All MIBs › CISCO-LWAPP-AAA-MIB
Organization: Cisco Systems Inc.
Last Updated: 2017-03-17
Category: Cisco Devices, RADIUS and AAA, Wireless and WLAN
Description: Manages AAA (Authentication, Authorization, Accounting) configuration for LWAPP-based wireless LAN controllers.
Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.
What Is CISCO-LWAPP-AAA-MIB?
The CISCO-LWAPP-AAA-MIB is a Cisco private module implemented on Wireless LAN Controllers (WLCs) acting as Central Controllers that terminate the Lightweight Access Point Protocol (LWAPP) tunnel from Cisco lightweight access points. It manages Authentication, Authorization, and Accounting (AAA) configuration on the controller, exposing tables for AAA method priority ordering and for configured TACACS+ server entries, including server type, priority, address, port, and enabled state. Its monitoring/management value is software-configuration oriented: administrators use it to verify AAA method precedence (e.g., local vs. RADIUS vs. TACACS+) and to confirm each configured TACACS+ server is correctly addressed, reachable on the right port, and enabled, catching misconfigurations that would otherwise cause authentication failures for admin or client access. It is part of the broader CISCO-LWAPP-* MIB family and depends on the underlying LWAPP tunnel/controller architecture shared with other Cisco lightweight-AP MIBs. It is deployed on Cisco Wireless LAN Controllers (e.g., 2100/4400/5500/WiSM series and successors), where CISCO-LWAPP-AAA-MIB SNMP monitoring supports AAA configuration checks across fleets of lightweight access points in enterprise Wi-Fi networks.
IPNetwork Monitor allows you to monitor SNMP objects defined in CISCO-LWAPP-AAA-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.
Supported Devices
- Cisco Wireless LAN Controllers (LWAPP-based)
Monitoring Examples
An administrator would check claPriorityTable/claPriorityEntry to confirm the claPriorityOrder in which claPriorityAuth methods (such as TACACS+ vs. local) are attempted, and poll claTacacsServerTable/claTacacsServerEntry for claTacacsServerAddress, claTacacsServerPortNum, and claTacacsServerEnabled to verify each AAA server is correctly configured. If claTacacsServerEnabled is set but the server is unreachable, admin logins to the WLC could silently fail over to a lower-priority method, which this table helps diagnose. ciscoLwappAAAMIBNotifs would alert on AAA-related configuration or state-change events.
What Can Be Monitored
- AAA method priority order
- TACACS+ server configuration (address, port, priority)
- TACACS+ server enabled state
- AAA notification events
This MIB depends on
Related MIBs
Imported Objects
From CISCO-LWAPP-TC-MIB
| CLSecKeyFormat |
From CISCO-LWAPP-WLAN-MIB
| cLWlanIndex | OBJECT-TYPE |
From CISCO-SMI
| ciscoMgmt | OBJECT-IDENTITY |
From CISCO-TC
| CiscoURLString |
From INET-ADDRESS-MIB
| InetAddress | |
| InetAddressType | |
| InetPortNumber |
From SNMP-FRAMEWORK-MIB
| SnmpAdminString |
From SNMPv2-CONF
| MODULE-COMPLIANCE | |
| NOTIFICATION-GROUP | |
| OBJECT-GROUP |
From SNMPv2-SMI
| Counter32 | |
| Gauge32 | |
| Integer32 | |
| MODULE-IDENTITY | |
| NOTIFICATION-TYPE | |
| OBJECT-TYPE | |
| Unsigned32 |
From SNMPv2-TC
| MacAddress | |
| RowStatus | |
| StorageType | |
| TimeInterval | |
| TruthValue |
How to Use in IPNetwork Monitor
Example using claRadiusAuthClientAccessRequestsTotal OID:
Select a Cisco Wireless LAN Controller (LWAPP-based) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type claRadiusAuthClientAccessRequestsTotal into the Find box to locate it in the OID tree, then select it and click OK. This object indicates the number of RADIUS Access-Request packets sent by the controller. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.
