CISCO-AAA-SESSION-MIB

All MIBs › CISCO-AAA-SESSION-MIB

Organization: Cisco Systems, Inc.

Last Updated: 2006-03-21

Category: Cisco Devices, RADIUS and AAA

Description: Provides data for accounting sessions based on Authentication, Authorization, and Accounting (AAA) protocols such as RADIUS and TACACS+.

IPNetwork Monitor uses several OIDs from this MIB in network discovery and polling the applicable devices. Start monitoring CISCO-AAA-SESSION-MIB with a free 30-day trial of IPNetwork Monitor.

What Is CISCO-AAA-SESSION-MIB?

CISCO-AAA-SESSION-MIB provides visibility into active Authentication, Authorization, and Accounting (AAA) sessions on Cisco devices, covering session data derived from protocols such as RADIUS (RFC 2139) and TACACS+. It exposes an active-sessions table with per-session identifying and status data — session ID, user ID, IP address, idle time, NAS port, and call-tracker ID — plus aggregate counters for total active sessions and a high-water-mark count. While not a classic hardware-environment MIB, it supports software/service status monitoring by revealing whether the AAA session-management subsystem is healthy: casnActiveTableEntries versus casnActiveTableHighWaterMark shows current versus peak session load, casnIdleTime per session can identify stale/hung sessions, and casnDisconnect provides a remote-management action to terminate a session. It is closely tied to standard AAA protocol semantics (RADIUS/TACACS+) referenced directly in its description, though it is a Cisco-proprietary session-tracking table rather than an IETF-standard MIB. It is deployed on Cisco access servers, VPN concentrators, or edge routers authenticating and accounting for many simultaneous user sessions. Engineers can download the CISCO-AAA-SESSION-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in CISCO-AAA-SESSION-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Cisco access server / VPN concentrator / edge router running AAA (RADIUS/TACACS+)

Monitoring Examples

An operator polls casnActiveTableEntries against casnActiveTableHighWaterMark to see whether current AAA session load is approaching the highest level ever recorded, a sign of a capacity issue. Walking casnActiveTable/casnActiveEntry by casnSessionId lets an admin inspect a specific session's casnUserId, casnIpAddr, and casnIdleTime to spot an unusually long-idle session, and then set casnDisconnect on that entry to force-terminate it; casnNasPort and casnCallTrackerId help correlate the session back to the originating dial-in or VPN port.

What Can Be Monitored

current active AAA session count
high-water-mark of active sessions
per-session idle time
per-session user ID and IP address
NAS port and call-tracker correlation
remote session disconnect action

Imported Objects

From CISCO-SMI

ciscoMgmt

OBJECT-IDENTITY

From IF-MIB

InterfaceIndexOrZero

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Gauge32
IpAddress
MODULE-IDENTITY
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DisplayString
RowPointer
TEXTUAL-CONVENTION
TruthValue

How to Use in IPNetwork Monitor

Example using casnTotalSessions OID:

Select a Cisco access server/VPN concentrator/router (AAA sessions) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type casnTotalSessions into the Find box to locate it in the OID tree, then select it and click OK. It reports the total number of sessions since last system re-initialization. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
ciscoAAASessionMIB	1.3.6.1.4.1.9.9.150			This MIB module provides data for accounting sessions based on Authentication, Authorization, Accounting (AAA) protocols. References: RFC 2139 RADIUS Accounting The TACACS+ Protocol Version 1.78, Internet Draft
casnMIBObjects	1.3.6.1.4.1.9.9.150.1
casnActive	1.3.6.1.4.1.9.9.150.1.1
G32 casnActiveTableEntries	1.3.6.1.4.1.9.9.150.1.1.1	Gauge32	read-only	Number of entries currently in casnActiveTable
G32 casnActiveTableHighWaterMark	1.3.6.1.4.1.9.9.150.1.1.2	Gauge32	read-only	Maximum number of entries present in casnActiveTable since last system re-initialization. This corresponds to the maximum value reported by casnActiveTableEntries.
casnActiveTable	1.3.6.1.4.1.9.9.150.1.1.3		not-accessible	This table contains entries for active AAA accounting sessions in the system.
casnActiveEntry	1.3.6.1.4.1.9.9.150.1.1.3.1		not-accessible	The information regarding a single accounting session. Entries are created when a new accounting session is begun. Entries are removed when the accounting session is ended. Initiating termination of a session with the object casnDisconnect will cause removal of the entry when the session completes termination.
CAS casnSessionId	1.3.6.1.4.1.9.9.150.1.1.3.1.1	CasnSessionId	not-accessible	This is the session identification used by the accounting protocol. This value is unique to a session within the system, even if multiple accounting protocols are in use. The value of this object corresponds to these accounting protocol attributes. RADIUS: attribute 44, Acct-Session-Id TACACS+: attribute 'task_id'
STR casnUserId	1.3.6.1.4.1.9.9.150.1.1.3.1.2	DisplayString	read-only	The User login ID or zero length string if unavailable. The value of this object corresponds to these accounting protocol attributes. RADIUS: attribute 1, User-Name TACACS+: attribute 'user'
IP casnIpAddr	1.3.6.1.4.1.9.9.150.1.1.3.1.3	IpAddress	read-only	The IP address of the session or 0.0.0.0 if not applicable or unavailable. RADIUS: attribute 8, Framed-IP-Address TACACS+: attribute 'addr'
G32 casnIdleTime	1.3.6.1.4.1.9.9.150.1.1.3.1.4	Gauge32	read-only	The elapsed time that this session has been idle. This is the time since the last user-level data has been received or transmitted. Protocol level handshaking associated with the call is considered to be idle for this object.
T/F casnDisconnect	1.3.6.1.4.1.9.9.150.1.1.3.1.5	TruthValue	read-write	This object is used to terminate this session. Setting the value to true(1) will initiate termination of this session. The entry will be removed once the session has completed termination. Once this object has been set to true(1), the session termination process can not be cancelled by setting the value false(2).
CCT casnCallTrackerId	1.3.6.1.4.1.9.9.150.1.1.3.1.6	CctCallId	read-only	The value of this object is the entry index in the CISCO-CALL-TRACKER-MIB cctActiveTable of the call corresponding to this accounting session. Using the value of this object to query the cctActiveTable will provide more detailed data regarding the session represented by this casnActiveEntry.
NUM casnNasPort	1.3.6.1.4.1.9.9.150.1.1.3.1.7	RowPointer	read-only	The value of this object identifies a particular conceptual row associated with the session identified by casnSessionId. The conceptual row that this object points to represents a port that is used to transport a session. If the port transporting the session cannot be determined, the value of this object will be zeroDotZero. For example, suppose a session is established using an ATM PVC. If the ifIndex of the ATM interface is 7, and the VPI/VCI values of the PVC are 1, 100 respectively, then the value of this object might be as follows: casnNasPort.15 = atmVclAdminStatus.7.1.100 ^ ^ ^ ^ \| \| \| \| casnSessionId --+ \| \| \| ifIndex -------------------------+ \| \| atmVclVpi ---------------------------+ \| atmVclVci ------------------------------+ where atmVclAdminStatus is the first accessible object of the atmVclTable of the ATM-MIB.
NUM casnVaiIfIndex	1.3.6.1.4.1.9.9.150.1.1.3.1.8	InterfaceIndexOrZero	read-only	The ifIndex of the Virtual Access Interface (VAI) that is associated with the PPP session. This interface may not be represented in the IF-MIB in which case the value of this object will be zero.
casnGeneral	1.3.6.1.4.1.9.9.150.1.2
C32 casnTotalSessionsEx	1.3.6.1.4.1.9.9.150.1.2.1	Counter32	read-only	Total number of sessions since last system re-initialization. This value includes all sessions currently in the casnActiveTable and all previous sessions whether terminated via casnDisconnect or via other mechanisms.
C32 casnDisconnectedSessions	1.3.6.1.4.1.9.9.150.1.2.2	Counter32	read-only	Total number of sessions which have been disconnected using casnDisconnect since last system re-initialization. This value includes any sessions still in the casnActiveTable with a casnDisconnect value of true(1) and all previous sessions which terminated as a result of setting casnDisconnect.
casnMIBNotificationPrefix	1.3.6.1.4.1.9.9.150.2
casnMIBNotifications	1.3.6.1.4.1.9.9.150.2.1
casnMIBConformance	1.3.6.1.4.1.9.9.150.3
casnMIBCompliances	1.3.6.1.4.1.9.9.150.3.1
casnMIBCompliance	1.3.6.1.4.1.9.9.150.3.1.1			The compliance statement for entities which implement the CISCO AAA Session MIB
casnMIBComplianceRev1	1.3.6.1.4.1.9.9.150.3.1.2			The compliance statement for entities which implement the CISCO AAA Session MIB
casnMIBGroups	1.3.6.1.4.1.9.9.150.3.2
casnActiveGroup	1.3.6.1.4.1.9.9.150.3.2.1			A collection of objects providing the AAA session information.
casnGeneralGroup	1.3.6.1.4.1.9.9.150.3.2.2			A collection of objects providing the AAA session information.
casnActiveGroupSup1	1.3.6.1.4.1.9.9.150.3.2.3			A collection of objects that supplements the casnActiveGroup.

RFC description

Tracks AAA (Authentication, Authorization, Accounting) session information on Cisco devices.

Start monitoring Cisco access server/VPN concentrator/router (AAA sessions) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download CISCO-AAA-SESSION-MIB