CISCO-AAA-CLIENT-MIB

All MIBs › CISCO-AAA-CLIENT-MIB

Organization: Cisco Systems, Inc.

Last Updated: 2001-11-19

Category: Cisco Devices, RADIUS and AAA

Description: Manages AAA client configuration and statistics for authentication on Cisco devices.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is CISCO-AAA-CLIENT-MIB?

CISCO-AAA-CLIENT-MIB is a Cisco enterprise MIB governing Authentication, Authorization and Accounting (AAA) client behavior, explicitly referencing TACACS+, RFC1411 Kerberos telnet authentication, and RFC1964 Kerberos GSS-API as the protocols it manages priority and configuration for. Its data is configuration-oriented rather than hardware: authentication method priority order, login mode, lockout period and maximum login attempts. Its monitoring value lies in verifying login-security posture and software behavior, e.g. confirming lockout thresholds and method priority are correctly enforced, and catching misconfigurations that could lock out or under-secure administrative access. It is explicitly built to interoperate with TACACS+, RFC1411 and RFC1964 as the underlying authentication protocols. It is used on any Cisco router or switch relying on centralized AAA (TACACS+/RADIUS/Kerberos) for administrative access control. Engineers can download the CISCO-AAA-CLIENT-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in CISCO-AAA-CLIENT-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Cisco router
Cisco switch (any AAA-capable Cisco IOS device)

Monitoring Examples

cacPriorityTable, keyed by cacPriorityNumber, exposes cacPrimaryMethod, letting an admin confirm the configured order in which authentication methods (e.g. TACACS+ then local) are tried. cacLoginConfigTable's cacMaxLoginAttempt and cacLockoutPeriod can be polled to verify the account-lockout policy in force; if cacEnable or cacLoginMode indicates AAA is disabled unexpectedly, administrative logins could be silently falling back to an insecure local-only method.

What Can Be Monitored

AAA authentication method priority order
login mode/enable state
max login attempts
account lockout period

Imported Objects

From CISCO-SMI

ciscoMgmt

OBJECT-IDENTITY

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Integer32
MODULE-IDENTITY
OBJECT-TYPE