OIDs
| OID symbolic | OID numeric | Type | Access | Description |
|---|---|---|---|---|
| ciscoLwappAAAMIB | 1.3.6.1.4.1.9.9.598 | This MIB is intended to be implemented on all those devices operating as Central Controllers (CC), that terminate the Light Weight Access Point Protocol tunnel from Cisco Light-weight LWAPP Access Points. Information provided by this MIB is used to manage AAA information on the controller. The relationship between CC and the LWAPP APs can be depicted as follows: +......+ +......+ +......+ + + + + + + + CC + + CC + + CC + + + + + + + +......+ +......+ +......+ .. . . .. . . . . . . . . . . . . . . . . . . +......+ +......+ +......+ +......+ + + + + + + + + + AP + + AP + + AP + + AP + + + + + + + + + +......+ +......+ +......+ +......+ . . . . . . . . . . . . . . . . . . . +......+ +......+ +......+ +......+ + + + + + + + + + MN + + MN + + MN + + MN + + + + + + + + + +......+ +......+ +......+ +......+ The LWAPP tunnel exists between the controller and the APs. The MNs communicate with the APs through the protocol defined by the 802.11 standard. LWAPP APs, upon bootup, discover and join one of the controllers and the controller pushes the configuration, that includes the WLAN parameters, to the LWAPP APs. The APs then encapsulate all the 802.11 frames from wireless clients inside LWAPP frames and forward the LWAPP frames to the controller. GLOSSARY Access Point ( AP ) An entity that contains an 802.11 medium access control ( MAC ) and physical layer ( PHY ) interface and provides access to the distribution services via the wireless medium for associated clients. LWAPP APs encapsulate all the 802.11 frames in LWAPP frames and sends them to the controller to which it is logically connected. Light Weight Access Point Protocol ( LWAPP ) This is a generic protocol that defines the communication between the Access Points and the Central Controller. Mobile Node ( MN ) A roaming 802.11 wireless device in a wireless network associated with an access point. Mobile Node and client are used interchangeably. Terminal Access Controller Access-Control System ( TACACS ) A remote authentication protocol that is used to communicate with an authentication server. TACACS allows a remote access server to communicate with an authentication server in order to determine if the user has access to the network. Remote Authentication Dial In User Service (RADIUS) It is an AAA (authentication, authorization and accounting) protocol for applications such as network access or IP mobility. It is intended to work in both local and roaming situations. Wireless LAN ( WLAN ) It is a wireless local area network, which is the linking of two or more computers without using wires. It uses radio communication to accomplish the same functionality of a wired LAN. PAP - Password Authentication Protocol CHAP - Challenge Handshake Authentication Protocol MD5-CHAP - Message Digest 5 Challenge Handshake Authentication Protocol LSC - Local Significant Certificate LSC can be used if we want our own public key infrastructure (PKI) to provide better security, to have control of our certificate authority (CA), and to define policies, restrictions, and usages on the generated certificates. REFERENCE [1] Wireless LAN Medium Access Control ( MAC ) and Physical Layer ( PHY ) Specifications [2] Draft-obara-capwap-lwapp-00.txt, IETF Light Weight Access Point Protocol | ||
| ciscoLwappAAAMIBNotifs | 1.3.6.1.4.1.9.9.598.0 | |||
| NTF ciscoLwappAAARadiusServerGlobalActivated | 1.3.6.1.4.1.9.9.598.0.1 | This notification is sent by the agent when the controller detects that the RADIUS server is activated in the global list. The RADIUS server is identified by the address (claRadiusAddress) and port number (claRadiusPortNum). | ||
| NTF ciscoLwappAAARadiusServerGlobalDeactivated | 1.3.6.1.4.1.9.9.598.0.2 | This notification is sent by the agent when the controller detects that the RADIUS server is deactivated in the global list. The RADIUS server is identified by the address (claRadiusAddress) and port number (claRadiusPortNum). | ||
| NTF ciscoLwappAAARadiusServerWlanActivated | 1.3.6.1.4.1.9.9.598.0.3 | This notification is sent by the agent when the controller detects that the RADIUS server is activated on the WLAN. The RADIUS server is identified by the address (claRadiusAddress) and port number (claRadiusPortNum). | ||
