CISCO-ADMISSION-POLICY-MIB

All MIBs › CISCO-ADMISSION-POLICY-MIB

Organization: Cisco Systems, Inc.

Last Updated: 2008-06-11

Category: Cisco Devices, VPN and Security

Description: Manages network admission policy rules and enforcement on Cisco devices.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is CISCO-ADMISSION-POLICY-MIB?

CISCO-ADMISSION-POLICY-MIB manages network admission-control policies on Cisco devices, tracking hosts as they are admitted to the network along with the QoS and security policies applied to their traffic. It exposes session-level data — total and active admitted-host session counts, per-session IP/MAC address and interface, client feature type, and the policy applied to that session — spanning both statistics and configuration/policy-enforcement categories. It supports software-status monitoring by tracking the health and scale of the admission-control feature itself: capTotalSessions versus capActiveSessions shows whether admitted sessions are accumulating or being properly cleared, and the per-session policy table confirms the correct QoS/security policy is applied to each admitted host, important for detecting misconfigured or stuck admission-control sessions. It is used in conjunction with network admission-control features and implicitly depends on interface indexing conventions from IF-MIB (capSidSessionIfIndex). It is deployed on Cisco switches/routers enforcing per-host network admission control with dynamic QoS or security policy assignment, typically in enterprise access-layer deployments. Engineers can download the CISCO-ADMISSION-POLICY-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in CISCO-ADMISSION-POLICY-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Cisco switch/router with network admission control (NAC-style) enforcement

Monitoring Examples

An operator compares capTotalSessions to capActiveSessions to see whether stale admitted sessions are accumulating rather than being cleaned up. Walking capSidSessionInfoTable by capSidSessionIndex reveals capSidSessionMacAddress, capSidSessionAddress, and capSidSessionIfIndex for a specific admitted host, and cross-referencing capSidSessionPolicyTable confirms which QoS/security policy was actually applied to that host's session — useful for verifying a device that failed posture assessment is under a restrictive policy rather than full access.

What Can Be Monitored

total admitted sessions
active admitted sessions
per-session MAC/IP address
per-session interface
per-session feature/client type
policy applied per admitted session

Imported Objects

From CISCO-SMI

ciscoMgmt

OBJECT-IDENTITY

From IF-MIB

InterfaceIndex

From INET-ADDRESS-MIB

InetAddress
InetAddressType

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Gauge32
Integer32
MODULE-IDENTITY
OBJECT-TYPE

From SNMPv2-TC

MacAddress
TEXTUAL-CONVENTION

How to Use in IPNetwork Monitor

Example using capTotalSessions OID:

Select a Cisco switches/router (network admission control) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type capTotalSessions into the Find box to locate it in the OID tree, then select it and click OK. This object indicates the total numbers of sessions created in the device since the last system reset. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
ciscoAdmissionPolicyMIB	1.3.6.1.4.1.9.9.653			This MIB module defines managed objects that facilitate the management of policies upon host(s) admission to a network. The information available through this MIB includes: o Statistics information such as number of total and active sessions. o Session information such as IP and MAC address of host, client type, and session state. o QoS and Security policy applied to host traffic upon host admission to a network. The following terms are used throughout this MIB: QoS (Quality of Service) is the method which attempts to ensure that the network requirements of different applications can be met by giving preferential forwarding treatment to some traffic. ACL (Access Control List) which contains filters used to identify traffic flows with certain characteristics. Downloadable ACL is a set of filters, configured on the RADIUS server which are downloaded during authorization phase of admission features like dot1x, authProxy, etc. SGT (Security Group Tag) is a unique 16 bits value assigned to every security group and used by network devices to enforce network policies. URL: Universal Resource Locator. URL-Redirect ACL is used for URL redirection feature. Any ingress HTTP from the host that matches the ACL content is subjected to redirection to the URL address specified by the URL-Redirect string. URL redirect string is the URL to which HTTP traffic to the host would be redirected.
ciscoAdmissionPolicyMIBNotifs	1.3.6.1.4.1.9.9.653.0
ciscoAdmissionPolicyMIBObjects	1.3.6.1.4.1.9.9.653.1
capSessions	1.3.6.1.4.1.9.9.653.1.1
C32 capTotalSessionsEx	1.3.6.1.4.1.9.9.653.1.1.1	Counter32	read-only	This object indicates the total numbers of sessions created in the device since the last system reset.
G32 capActiveSessions	1.3.6.1.4.1.9.9.653.1.1.2	Gauge32	read-only	This object indicates the currently active sessions in the device.
capSidSessionInfoTable	1.3.6.1.4.1.9.9.653.1.1.3		not-accessible	This table lists admission policy sessions based on unique session identifier. An entry is created by the agent when an admission policy session has successfully registered to the system. An entry is deleted by the agent upon de-registration of the admission policy session with system.
capSidSessionInfoEntry	1.3.6.1.4.1.9.9.653.1.1.3.1		not-accessible	Each row contains the management information of a particular active session based on unique session identifier.
CAP capSidSessionIndex	1.3.6.1.4.1.9.9.653.1.1.3.1.1	CapSessionId	not-accessible	This object uniquely identifies a session.
NUM capSidSessionIfIndex	1.3.6.1.4.1.9.9.653.1.1.3.1.2	InterfaceIndex	read-only	This object indicates the ifIndex value of the interface on which the session is established.
MAC capSidSessionMacAddress	1.3.6.1.4.1.9.9.653.1.1.3.1.3	MacAddress	read-only	This object indicates the MAC address of the host.
IPt capSidSessionAddressType	1.3.6.1.4.1.9.9.653.1.1.3.1.4	InetAddressType	read-only	This object indicates the type of Internet address assigned for the host.
IP capSidSessionAddress	1.3.6.1.4.1.9.9.653.1.1.3.1.5	InetAddress	read-only	This object indicates the Internet address assigned for the host. The type of this address is determined by the value of capSidSessionAddressType object.
BIT capSidSessionFeatureType	1.3.6.1.4.1.9.9.653.1.1.3.1.6	Bits	read-only	This object indicates the admission features associated with the session. 'dot1x' indicates that the admission feature is 802.1x feature. 'mab' indicates that the admission feature is Mac Authentication Bypass feature. 'eou' indicates that the admission feature is Extensible Authentication Protocol over UDP feature. 'authProxy' indicates that the admission feature is Authentication Proxy feature.
capSidSessionPolicyTable	1.3.6.1.4.1.9.9.653.1.1.4		not-accessible	This table lists the policies that will be enforced per session per admission feature. The session in this table should have a corresponding entry in capSidSessionInfoTable.
capSidSessionPolicyEntry	1.3.6.1.4.1.9.9.653.1.1.4.1		not-accessible	Each row contains the management information of a particular admission feature of a session.
INT capSidSessionPolicyIndex	1.3.6.1.4.1.9.9.653.1.1.4.1.1	INTEGER	not-accessible	This object indicates the admission feature which a host is subjected to in a session. 'dot1x' indicates that the admission feature is 802.1x feature. 'mab' indicates that the admission feature is Mac Authentication Bypass feature. 'eou' indicates that the admission feature is Extensible Authentication Protocol over UDP feature. 'authProxy' indicates that the admission feature is Authentication Proxy feature.
CAP capSidIngressQosPolicy	1.3.6.1.4.1.9.9.653.1.1.4.1.2	CapQosPolicy	read-only	This object indicates the name of an existing QoS policy which will be applied to incoming traffic in this session. An empty string indicates that no such policy is applied.
CAP capSidIngressQosPolicyState	1.3.6.1.4.1.9.9.653.1.1.4.1.3	CapPolicyState	read-only	This object indicates the current state of the QoS policy which will be applied to incoming traffic in this session.
CAP capSidEgressQosPolicy	1.3.6.1.4.1.9.9.653.1.1.4.1.4	CapQosPolicy	read-only	This object indicates the name of an existing QoS policy which will be applied to outgoing traffic in this session. An empty string indicates that no such policy is applied.
CAP capSidEgressQosPolicyState	1.3.6.1.4.1.9.9.653.1.1.4.1.5	CapPolicyState	read-only	This object indicates the current state of the QoS policy which will be applied to outgoing traffic in this session.
CAP capSidDownloadableAclName	1.3.6.1.4.1.9.9.653.1.1.4.1.6	CapAclName	read-only	This object indicates the name of a Downloadable ACL which will be applied to the host traffic. An empty string indicates that no such ACL is applied.
CAP capSidDownloadableAclState	1.3.6.1.4.1.9.9.653.1.1.4.1.7	CapPolicyState	read-only	This object indicates the state of this session downloadable ACL policy.
CAP capSidUrlRedirectAclName	1.3.6.1.4.1.9.9.653.1.1.4.1.8	CapAclName	read-only	This object indicates the ACL name that redirected traffic from the host will be subjected to. An empty string indicates that no such ACL is applied.
CAP capSidUrlRedirectAclState	1.3.6.1.4.1.9.9.653.1.1.4.1.9	CapPolicyState	read-only	This object indicates the state of this session URL-Redirect ACL policy.
STR capSidRedirectUrlString	1.3.6.1.4.1.9.9.653.1.1.4.1.10	CapURLString	read-only	This object indicates the URL that traffic from the host will be redirected to. An empty string indicates that no such URL is applied.
CAP capSidRedirectUrlStringState	1.3.6.1.4.1.9.9.653.1.1.4.1.11	CapPolicyState	read-only	This object indicates the state of this session URL-Redirect string policy.
I32 capSidSecurityGroupTag	1.3.6.1.4.1.9.9.653.1.1.4.1.12	Integer32	read-only	This object indicates the SGT value assigned to the host that initiated this session. Value of -1 indicates that there is no SGT value assigned.
ciscoAdmissionPolicyMIBConformance	1.3.6.1.4.1.9.9.653.2
ciscoAdmissionPolicyMIBCompliances	1.3.6.1.4.1.9.9.653.2.1
ciscoAdmissionPolicyMIBCompliance	1.3.6.1.4.1.9.9.653.2.1.1			The compliance statement for the CISCO-ADMISSION-POLICY-MIB
ciscoAdmissionPolicyMIBGroups	1.3.6.1.4.1.9.9.653.2.2
capSessionStatisticsGroup	1.3.6.1.4.1.9.9.653.2.2.1			A collection of object which provides session statistics information in the device.
capSidSessionInfoGroup	1.3.6.1.4.1.9.9.653.2.2.2			A collection of objects which provides managed information of a session based on unique session identifier.
capSidSessionPolicyGroup	1.3.6.1.4.1.9.9.653.2.2.3			A collection of objects which provides policy information in a session based on unique session identifier.

RFC description

Host admission control MIB providing QoS and security policy management for network access.

Start monitoring Cisco switches/routers (network admission control) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download CISCO-ADMISSION-POLICY-MIB