From SNMPv2-TC

TEXTUAL-CONVENTION
TruthValue

OIDs

OID symbolic	OID numeric	Type	Access	Description
ciscoAAAClientMIB	1.3.6.1.4.1.9.9.158			This MIB module provides data for authentication method priority based on Authentication, Authorization, Accounting (AAA) protocols. References: The TACACS+ Protocol Version 1.78, Internet Draft RFC 1411 Telnet Authentication: Kerberos Version 4. RFC 1964 The Kerberos Version 5 GSS-API Mechanism.
cacMIBObjects	1.3.6.1.4.1.9.9.158.1
cacPriority	1.3.6.1.4.1.9.9.158.1.1
cacPriorityTable	1.3.6.1.4.1.9.9.158.1.1.1		not-accessible	This table contains entries for AAA authentication methods configured in the system. At startup, agent set up all the entries of the table. All authentication methods will be disabled except local authentication will be enabled for each session type and login mode. Users later can enable/disable a specific authentication method through cacEnable object. The following table describes the startup state of each authentication method and session type in normal login mode and enable login mode. AuthenMethod Console Session Telnet Session Http Session ------------ ---------------- ---------------- ------------ tacacs disabled disabled disabled radius disabled disabled disabled kerberos disabled disabled disabled local enabled() enabled() enabled() () denotes primary method.
cacPriorityEntry	1.3.6.1.4.1.9.9.158.1.1.1.1		not-accessible	An entry containing the priority number of an authentication method used in a session.
SES cacSession	1.3.6.1.4.1.9.9.158.1.1.1.1.1	SessionType	not-accessible	This is the session type used to connect to the network device.
AUT cacAuthen	1.3.6.1.4.1.9.9.158.1.1.1.1.2	AuthenMethod	not-accessible	This is the authentication method used to authenticate users.
LOG cacLoginMode	1.3.6.1.4.1.9.9.158.1.1.1.1.3	LoginMode	not-accessible	This is the login mode user used to login to the network device.
T/F cacEnable	1.3.6.1.4.1.9.9.158.1.1.1.1.4	TruthValue	read-write	It indicates whether the authentication method denoted by cacAuthen is enabled or not. When this object is true(1), the authentication method denoted by cacAuthen is enabled. When this object is false(2), the authentication method denoted by cacAuthen is disabled. If the value of cacAuthen is local, the value of this object cannot be set to false(2).
I32 cacPriorityNumber	1.3.6.1.4.1.9.9.158.1.1.1.1.5	Integer32	read-only	This is the priority number of an authentication method to be used in user authentication for a session. This value is automatically assigned and reflects the relative priority of the authentication method denoted by cacAuthen with respected to already configured authentication methods. It is assigned in the order in which the authentication method is enabled by the user through cacEnable. The higher value has the higher priority. This object is used to determine the fallback order in case the primary authentication method indicated by cacPrimaryMethod failed. If the authentication method denoted by cacAuthen is disabled for the type of session denoted by cacSession, the value of this object is equal to 0.
T/F cacPrimaryMethod	1.3.6.1.4.1.9.9.158.1.1.1.1.6	TruthValue	read-write	It indicates whether the authentication method denoted by cacAuthen is the primary (first one to be tried) method when there are multiple authentication method configured. Setting this object to true(1) will make the authentication method denoted by cacAuthen to be the primary authentication method for the session denoted by cacSession. The previously configured primary method will be changed to false(2). Setting this object to false(2) is not allowed.
cacLoginConfig	1.3.6.1.4.1.9.9.158.1.2
cacLoginConfigTable	1.3.6.1.4.1.9.9.158.1.2.1		not-accessible	A table that contains login configuration which is associated with this system.
cacLoginConfigEntry	1.3.6.1.4.1.9.9.158.1.2.1.1		not-accessible	An entry containing the configuration of the login.
I32 cacMaxLoginAttempt	1.3.6.1.4.1.9.9.158.1.2.1.1.1	Integer32	read-write	Indicates the maximum number of login attempts allowed. Setting this variable to 0 will disable the attempt limit checking. If the login session type does not support this attempt limit checking, the value of this object can only be set to 0.
I32 cacLockoutPeriod	1.3.6.1.4.1.9.9.158.1.2.1.1.2	Integer32	read-write	Indicates the lockout period after the maximum number of login attempt is met. For console, the console input will be frozen during this period. For remote logins, the connection will be closed and any subsequent access from that station will be closed during the lockout time. Setting this variable to 0 will disable the lockout. If the login session type does not support this lockout period, the value of this object can only be set to 0. If the lockout period is greater than the maximum value reportable by this object then this object should report its maximum value (600) and cacLockoutPeriodExt must be used to report the lockout period.
I32 cacLockoutPeriodExt	1.3.6.1.4.1.9.9.158.1.2.1.1.3	Integer32	read-write	Specifies the lockout period after the maximum number of login attempt is met. For console, the console input will be frozen during this period. For remote logins, the connection will be closed and any subsequent access from that station will be closed during the lockout time. Setting this variable to 0 will disable the lockout. If the login session type does not support this lockout period, the value of this object can only be set to 0.
cacMIBNotifications	1.3.6.1.4.1.9.9.158.2
cacMIBConformance	1.3.6.1.4.1.9.9.158.3
cacMIBCompliances	1.3.6.1.4.1.9.9.158.3.1
cacMIBCompliance	1.3.6.1.4.1.9.9.158.3.1.1			The compliance statement for entities which implement the CISCO AAA Client MIB
cacMIBCompliance2	1.3.6.1.4.1.9.9.158.3.1.2			The compliance statement for entities which implement the CISCO AAA Client MIB
cacMIBGroups	1.3.6.1.4.1.9.9.158.3.2
cacPriorityGroup	1.3.6.1.4.1.9.9.158.3.2.1			A collection of objects providing the AAA client priority information.
cacLoginConfigGroup	1.3.6.1.4.1.9.9.158.3.2.2			A collection of objects providing the AAA client login configuration.
cacLoginConfigGroupRev1	1.3.6.1.4.1.9.9.158.3.2.3			A collection of objects providing the AAA client login configuration.

RFC description

RFC 3317 MIB defining objects for RADIUS and TACACS+ AAA client operations on Cisco devices, enabling remote monitoring of authentication and authorization activities.

Start monitoring Cisco routers and switches (AAA client) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download CISCO-AAA-CLIENT-MIB

What Is CISCO-AAA-CLIENT-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description