| NTF ciscoLwappAAARadiusServerWlanDeactivated | 1.3.6.1.4.1.9.9.598.0.4 | This notification is sent by the agent when the controller detects that the RADIUS server is deactivated on the WLAN. The RADIUS server is identified by the address (claRadiusAddress) and port number (claRadiusPortNum). | ||
| NTF ciscoLwappAAARadiusReqTimedOut | 1.3.6.1.4.1.9.9.598.0.5 | This notification is sent by the agent when the controller detects that the RADIUS server failed to respond to request from a client/user. The RADIUS server is identified by the address (claRadiusAddress) and port number (claRadiusPortNum). | ||
| NTF ciscoLwappAAARadiusAuthServerAvailable | 1.3.6.1.4.1.9.9.598.0.6 | This notification is sent by the agent when the controller detects that the RADIUS authenticating server is available/responsive when it was previously unavailable/unresponsive. The state change triggers this notification. The RADIUS server is identified by the address (claRadiusAddress) and port number (claRadiusPortNum). | ||
| NTF ciscoLwappAAARadiusAuthServerUnavailable | 1.3.6.1.4.1.9.9.598.0.7 | This notification is sent by the agent when the controller detects that the RADIUS authenticating server is unavailable/unresponsive when it was previously available/responsive. The state change triggers this notification. The RADIUS server is identified by the address (claRadiusAddress) and port number (claRadiusPortNum). | ||
| NTF ciscoLwappAAARadiusAcctServerAvailable | 1.3.6.1.4.1.9.9.598.0.8 | This notification is sent by the agent when the controller detects that the RADIUS accounting server is available/responsive when it was previously unavailable/unresponsive. The state change triggers this notification. The RADIUS server is identified by the address (claRadiusAddress) and port number (claRadiusPortNum). | ||
| NTF ciscoLwappAAARadiusAcctServerUnavailable | 1.3.6.1.4.1.9.9.598.0.9 | This notification is sent by the agent when the controller detects that the RADIUS accounting server is unavailable/unresponsive when it was previously available/responsive. The state change triggers this notification. The RADIUS server is identified by the address (claRadiusAddress) and port number (claRadiusPortNum). | ||
| ciscoLwappAAAMIBObjects | 1.3.6.1.4.1.9.9.598.1 | |||
| claConfigObjects | 1.3.6.1.4.1.9.9.598.1.1 | |||
| claPriorityTable | 1.3.6.1.4.1.9.9.598.1.1.1 | not-accessible | This table contains entries for AAA authentication methods configured in the controller. At startup, all the entries in this table are set up by the central controller. A management application can later change the priority order using the claPriorityOrder. | |
| claPriorityEntry | 1.3.6.1.4.1.9.9.598.1.1.1.1 | not-accessible | A conceptual row in claPriorityTable. There is an entry in this table for each AAA authentication method available at the agent, as identified by a value of claPriorityAuth. | |
| INT claPriorityAuth | 1.3.6.1.4.1.9.9.598.1.1.1.1.1 | INTEGER | not-accessible | This object represents the authentication method used to authenticate users. local - indicates that local password is used for authentication. radius - indicates that RADIUS method is used for authentication. tacacsplus - indicates that TACACS method is used for authentication. |
| U32 claPriorityOrder | 1.3.6.1.4.1.9.9.598.1.1.1.1.2 | Unsigned32 | read-write | This object specifies the priority order of an authentication method to be used in user authentication for a session. At start up, the agent assigns the value of this object. Later this can be changed by the management station. This object reflects the relative priority of the authentication method denoted by claPriorityAuth with respect to already configured authentication methods. The zero value indicates that the priority is not set and that the authentication methods are applied in ascending order. Each object must contain a unique value for claPriorityOrder or zero. In the case when a priority is set for a value that is already used by existing object the existing object's claPriorityOrder with be swapped. When priority is set to 0 for an auth method the priority of the existing methods with lower priority will be pushed up |
