CISCO-LOCAL-AUTH-USER-MIB

All MIBs › CISCO-LOCAL-AUTH-USER-MIB

Organization: Cisco Systems, Inc.

Last Updated: 2013-11-08

Category: Cisco Devices, Device Management, RADIUS and AAA, VPN and Security

Description: Manages local authentication user database entries including credentials and access privileges.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is CISCO-LOCAL-AUTH-USER-MIB?

The CISCO-LOCAL-AUTH-USER-MIB manages the local authentication user database on a Cisco Network Access Server, covering users authenticated directly by the device rather than by an external AAA server. It exposes tables of user accounts and their configuration, including user type, creation time, and lifetime/expiration settings. Administrators use it to monitor the software-level security/configuration status of local accounts, tracking user counts, account creation timestamps, and lifetimes to detect stale or soon-to-expire accounts, as well as receiving notifications on account changes. It is a Cisco-specific local-auth complement to standard AAA mechanisms like RADIUS/TACACS+ rather than a replacement, used as a fallback authentication database. It is typically deployed on Cisco Network Access Server devices, such as routers, switches, or wireless controllers, that need a local user store for telnet/SSH, PPP, or 802.1x network access authentication, with a CISCO-LOCAL-AUTH-USER-MIB download available for administrators to import into their SNMP management software.

IPNetwork Monitor allows you to monitor SNMP objects defined in CISCO-LOCAL-AUTH-USER-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Cisco Network Access Server (router, switch, or wireless controller)

Monitoring Examples

clauUserTable/clauUserEntry list local accounts by clauUserIndex, clauUserName, and clauUserType, while clauUserCreationTime and clauUserLifetime let an admin identify accounts approaching expiration. Comparing clauUserConfigTable's clauUserConfigName/clauUserConfigType against the live clauUserTable helps confirm that provisioned local users match those actually created on the device, flagging any configuration drift or accounts that failed to be created.

What Can Be Monitored

local user account list
account creation time
account lifetime/expiration
user type/access privilege
local-auth user change notifications

Imported Objects

From CISCO-SMI

ciscoMgmt

OBJECT-IDENTITY

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DateAndTime
RowStatus
StorageType
TruthValue

