BAY-STACK-RADIUS-MIB

All MIBs › BAY-STACK-RADIUS-MIB

Organization: Avaya

Last Updated: 2015-07-23

Category: RADIUS and AAA, Vendor: Avaya

Description: Manages RADIUS authentication server configuration and accounting statistics on Avaya/Nortel ERS switches.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is BAY-STACK-RADIUS-MIB?

BAY-STACK-RADIUS-MIB is a Nortel/Avaya (BayStack/ERS switch family) MIB for configuring and monitoring RADIUS authentication and accounting on the switch. It exposes objects controlling whether the switch uses its management IP for RADIUS traffic, whether accounting is enabled and on which port, interim accounting update settings and interval, password-fallback and dynamic-authorization replay-protection behavior, and a reachability test mechanism with its own username/password. This is a software/service-status MIB centered on the health of the authentication subsystem — its monitoring value is confirming that RADIUS accounting and reachability checks are functioning, critical for network access control, rather than tracking hardware sensors like temperature or fans. It depends on the standard RADIUS protocol (RFC 2865/2866) for the underlying authentication/accounting semantics it configures and reports on. It is deployed on Avaya/Nortel Ethernet Routing Switches (ERS) in enterprise networks using RADIUS-based network access control (e.g., 802.1X). Engineers can download the BAY-STACK-RADIUS-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in BAY-STACK-RADIUS-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Avaya/Nortel Ethernet Routing Switch (BayStack/ERS series)

Monitoring Examples

An operator would check bsRadiusAccountingEnabled and bsRadiusAccountingPort to confirm accounting is turned on and directed at the expected port, and bsRadiusAccountingInterimUpdates/bsRadiusAccountingInterimUpdatesInterval to verify interim updates are sent at the configured cadence for long-lived sessions. bsRadiusReachability together with bsRadiusReachabilityUserName/bsRadiusReachabilityPassword would actively test whether the configured RADIUS server is reachable and responding, catching a silently failed authentication path before users are locked out. bsRadiusNotifications would alert on RADIUS-related events such as a reachability test failure.

What Can Be Monitored

RADIUS accounting enabled state and port
interim accounting update interval
RADIUS server reachability test result
password fallback behavior
dynamic authorization replay-protection setting

Imported Objects

From INET-ADDRESS-MIB

InetAddress
InetAddressType
InetPortNumber

From RADIUS-DYNAUTH-SERVER-MIB

radiusDynAuthClientEntry

OBJECT-TYPE

From SNMPv2-SMI

Counter32
Integer32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DisplayString
RowStatus
TruthValue

From SYNOPTICS-ROOT-MIB

bayStackMibs

OBJECT-IDENTITY

How to Use in IPNetwork Monitor

Example using bsRadiusExtDynAuthServRcRequests OID:

Select an Avaya/Nortel BayStack Ethernet Routing Switch (ERS) (legacy) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type bsRadiusExtDynAuthServRcRequests into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. The number of RADIUS Reauthentication-requests received from this Dynamic Authorization Client. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline (in requests), since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
bayStackRadiusMib	1.3.6.1.4.1.45.5.21			This MIB module is used for RADIUS configuration settings in Nortel's software and products.
T/F bsRadiusAccountingEnabled	1.3.6.1.4.1.45.5.21.1.1.2	TruthValue	read-write	This object controls whether RADIUS accounting is enabled.
T/F bsRadiusAccountingInterimUpdates	1.3.6.1.4.1.45.5.21.1.1.5	TruthValue	read-write	This object controls whether RADIUS interim updates are enabled or disabled.
U32 bsRadiusAccountingInterimUpdatesInterval	1.3.6.1.4.1.45.5.21.1.1.6	Unsigned32	read-write	This object controls the interval for RADIUS interim updates.
INT bsRadiusAccountingInterimUpdatesIntervalSource	1.3.6.1.4.1.45.5.21.1.1.7	INTEGER	read-write	This object controls the source for the interval value for RADIUS interim updates. If the value is configuredValue(1), then the value of bsRadiusAccountingInterimUpdatesInterval is used. If the value is radiusServer(2), then a value obtained from the RADIUS server is used.
INE bsRadiusAccountingPort	1.3.6.1.4.1.45.5.21.1.1.4	InetPortNumber	read-write	This object controls the port used for RADIUS accounting.
IP bsRadiusDynAuthClientAddress	1.3.6.1.4.1.45.5.21.1.3.1.2	InetAddress	not-accessible	The internet address of a RADIUS Dynamic Authorization Client configured in this entry.
IPt bsRadiusDynAuthClientAddressType	1.3.6.1.4.1.45.5.21.1.3.1.1	InetAddressType	not-accessible	The type of address contained in the corresponding instance of bsRadiusDynAuthClientAddress.
T/F bsRadiusDynAuthClientEnabled	1.3.6.1.4.1.45.5.21.1.3.1.5	TruthValue	read-create	Enable or disable packet receive from this RADIUS Dynamic Authorization Client. The NAS will not listen for requests from the client unless this object is true(1).
bsRadiusDynAuthClientEntry	1.3.6.1.4.1.45.5.21.1.3.1		not-accessible	An entry containing objects defining RADIUS Dynamic Authorization Clients which can connect to this RADIUS Dynamic Authorization Server.
T/F bsRadiusDynAuthClientProcessCoARequests	1.3.6.1.4.1.45.5.21.1.3.1.7	TruthValue	read-create	Enable or disable processing of Change-Of-Authorization requests from the RADIUS Dynamic Authorization Client.
T/F bsRadiusDynAuthClientProcessDisconnectRequests	1.3.6.1.4.1.45.5.21.1.3.1.6	TruthValue	read-create	Enable or disable processing of Disconnect requests from the RADIUS Dynamic Authorization Client.
T/F bsRadiusDynAuthClientProcessReAuthRequests	1.3.6.1.4.1.45.5.21.1.3.1.10	TruthValue	read-create	Enable or disable the processing of Reauthentication requests from the RADIUS Dynamic Authorization Client.
T/F bsRadiusDynAuthClientReplayProtection	1.3.6.1.4.1.45.5.21.1.3.1.9	TruthValue	read-create	Enable or disable RADIUS replay protection.
ROW bsRadiusDynAuthClientRowStatus	1.3.6.1.4.1.45.5.21.1.3.1.8	RowStatus	read-create	Controls row creation/deletion in this table.
OCT bsRadiusDynAuthClientSecret	1.3.6.1.4.1.45.5.21.1.3.1.4	OCTET STRING	read-create	The secret shared between RADIUS Dynamic Authorization Client and Server. Note that when this object is retrieved, its value will always by a zero-length octet string.
bsRadiusDynAuthClientTable	1.3.6.1.4.1.45.5.21.1.3		not-accessible	This table is used to configure RADIUS Dynamic Authorization Clients. RADIUS Dynamic Authorization Clients are entities which can send Disconnect and Change Of Authorization requests to a RADIUS Dynamic Authorization Server.
INE bsRadiusDynAuthClientUdpPort	1.3.6.1.4.1.45.5.21.1.3.1.3	InetPortNumber	read-create	The UDP port number the server/NAS listens on for requests from the RADIUS Dynamic Authorization Client configured in this entry.
T/F bsRadiusDynAuthReplayProtection	1.3.6.1.4.1.45.5.21.1.1.8	TruthValue	read-write	Globally enable or disable RADIUS replay protection.
INT bsRadiusEncapsulationProtocol	1.3.6.1.4.1.45.5.21.1.1.12	INTEGER	read-write	This object specifies the type of encapsulation for RADIUS packets.
bsRadiusExtDynAuthClientEntry	1.3.6.1.4.1.45.5.21.1.4.1		not-accessible	An entry (conceptual row) representing one Dynamic Authorization Client with which the server shares a secret.
bsRadiusExtDynAuthClientTable	1.3.6.1.4.1.45.5.21.1.4		not-accessible	The (conceptual) table listing the RADIUS Dynamic Authorization Clients with which the server shares a secret. This is an extension of radiusDynAuthClientTable.