| claTacacsServerTable | 1.3.6.1.4.1.9.9.598.1.1.2 | not-accessible | This table represents the information about configuring the Accounting, Authentication and Authorization servers. The creation of a new row in claTacacsServerTable is through an explicit network management action results in creation of an entry in this table. Similarly, deletion of a row in claTacacsServerTable through user action causes the deletion of corresponding row in this table. The claTacacsServerType defines the server type being used and the claTacacsServerPriority defines the priority the server accessed within a given type. | |
| claTacacsServerEntry | 1.3.6.1.4.1.9.9.598.1.1.2.1 | not-accessible | Each entry in this table provides information about the server that is configured for AAA. Each entry is uniquely identified by the server type and priority that server is accessed. | |
| INT claTacacsServerType | 1.3.6.1.4.1.9.9.598.1.1.2.1.1 | INTEGER | not-accessible | This attribute identifies the type of the server being configured. |
| U32 claTacacsServerPriority | 1.3.6.1.4.1.9.9.598.1.1.2.1.2 | Unsigned32 | not-accessible | The priority value for this entry. This value determines the unique priority for this entry. The priority value for this entry determines the order in which the server configured in this entry is accessed. The lower the number, the higher the priority. For example if there are 2 entries with priority 1 and 2 respectively, the controller will try the server with priority 1 before it tries the server with priority 2. |
| IPt claTacacsServerAddressType | 1.3.6.1.4.1.9.9.598.1.1.2.1.3 | InetAddressType | read-create | This object specifies the type of the network address made available through claTacacsServerAddress. This object must be set to a valid value before setting the row to 'active'. |
| IP claTacacsServerAddress | 1.3.6.1.4.1.9.9.598.1.1.2.1.4 | InetAddress | read-create | This object specifies the address of the AAA server. The type of the address stored in this object is determined by the claTacacsServerAddressType object. This object must be set to a valid value before setting the row to 'active'. |
| INE claTacacsServerPortNum | 1.3.6.1.4.1.9.9.598.1.1.2.1.5 | InetPortNumber | read-create | This object specifies the port number for this server. It must be set to a valid value before setting the row to 'active'. |
| T/F claTacacsServerEnabled | 1.3.6.1.4.1.9.9.598.1.1.2.1.6 | TruthValue | read-create | This object specifies the server state. A value of 'true' indicates that the server state is enabled. A value of 'false' indicates that the server state is disabled. |
| CLS claTacacsServerSecretType | 1.3.6.1.4.1.9.9.598.1.1.2.1.7 | CLSecKeyFormat | read-create | This object specifies the server secret type. The claTacacsServerSecret value is set based on this type. When reading this object, the value 'default' is always returned. This object must be set to a valid value before setting the row to 'active'. |
| STR claTacacsServerSecret | 1.3.6.1.4.1.9.9.598.1.1.2.1.8 | SnmpAdminString | read-create | This object specifies the key configured for this server. For get operation this always returns a string with asterisks. This object must be set to a valid value before setting the row to 'active'. This object can be modified when a row is in the 'active' state. |
| U32 claTacacsServerTimeout | 1.3.6.1.4.1.9.9.598.1.1.2.1.9 | Unsigned32 | read-create | This object specifies the number of seconds between retransmissions. This object can be modified when a row is in the 'active' state. |
| STO claTacacsServerStorageType | 1.3.6.1.4.1.9.9.598.1.1.2.1.10 | StorageType | read-create | This object specifies the storage type for this conceptual row. Conceptual rows having the value 'permanent' need not allow write-access to any columnar objects in the row. |
| ROW claTacacsServerRowStatus | 1.3.6.1.4.1.9.9.598.1.1.2.1.11 | RowStatus | read-create | This object specifies to add or delete an entry in this table. The required parameters for this entry are claTacacsServerAddress, claTacacsServerAddressType, claTacacsServerPortNum, claTacacsServerSecret and claTacacsServerSecretType should be provided. When a row is in 'active' state, some objects in this table can be modified as described in each individual object's description. |
| claWlanTable | 1.3.6.1.4.1.9.9.598.1.1.3 | not-accessible | AAA table corresponding to a WLAN. When WLAN is added a new entry gets added to this table. The entry is removed when the WLAN is removed. | |