OIDs

OID symbolic	OID numeric	Type	Access	Description
ciscoLocalAuthUserMIB	1.3.6.1.4.1.9.9.798			This MIB module defines objects describing users authenticated locally by a Network Access Server (NAS). +--------+ +--------+ +---------+ \| \| \| \| \| \| \| Client \|\| Server \|\| Network \| \| \| \| (NAS) \| \| \| +--------+ +--------+ +---------+ A client is a telnet or SSH user needing access to the NAS box directly. Network user like PPP or dot1x will request NAS box for authentication to access the network. NAS box authenticates user present in the local user database. GLOSSARY Network Access Server ( NAS ) A single point of access to a remote resource and is exclusively used with Authentication, Authorization and Accounting. Point-to-Point Protocol (PPP) A data link protocol commonly used in establishing a direct connection between two networking nodes.
ciscoLocalAuthUserMIBNotifs	1.3.6.1.4.1.9.9.798.0
NTF clauUserAdded	1.3.6.1.4.1.9.9.798.0.1			This notification indicates when the system has added a user. This notification is deprecated and replaced by clauUserAdded1
NTF clauUserDeleted	1.3.6.1.4.1.9.9.798.0.2			This notification indicates when the system has deleted a user. This notification is deprecated and replaced by clauUserDeleted1
NTF clauUserLoggedIn	1.3.6.1.4.1.9.9.798.0.3			This notification indicates when the user has logged into the system. This notification is deprecated and replaced by clauUserLoggedIn1
NTF clauUserLoggedOut	1.3.6.1.4.1.9.9.798.0.4			This notification indicates when the user has logged out of the system. This notification is deprecated and replaced by clauUserLoggedOut1
NTF clauUserAdded1	1.3.6.1.4.1.9.9.798.0.5			This notification indicates when the system has added a user.
NTF clauUserDeleted1	1.3.6.1.4.1.9.9.798.0.6			This notification indicates when the system has deleted a user or when user lifetime got expired.
NTF clauUserLoggedIn1	1.3.6.1.4.1.9.9.798.0.7			This notification indicates when the user has logged into the system.
NTF clauUserLoggedOut1	1.3.6.1.4.1.9.9.798.0.8			This notification indicates when the user has logged out of the system
ciscoLocalAuthUserMIBObjects	1.3.6.1.4.1.9.9.798.1
T/F clauNotifEnable	1.3.6.1.4.1.9.9.798.1.1	TruthValue	read-write	This object specifies whether the system generates clauUserAdded1, clauUserDeleted1, clauUserLoggedIn1 and clauUserLoggedOut1 notifications.
clauUserTable	1.3.6.1.4.1.9.9.798.1.2		not-accessible	This table lists the currently configured local users. This table is deprecated and replaced by clauUserConfigTable.
clauUserEntry	1.3.6.1.4.1.9.9.798.1.2.1		not-accessible	An entry describes a local user identified by its index. An entry is created or modified when a user is defined with IOS configuration commands via CLI. An entry is removed when a user is undefined with IOS configuration commands via CLI or by automatic expiry of users when lifetime of the user is expired.
U32 clauUserIndex	1.3.6.1.4.1.9.9.798.1.2.1.1	Unsigned32	not-accessible	This object indicates an integer-value that uniquely identifies a local user.
STR clauUserName	1.3.6.1.4.1.9.9.798.1.2.1.2	SnmpAdminString	read-only	A textual string containing the name of the locally authenticated user.
INT clauUserType	1.3.6.1.4.1.9.9.798.1.2.1.3	INTEGER	read-only	This object indicates the type of local user: defaultUser - Default user account type. lobbyUser - Management user with lobby admin privileges, can create and manage guest user account type. managementUser - Management user account type. networkUser - User requires accessing the network. guestUser - Type of networkUser with lifetime configured such that they can stay alive for a given time period and will expire therafter.
DAT clauUserCreationTime	1.3.6.1.4.1.9.9.798.1.2.1.4	DateAndTime	read-only	This object indicates the time the local user was created.
U32 clauUserLifetime	1.3.6.1.4.1.9.9.798.1.2.1.5	Unsigned32	read-only	This object indicates the expiry duration of the local user; that is, the duration the local user is valid from the creation time.
clauUserConfigTable	1.3.6.1.4.1.9.9.798.1.3		not-accessible	This table lists the currently configured local users.
clauUserConfigEntry	1.3.6.1.4.1.9.9.798.1.3.1		not-accessible	An entry describes the configured local user.
OCT clauUserConfigName	1.3.6.1.4.1.9.9.798.1.3.1.1	OCTET STRING	not-accessible	A textual string containing the name of the locally authenticated user.
INT clauUserConfigType	1.3.6.1.4.1.9.9.798.1.3.1.2	INTEGER	read-only	This object indicates the type of local user: defaultUser - Default user account type. lobbyUser - Management user with lobby admin privileges, can create and manage guest user account type. managementUser - Management user account type. networkUser - User requires accessing the network. guestUser - Type of networkUser with lifetime configured such that they can stay alive for a given time period and will expire therafter.
DAT clauUserConfigCreationTime	1.3.6.1.4.1.9.9.798.1.3.1.3	DateAndTime	read-only	This object indicates the time the local user was created.
U32 clauUserConfigLifetime	1.3.6.1.4.1.9.9.798.1.3.1.4	Unsigned32	read-create	This object specifies the expiry duration of the local user; that is, the duration the local user is valid from thes creation time.
STR clauUserConfigPassword	1.3.6.1.4.1.9.9.798.1.3.1.5	SnmpAdminString	read-create	This object specifies the password of the locally authenticated user. When read, this object always returns the value of a non zero-length octet string with asterick value.
STR clauUserConfigDescription	1.3.6.1.4.1.9.9.798.1.3.1.6	SnmpAdminString	read-create	This object specifies the description of the local user.
STO clauUserConfigStorageType	1.3.6.1.4.1.9.9.798.1.3.1.7	StorageType	read-create	The storage type for this conceptual row in the clauUserConfigTable.
ROW clauUserConfigRowStatus	1.3.6.1.4.1.9.9.798.1.3.1.8	RowStatus	read-create	This object reflects the status of the row in this table. It can be used for creating, deleting and modifying the entries in this table.
ciscoLocalAuthUserMIBConform	1.3.6.1.4.1.9.9.798.2
clauMIBCompliances	1.3.6.1.4.1.9.9.798.2.1
clauMIBCompliance	1.3.6.1.4.1.9.9.798.2.1.1			This is a default module-compliance containing default object groups.
clauMIBCompliance1	1.3.6.1.4.1.9.9.798.2.1.2			This is a default module-compliance containing object and notification groups.
clauMIBCompliance2	1.3.6.1.4.1.9.9.798.2.1.3			This is a default module-compliance containing object and notification groups.
clauMIBGroups	1.3.6.1.4.1.9.9.798.2.2
clauMIBMainObjectGroup	1.3.6.1.4.1.9.9.798.2.2.1			This is a cisco Local Authenticated User MIB Main Object group.
clauMIBNotificationGroup	1.3.6.1.4.1.9.9.798.2.2.2			This is a cisco Local Authenticated User MIB Notification group.
clauMIBNotificationGroup1	1.3.6.1.4.1.9.9.798.2.2.3			A collection of notifications about local user login and logout
clauNotifControlGroup	1.3.6.1.4.1.9.9.798.2.2.4			A collection of objects providing for configuration of notification control.
clauUserInfoGroup	1.3.6.1.4.1.9.9.798.2.2.5			A collection of objects providing the local user information.
clauMIBNotificationGroup2	1.3.6.1.4.1.9.9.798.2.2.6			A collection of notifications about local user addition, deletion, login and logout.

RFC description

Cisco vendor-specific MIB for local authentication and user management; manages local user accounts, authentication methods, and password policies on Cisco network devices.

Start monitoring Cisco Network Access Server (router, switch, or wireless controller) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download CISCO-LOCAL-AUTH-USER-MIB

What Is CISCO-LOCAL-AUTH-USER-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description