C32 bsRadiusExtDynAuthServRcAcks	1.3.6.1.4.1.45.5.21.1.4.1.4	Counter32	read-only	The number of incoming Reauthentication packets from this Dynamic Authorization Client silently discarded by the server application for some reason other than malformed, bad authenticators, or unknown types. This counter may experience a discontinuity when the DAS module (re)starts, as indicated by the value of radiusDynAuthServerCounterDiscontinuity.
C32 bsRadiusExtDynAuthServRcAuthOnlyRequests	1.3.6.1.4.1.45.5.21.1.4.1.2	Counter32	read-only	The number of RADIUS Reauthentication-requests that include a Service-Type attribute with value 'Authorize Only' received from this Dynamic Authorization Client. This counter may experience a discontinuity when the DAS module (re)starts, as indicated by the value of radiusDynAuthServerCounterDiscontinuity.
C32 bsRadiusExtDynAuthServRcBadAuths	1.3.6.1.4.1.45.5.21.1.4.1.11	Counter32	read-only	The number of RADIUS Reauthentication-Request packets that contained an invalid Authenticator field received from this Dynamic Authorization Client. This counter may experience a discontinuity when the DAS module (re)starts, as indicated by the value of radiusDynAuthServerCounterDiscontinuity.
C32 bsRadiusExtDynAuthServRcDropped	1.3.6.1.4.1.45.5.21.1.4.1.10	Counter32	read-only	The number of incoming Reauthentication packets from this Dynamic Authorization Client silently discarded by the server application for some reason other than malformed, bad authenticators, or unknown types. This counter may experience a discontinuity when the DAS module (re)starts, as indicated by the value of radiusDynAuthServerCounterDiscontinuity.
C32 bsRadiusExtDynAuthServRcDupRequests	1.3.6.1.4.1.45.5.21.1.4.1.3	Counter32	read-only	The number of duplicate RADIUS Reauthentication-Request packets received from this Dynamic Authorization Client. This counter may experience a discontinuity when the DAS module (re)starts, as indicated by the value of radiusDynAuthServerCounterDiscontinuity.
C32 bsRadiusExtDynAuthServRcMalformed	1.3.6.1.4.1.45.5.21.1.4.1.9	Counter32	read-only	The number of malformed RADIUS Reauthentication-Request packets received from this Dynamic Authorization Client. Bad authenticators and unknown types are not included as malformed Reauthentication-Requests. This counter may experience a discontinuity when the DAS module (re)starts, as indicated by the value of radiusDynAuthServerCounterDiscontinuity.
C32 bsRadiusExtDynAuthServRcNacks	1.3.6.1.4.1.45.5.21.1.4.1.5	Counter32	read-only	The number of RADIUS Reauthentication-NAK packets sent to this Dynamic Authorization Client. This includes the RADIUS Reauthentication-NAK packets sent with a Service-Type attribute with value 'Authorize Only' and the RADIUS Reauthentication-NAK packets sent because no session context was found. This counter may experience a discontinuity when the DAS module (re)starts, as indicated by the value of radiusDynAuthServerCounterDiscontinuity.
C32 bsRadiusExtDynAuthServRcNacksAuthOnlyRequests	1.3.6.1.4.1.45.5.21.1.4.1.6	Counter32	read-only	The number of RADIUS Reauthentication-NAK packets that include a Service-Type attribute with value 'Authorize Only' sent to this Dynamic Authorization Client. This counter may experience a discontinuity when the DAS module (re)starts, as indicated by the value of radiusDynAuthServerCounterDiscontinuity.
C32 bsRadiusExtDynAuthServRcNacksNoSess	1.3.6.1.4.1.45.5.21.1.4.1.7	Counter32	read-only	The number of RADIUS Reauthentication-NAK packets sent to this Dynamic Authorization Client because no session context was found. This counter may experience a discontinuity when the DAS module (re)starts, as indicated by the value of radiusDynAuthServerCounterDiscontinuity.
C32 bsRadiusExtDynAuthServRcRequestsEx	1.3.6.1.4.1.45.5.21.1.4.1.1	Counter32	read-only	The number of RADIUS Reauthentication-requests received from this Dynamic Authorization Client. This also includes the Reauthentication requests that have a Service-Type attribute with value 'Authorize Only'. This counter may experience a discontinuity when the DAS module (re)starts, as indicated by the value of radiusDynAuthServerCounterDiscontinuity.
C32 bsRadiusExtDynAuthServRcSessReauthenticated	1.3.6.1.4.1.45.5.21.1.4.1.8	Counter32	read-only	The number of user sessions reauthenticated for the Reauthentication-Requests received from this Dynamic Authorization Client. Depending on site- specific policies, a single Reauthentication request can change multiple user sessions' authorization. In cases where this Dynamic Authorization Server has no knowledge of the number of user sessions that are affected by a single request, each such CoA-Request will count as a single affected user session only. This counter may experience a discontinuity when the DAS module (re)starts, as indicated by the value of radiusDynAuthServerCounterDiscontinuity.