| claWlanEntry | 1.3.6.1.4.1.9.9.598.1.1.3.1 | not-accessible | Each entry in this table provides AAA information for a WLAN. | |
| T/F claWlanAcctServerEnabled | 1.3.6.1.4.1.9.9.598.1.1.3.1.1 | TruthValue | read-write | This object specifies the status to indicate whether the account server is enabled(true) or disabled(false) for this WLAN. A value of 'true' indicates that the server is enabled. A value of 'false' indicates that the server is disabled. |
| T/F claWlanAuthServerEnabled | 1.3.6.1.4.1.9.9.598.1.1.3.1.2 | TruthValue | read-write | This object specifies the status whether the authentication server is enabled(true) or disabled(false) for this WLAN. A value of 'true' indicates that the server is enabled. A value of 'false' indicates that the server is disabled. |
| T/F claWlanOverwriteInterface | 1.3.6.1.4.1.9.9.598.1.1.3.1.3 | TruthValue | read-write | This object specifies the status whether dynamic interface is enabled(true) or disabled(false) for this WLAN. A value of 'true' indicates that the dynamic interface is enabled. A value of 'false' indicates that the dynamic interface is disabled. |
| T/F claWlanInterimUpdate | 1.3.6.1.4.1.9.9.598.1.1.3.1.4 | TruthValue | read-write | This object specifies the status whether the interim update is enabled(true) or disabled(false) for this WLAN. A value of 'true' indicates that the interim update is enabled. A value of 'false' indicates that the interim update is disabled. |
| NUM claWlanInterimUpdateInterval | 1.3.6.1.4.1.9.9.598.1.1.3.1.5 | TimeInterval | read-write | This object specifies the interim update interval configuration. |
| T/F claRadiusServerGlobalActivatedEnabled | 1.3.6.1.4.1.9.9.598.1.1.4 | TruthValue | read-write | The object specifies to control the generation of ciscoLwappAAARadiusServerGlobalActivated notification. A value of 'true' indicates that the agent generates ciscoLwappAAARadiusServerGlobalActivated notification. A value of 'false' indicates that the agent doesn't generate ciscoLwappAAARadiusServerGlobalActivated notification. |
| T/F claRadiusServerGlobalDeactivatedEnabled | 1.3.6.1.4.1.9.9.598.1.1.5 | TruthValue | read-write | The object specifies to control the generation of ciscoLwappAAARadiusServerGlobalDeactivated notification. A value of 'true' indicates that the agent generates ciscoLwappAAARadiusServerGlobalDeactivated notification. A value of 'false' indicates that the agent doesn't generate ciscoLwappAAARadiusServerGlobalDeactivated notification. |
| T/F claRadiusServerWlanActivatedEnabled | 1.3.6.1.4.1.9.9.598.1.1.6 | TruthValue | read-write | The object specifies to control the generation of ciscoLwappAAARadiusServerWlanActivated notification. A value of 'true' indicates that the agent generates ciscoLwappAAARadiusServerWlanActivated notification. A value of 'false' indicates that the agent doesn't generate ciscoLwappAAARadiusServerWlanActivated notification. |
| T/F claRadiusServerWlanDeactivatedEnabled | 1.3.6.1.4.1.9.9.598.1.1.7 | TruthValue | read-write | The object specifies to control the generation of ciscoLwappAAARadiusServerWlanDeactivated notification. A value of 'true' indicates that the agent generates ciscoLwappAAARadiusServerWlanDeactivated notification. A value of 'false' indicates that the agent doesn't generate ciscoLwappAAARadiusServerWlanDeactivated notification. |
| T/F claRadiusReqTimedOutEnabled | 1.3.6.1.4.1.9.9.598.1.1.8 | TruthValue | read-write | The object specifies to control the generation of ciscoLwappAAARadiusReqTimedOut notification. A value of 'true' indicates that the agent generates ciscoLwappAAARadiusReqTimedOut notification. A value of 'false' indicates that the agent doesn't generate ciscoLwappAAARadiusReqTimedOut notification. |
| T/F claSaveUserData | 1.3.6.1.4.1.9.9.598.1.1.9 | TruthValue | read-write | This object specifies to save the guest user config to NVRAM. A value of 'true' indicates that the data is saved. A value of 'false' indicates the data is not saved. |
| INT claWebRadiusAuthentication | 1.3.6.1.4.1.9.9.598.1.1.10 | INTEGER | read-write | This object specifies to configure the Web RADIUS Authentication parameters on the WLC. PAP (1) - Configure Web RADIUS Authentication in PAP mode. CHAP (2) - Configure Web RADIUS Authentication in CHAP mode. MD5-CHAP (3) - Configure Web RADIUS Authentication in MD5-CHAP mode. |
