6.1.4.1.207.8.4.4.4.118.1.1.3.2			Triggered when a supplicant who was previously authorised on a port, is no longer authorised. This can be due to an authentication timeout, log off or disconnection of the port.
NTF atrMacBasedAuthAuthenticated	1.3.6.1.4.1.207.8.4.4.4.118.1.1.6.1			Triggered when a supplicant is authenticated on a port.
INT atrMacBasedAuthBackendAuthState	1.3.6.1.4.1.207.8.4.4.4.118.1.1.5.1.1.2	INTEGER	read-only	The current state of the Backend Authentication state machine.
atrMacBasedAuthConfigEntry	1.3.6.1.4.1.207.8.4.4.4.118.1.1.5.1.1		not-accessible	The configuration information for an Authenticator PAE.
atrMacBasedAuthConfigTable	1.3.6.1.4.1.207.8.4.4.4.118.1.1.5.1		not-accessible	A table that contains the configuration objects for the Authenticator PAE associated with each port. An entry appears in this table for each port that may authenticate access to itself.
ATR atrMacBasedAuthControlledPortControl	1.3.6.1.4.1.207.8.4.4.4.118.1.1.5.1.1.4	AtrPaeControlledPortControl	read-write	The current value of the controlled Port control parameter for the Port.
ATR atrMacBasedAuthControlledPortStatus	1.3.6.1.4.1.207.8.4.4.4.118.1.1.5.1.1.3	AtrPaeControlledPortStatus	read-only	The current value of the controlled Port status parameter for the Port.
NTF atrMacBasedAuthFailedAuth	1.3.6.1.4.1.207.8.4.4.4.118.1.1.6.3			Triggered when a supplicant is unable to be authorised on a port.
INT atrMacBasedAuthLastAuthReason	1.3.6.1.4.1.207.8.4.4.4.118.1.1.5.1.1.10	INTEGER	read-only	Should the supplicant have failed authentication, this records the reason for the last failure. Never is returned in the case the supplicant has never failed.
T/F atrMacBasedAuthMibReset	1.3.6.1.4.1.207.8.4.4.4.118.1.1.5.1.1.13	TruthValue	read-write	Only valid in Multi-Supplicant mode, this parameter defines whether to age out MIB information stored for old supplicants.
atrMacBasedAuthPaeAuthenticator	1.3.6.1.4.1.207.8.4.4.4.118.1.1.5
atrMacBasedAuthPaePortEntry	1.3.6.1.4.1.207.8.4.4.4.118.1.1.4.1.1		not-accessible	The Port number, protocol version, and initialisation control for a Port.
T/F atrMacBasedAuthPaePortInitialise	1.3.6.1.4.1.207.8.4.4.4.118.1.1.4.1.1.2	TruthValue	read-write	The initialisation control for this Port. Setting this attribute TRUE causes the Port to be initialised. The attribute value reverts to FALSE once initialisation has completed.
NUM atrMacBasedAuthPaePortNumber	1.3.6.1.4.1.207.8.4.4.4.118.1.1.4.1.1.1	InterfaceIndex	read-only	The Port number associated with this Port.
T/F atrMacBasedAuthPaePortReauthenticate	1.3.6.1.4.1.207.8.4.4.4.118.1.1.4.1.1.3	TruthValue	read-write	The reauthentication control for this port. Setting this attribute TRUE causes the Authenticator PAE state machine for the Port to reauthenticate the Supplicant. Setting this attribute FALSE has no effect. This attribute always returns FALSE when it is read.
MAC atrMacBasedAuthPaePortSuppMacAddress	1.3.6.1.4.1.207.8.4.4.4.118.1.1.4.1.1.4	MacAddress	read-only	The six character MAC Address of the attached supplicant.
atrMacBasedAuthPaePortTable	1.3.6.1.4.1.207.8.4.4.4.118.1.1.4.1		not-accessible	A table of system level information for each port supported by the Port Access Entity. An entry appears in this table for each port of this system.
INT atrMacBasedAuthPaeState	1.3.6.1.4.1.207.8.4.4.4.118.1.1.5.1.1.1	INTEGER	read-only	The current value of the Authenticator PAE state machine.
atrMacBasedAuthPaeSystem	1.3.6.1.4.1.207.8.4.4.4.118.1.1.4
STR atrMacBasedAuthPostAuthVlan	1.3.6.1.4.1.207.8.4.4.4.118.1.1.5.1.1.9	DisplayString	read-only	The VLAN name of the VLAN that this port belongs to since RADIUS authentication.
STR atrMacBasedAuthPreAuthVlan	1.3.6.1.4.1.207.8.4.4.4.118.1.1.5.1.1.8	DisplayString	read-only	The VLAN name of the VLAN that this port belonged to prior to RADIUS authentication.
U32 atrMacBasedAuthQuietPeriod	1.3.6.1.4.1.207.8.4.4.4.118.1.1.5.1.1.5	Unsigned32	read-write	The value, in seconds, of the quietPeriod constant currently in use by the Authenticator PAE state machine.
T/F atrMacBasedAuthReAuthEnabled	1.3.6.1.4.1.207.8.4.4.4.118.1.1.5.1.1.7	TruthValue	read-write	The enable/disable control used by the Reauthentication Timer state machine.
U32 atrMacBasedAuthReAuthPeriod	1.3.6.1.4.1.207.8.4.4.4.118.1.1.5.1.1.6	Unsigned32	read-write	The value, in seconds, of the reAuthPeriod constant currently in use by the Reauthentication Timer state machine.
T/F atrMacBasedAuthSecureVlan	1.3.6.1.4.1.207.8.4.4.4.118.1.1.5.1.1.12	TruthValue	read-write	Only valid in Multi-Supplicant mode, this parameter defines whether to allow supplicants to authenticate on a port, when there is already an authenticated aupplicant on the port
INT atrMacBasedAuthTrap	1.3.6.1.4.1.207.8.4.4.4.118.1.1.5.1.1.14	INTEGER	read-write	Specifies what events trigger an SNMP trap.
atrMacBasedAuthTraps	1.3.6.1.4.1.207.8.4.4.4.118.1.1.6
NTF atrMacBasedAuthUnauthenticated	1.3.6.1.4.1.207.8.4.4.4.118.1.1.6.2			Triggered when a supplicant who was previously authorised on a port, is no longer authorised. This can be due to a authentication timeout or a failed reauthentication.
T/F atrMacBasedAuthVlanAssignment	1.3.6.1.4.1.207.8.4.4.4.118.1.1.5.1.1.11	TruthValue	read-write	Specifies whether VLAN Assignment is to be performed on the port. When set to TRUE, the VLAN Assignment mechanism will run, when set to FALSE it will not.
atrPaeMib	1.3.6.1.4.1.207.8.4.4.4.118.1
atrPaeMIBObjects	1.3.6.1.4.1.207.8.4.4.4.118.1.1
portAuth	1.3.6.1.4.1.207.8.4.4.4.118			Description of atrDot1xUnauthenticated is modified.

RFC description

Implements 802.1X port authentication and access control on Allied Telesis devices.

Start monitoring Allied Telesis managed switches and routers with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download AT-PAE-MIB