bsRadiusNotifications	1.3.6.1.4.1.45.5.21.0
bsRadiusObjects	1.3.6.1.4.1.45.5.21.1
T/F bsRadiusPasswordFallbackEnabled	1.3.6.1.4.1.45.5.21.1.1.3	TruthValue	read-write	This object controls whether RADIUS password fallback is enabled.
INT bsRadiusReachability	1.3.6.1.4.1.45.5.21.1.1.9	INTEGER	read-write	Select the method used to test RADIUS server reachablity.
I32 bsRadiusReachabilityBadTimer	1.3.6.1.4.1.45.5.21.1.1.15	Integer32	read-write	This object specifies the interval between checks when the RADIUS server is unreachable.
I32 bsRadiusReachabilityGoodTimer	1.3.6.1.4.1.45.5.21.1.1.16	Integer32	read-write	This object specifies the interval between checks when the RADIUS server is reachable.
STR bsRadiusReachabilityPassword	1.3.6.1.4.1.45.5.21.1.1.11	DisplayString	read-write	The password used for the RADIUS server reachability useRadius option.
I32 bsRadiusReachabilityRetry	1.3.6.1.4.1.45.5.21.1.1.14	Integer32	read-write	This object specifies the number of retry attempts to reach the RADIUS server.
NTF bsRadiusReachabilityServerDown	1.3.6.1.4.1.45.5.21.0.1			This notification is generated when a Radius server fails to respond to reachability requests.
NTF bsRadiusReachabilityServerUp	1.3.6.1.4.1.45.5.21.0.2			This notification is generated when a Radius server, which has previously failed to respond to reachability requests, responds to a reachability request.
I32 bsRadiusReachabilityTimeout	1.3.6.1.4.1.45.5.21.1.1.13	Integer32	read-write	This object specifies the time interval to wait before re-sending a message to the RADIUS server .
STR bsRadiusReachabilityUserName	1.3.6.1.4.1.45.5.21.1.1.10	DisplayString	read-write	The username used for the RADIUS server reachability useRadius option.
bsRadiusScalars	1.3.6.1.4.1.45.5.21.1.1
T/F bsRadiusServerAccountingEnabled	1.3.6.1.4.1.45.5.21.1.2.1.10	TruthValue	read-write	This object controls whether RADIUS accounting is enabled for this RADIUS server instance.
INE bsRadiusServerAccountingPort	1.3.6.1.4.1.45.5.21.1.2.1.9	InetPortNumber	read-write	The UDP accounting port number to use when trying to contact the RADIUS server at the address contained in the corresponding instance of bsRadiusServerAddress.
IP bsRadiusServerAddress	1.3.6.1.4.1.45.5.21.1.2.1.4	InetAddress	read-create	The internet address to use when attempting to contact a RADIUS server.
IPt bsRadiusServerAddressType	1.3.6.1.4.1.45.5.21.1.2.1.3	InetAddressType	read-create	The type of address contained in the corresponding instance of bsRadiusServerAddress.
bsRadiusServerEntry	1.3.6.1.4.1.45.5.21.1.2.1		not-accessible	An entry containing objects defining how to connect to a RADIUS server.
I32 bsRadiusServerIndex	1.3.6.1.4.1.45.5.21.1.2.1.1	Integer32	not-accessible	A unique integer value used to identify entries in this table.
I32 bsRadiusServerPriority	1.3.6.1.4.1.45.5.21.1.2.1.2	Integer32	read-create	This value indicates the order in which entries in this table are used when attempting to contact a RADIUS server. Entries with a lower priority number are tried first. If two entries have the same priority value, the entry with a lower index value is tried first. Also note that entries which contain an invalid internet address will not be used.
I32 bsRadiusServerRetryLimit	1.3.6.1.4.1.45.5.21.1.2.1.11	Integer32	read-write	This object specifies the number of RADIUS retry attempts, for this RADIUS server instance.
ROW bsRadiusServerRowStatus	1.3.6.1.4.1.45.5.21.1.2.1.8	RowStatus	read-create	Controls row creation/deletion in this table.
OCT bsRadiusServerSecret	1.3.6.1.4.1.45.5.21.1.2.1.7	OCTET STRING	read-create	The shared RADIUS secret to use when communicating with the RADIUS server. Note that when this object is retrieved, its value will always by a zero-length octet string.
bsRadiusServerTable	1.3.6.1.4.1.45.5.21.1.2		not-accessible	This table is used to control RADIUS server settings.
I32 bsRadiusServerTimeout	1.3.6.1.4.1.45.5.21.1.2.1.6	Integer32	read-create	The time interval to wait before re-sending a message to this RADIUS server.
INE bsRadiusServerUdpPort	1.3.6.1.4.1.45.5.21.1.2.1.5	InetPortNumber	read-create	The UDP port number to use when trying to contact the RADIUS server at the address contained in the corresponding instance of bsRadiusServerAddress.
T/F bsRadiusUseMgmtIp	1.3.6.1.4.1.45.5.21.1.1.1	TruthValue	read-write	This object controls whether RADIUS uses the system's management IP address as the source address for RADIUS requests.

RFC description

Manages RADIUS authentication configuration on BayStack products including server settings, accounting, and reachability.

Start monitoring Avaya/Nortel BayStack Ethernet Routing Switch (ERS) (legacy) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download BAY-STACK-RADIUS-MIB