| INT claRadiusFallbackMode | 1.3.6.1.4.1.9.9.598.1.1.11 | INTEGER | read-write | This object specifies to configure the RADIUS Fallback Test mode on the WLC. Following are the configurable options:- off (1) - Disables RADIUS server fallback test. passive (2) - Sets server status based on last transaction. active (3) - Sends probes to dead servers to test status. |
| STR claRadiusFallbackUsername | 1.3.6.1.4.1.9.9.598.1.1.12 | SnmpAdminString | read-write | This object specifies to configure the RADIUS Fallback Test. username to be sent in dead server probes |
| NUM claRadiusFallbackInterval | 1.3.6.1.4.1.9.9.598.1.1.13 | TimeInterval | read-write | This object specifies to configure the probe interval (when claRadiusFallbackMode is in active mode) or inactive time (when claRadiusFallbackMode is in passive mode) |
| INT claRadiusAuthMacDelimiter | 1.3.6.1.4.1.9.9.598.1.1.14 | INTEGER | read-write | This object specifies the delimiter to be used for RADIUS authentication servers. The possible values allowed are - no delimiter (0) - as in xxxxxxxxxxxx. colon (1) - as in xx:xx:xx:xx:xx:xx. hyphen (2) - as in xx-xx-xx-xx-xx-xx. single hyphen (3) - as in xxxxxx-xxxxxx. |
| INT claRadiusAcctMacDelimiter | 1.3.6.1.4.1.9.9.598.1.1.15 | INTEGER | read-write | This object specifies the delimiter to be used for RADIUS accounting servers. The possible values allowed are - no delimiter (0) - as in xxxxxxxxxxxx. colon (1) - as in xx:xx:xx:xx:xx:xx. hyphen (2) - as in xx-xx-xx-xx-xx-xx. single hyphen (3) - as in xxxxxx-xxxxxx. |
| T/F claAcceptMICertificate | 1.3.6.1.4.1.9.9.598.1.1.16 | TruthValue | read-write | This object specifies if controller will accept Manufactured Installed Certificate from the access points as part of authorization. A value of 'true' indicates that the controller will accept the certificate. A value of 'false' indicates that the controller will not accept the certificate. |
| T/F claAcceptLSCertificate | 1.3.6.1.4.1.9.9.598.1.1.17 | TruthValue | read-write | This object specifies if controller will accept Local Significant Certificate from access points as part of authorization. A value of 'true' indicates that the controller will accept the certificate. A value of 'false' indicates that the controller will not accept the certificate. |
| T/F claAllowAuthorizeLscApAgainstAAA | 1.3.6.1.4.1.9.9.598.1.1.18 | TruthValue | read-write | This object specifies if access points to be authorized using a AAA RADIUS server or local database. A value of 'true' indicates that the access points would be authorized using a AAA RADIUS. A value of 'false' indicates that the access points would be authorized using a local database. |
| T/F claSscHashValidationEnabled | 1.3.6.1.4.1.9.9.598.1.1.19 | TruthValue | read-write | This object specifies if the SSC Hash Validation is configured on the controller. If true, then SSC Hash Validation is enabled. If false, then SSC Hash validation is disabled. |
| STR claSscCertificateSubject | 1.3.6.1.4.1.9.9.598.1.1.20 | SnmpAdminString | read-only | This object indicates the SSC Certificate subject value of the controller. |
| STR claSscCertificateValidity | 1.3.6.1.4.1.9.9.598.1.1.21 | SnmpAdminString | read-only | This object indicates the SSC Certificate validity value of the controller. |
| STR claSscCertificateHashKey | 1.3.6.1.4.1.9.9.598.1.1.22 | SnmpAdminString | read-only | This object indicates the SSC Certificate hash key value of the controller. |
| claRadiusAuthServerTable | 1.3.6.1.4.1.9.9.598.1.1.23 | not-accessible | This table represents the conceptual listing the RADIUS authentication servers with which the client shares a secret. | |
| claRadiusAuthServerEntry | 1.3.6.1.4.1.9.9.598.1.1.23.1 | not-accessible | An entry is a conceptual row representing a RADIUS authentication server with which the client shares a secret. | |
| I32 claRadiusAuthServerIndex | 1.3.6.1.4.1.9.9.598.1.1.23.1.1 | Integer32 | read-create | This object specifies a number uniquely identifying each RADIUS authentication server with which this client communicates. |
| INT claRadiusAuthServerIPSecAuthMethod | 1.3.6.1.4.1.9.9.598.1.1.23.1.2 | INTEGER | read-create | This object specifies IPSec authentication method over RADIUS. The value of 'psk' indicates that the authentication is through PSK method. The value of 'cert' indicates that the authentication is through certificate method. |
| OCT claRadiusAuthServerKey | 1.3.6.1.4.1.9.9.598.1.1.23.1.3 | OCTET STRING | read-create | This object specifies the authentication and encryption key shared between the Radius client and this Radius Server. When the claRadiusAuthServerKeyFormat is hex it can have max length of 128 bytes. If the claRadiusAuthServerKeyFormat is Ascii it can have max length of 64 bytes. |
| INT claRadiusAuthServerKeyFormat | 1.3.6.1.4.1.9.9.598.1.1.23.1.4 | INTEGER | read-create | This object specifies the format of the server key. When hex, the number of characters in the key should be even. The value of 'hex' indicates that the format is in hex format. The value of 'cert' indicates that the format is in ascii format. |
| INT claRadiusAuthServerIsActive | 1.3.6.1.4.1.9.9.598.1.1.23.1.5 | INTEGER | read-only | This object indicates the status of the RADIUS authentication server. The value of 'disable' indicates that the status is disabled. The value of 'enable' indicates that the status is enabled. |
| T/F claRadiusAuthServerTunnelProxy | 1.3.6.1.4.1.9.9.598.1.1.23.1.6 | TruthValue | read-create | This object specifies active RADIUS authentication server's tunnel proxy. A value of 'true' indicates that the tunnel proxy is enabled. A value of 'false' indicates that the tunnel proxy is disabled. |
| T/F claRadiusAuthServerPacState | 1.3.6.1.4.1.9.9.598.1.1.23.1.7 | TruthValue | read-create | This object specifies active RADIUS authentication server's PAC (Protected Access Control) state. A value of 'true' indicates that the server PAC state is enabled. A value of 'false' indicates that the server PAC state is disabled. |
| claRadiusAccServerTable | 1.3.6.1.4.1.9.9.598.1.1.24 | not-accessible | This table represents the conceptual table listing the RADIUS accounting servers with which the client shares a secret. | |
| claRadiusAccServerEntry | 1.3.6.1.4.1.9.9.598.1.1.24.1 | not-accessible | An entry is a conceptual row representing a RADIUS accounting server with which the client shares a secret. | |
| I32 claRadiusAccServerIndex | 1.3.6.1.4.1.9.9.598.1.1.24.1.1 | Integer32 | read-create | This object specifies a number uniquely identifying each RADIUS accounting server with which this client communicates. |
| INT claRadiusAccServerIPSecAuthMethod | 1.3.6.1.4.1.9.9.598.1.1.24.1.2 | INTEGER | read-create | This object specifies IPSec Authentication method over RADIUS. The value of 'psk' indicates that the authentication is through PSK method. The value of 'cert' indicates that the authentication is through certificate method. |
| OCT claRadiusAccServerKey | 1.3.6.1.4.1.9.9.598.1.1.24.1.3 | OCTET STRING | read-create | This object specifies the accounting and encryption key shared between the RADIUS client and this RADIUS Server. When the claRadiusAccServerKeyFormat is hex it can have max length of 128 bytes. If the claRadiusAccServerKeyFormat is Ascii it can have max length of 64 bytes. |
| INT claRadiusAccServerKeyFormat | 1.3.6.1.4.1.9.9.598.1.1.24.1.4 | INTEGER | read-create | This object specifies the format of the server key. When hex, the number of characters in the key should be even. The value of 'hex' indicates that the format is in hex format. The value of 'cert' indicates that the format is in ascii format. |
| INT claRadiusAccServerIsActive | 1.3.6.1.4.1.9.9.598.1.1.24.1.5 | INTEGER | read-only | This object indicates the status of the RADIUS accounting server. The value of 'disable' indicates that status is disabled. The value of 'enable' indicates that status is enabled. |
| T/F claRadiusAccServerTunnelProxy | 1.3.6.1.4.1.9.9.598.1.1.24.1.6 | TruthValue | read-create | This object specifies active RADIUS accounting server's tunnel proxy. A value of 'true' indicates that the tunnel proxy is enabled. A value of 'false' indicates that the tunnel proxy is disabled. |
| T/F claRadiusAccServerPacState | 1.3.6.1.4.1.9.9.598.1.1.24.1.7 | TruthValue | read-create | This object specifies active RADIUS accounting server's PAC (Protected Access Control). A value of 'true' indicates that the server PAC state is enabled. A value of 'false' indicates that the server PAC state is disabled. |
| claRadiusAuthServerRealmTable | 1.3.6.1.4.1.9.9.598.1.1.25 | not-accessible | This table represents the conceptual table listing the RADIUS authentication servers with realm config. | |
| claRadiusAuthServerRealmEntry | 1.3.6.1.4.1.9.9.598.1.1.25.1 | not-accessible | An entry is a conceptual row representing a RADIUS authentication server with a particular realm. | |
| STR claRadiusAuthServerRealm | 1.3.6.1.4.1.9.9.598.1.1.25.1.1 | SnmpAdminString | not-accessible | This object represents authentication realm string on this index. This is used to filter the realms that are received from the client on the controller. |
| ROW claRadiusAuthRealmRowStatus | 1.3.6.1.4.1.9.9.598.1.1.25.1.2 | RowStatus | read-create | This object specifies the row status is used to control the realm to add or delete an entry in this table. |
| claRadiusAcctServerRealmTable | 1.3.6.1.4.1.9.9.598.1.1.26 | not-accessible | This table represents the conceptual table listing the RADIUS accounting servers with which the client shares a realm. | |
| claRadiusAcctServerRealmEntry | 1.3.6.1.4.1.9.9.598.1.1.26.1 | not-accessible | An entry is a conceptual row representing a RADIUS accounting server with a particular realm. | |
| STR claRadiusAcctServerRealm | 1.3.6.1.4.1.9.9.598.1.1.26.1.1 | SnmpAdminString | not-accessible | This object represents the accounting realm string on this index. This is used to filter the realms that are received from the client on the controller. |
| ROW claRadiusAcctRealmRowStatus | 1.3.6.1.4.1.9.9.598.1.1.26.1.2 | RowStatus | read-create | This object specifies the row status, used to control the realm to add or delete an entry in this table. |
| U32 claTacacsFallbackTestInterval | 1.3.6.1.4.1.9.9.598.1.1.27 | Unsigned32 | read-write | This object specifies the TACACS Fallback Test Interval in seconds. |
| claStatusObjects | 1.3.6.1.4.1.9.9.598.1.2 | |||
| claRadiusServerTable | 1.3.6.1.4.1.9.9.598.1.2.1 | not-accessible | This table represents the information about the requests sent to the RADIUS servers. When a new request gets sent to the RADIUS server an entry gets added to this table. The agents maintains a circular queue which automatically gets overwritten once the queue is full. | |
| claRadiusServerEntry | 1.3.6.1.4.1.9.9.598.1.2.1.1 | not-accessible | Each entry in this table provides information about a request that is sent to a RADIUS server. Each entry is uniquely identified by the request identifier. | |
| U32 claRadiusReqId | 1.3.6.1.4.1.9.9.598.1.2.1.1.1 | Unsigned32 | not-accessible | This object indicates the request identifier of the request sent to the RADIUS server. |
| IPt claRadiusAddressType | 1.3.6.1.4.1.9.9.598.1.2.1.1.2 | InetAddressType | read-only | This object indicates the address type for the RADIUS server. |
| IP claRadiusAddress | 1.3.6.1.4.1.9.9.598.1.2.1.1.3 | InetAddress | read-only | This object indicates the address of the RADIUS server. |
| INE claRadiusPortNum | 1.3.6.1.4.1.9.9.598.1.2.1.1.4 | InetPortNumber | read-only | This object indicates the port number for the RADIUS server. |
| U32 claRadiusWlanIdx | 1.3.6.1.4.1.9.9.598.1.2.1.1.5 | Unsigned32 | read-only | This object indicates the WLAN index whether the RADIUS server is activating and deactivating. |
| MAC claRadiusClientMacAddress | 1.3.6.1.4.1.9.9.598.1.2.1.1.6 | MacAddress | read-only | This object indicates the client MAC address that sent the request identified by the claRadiusReqId. |
| STR claRadiusUserName | 1.3.6.1.4.1.9.9.598.1.2.1.1.7 | SnmpAdminString | read-only | This object identifies the user for whom the request identified by the claRadiusReqId was sent. |
| G32 claDBCurrentUsedEntries | 1.3.6.1.4.1.9.9.598.1.2.2 | Gauge32 | read-only | This object specifies the current database entries used. This includes the number of users, mac filters configured in the system. |
| C32 claRadiusAuthClientAccessRequestsTotalEx | 1.3.6.1.4.1.9.9.598.1.2.3 | Counter32 | read-only | This object indicates the number of RADIUS Access-Request packets sent by the controller. This also includes retransmissions. |
| C32 claRadiusAuthClientAccessResponseTotal | 1.3.6.1.4.1.9.9.598.1.2.4 | Counter32 | read-only | This object indicates the number of RADIUS Auth response packets received by the controller. This includes 'Access-Accept', 'Access-Reject' and 'Access-Challenge'. |
| C32 claRadiusAuthClientAccessAcceptsTotal | 1.3.6.1.4.1.9.9.598.1.2.5 | Counter32 | read-only | This object indicates the number of RADIUS Access-Accept packets received by the controller. |
| claRadiusServerAvpTable | 1.3.6.1.4.1.9.9.598.1.2.6 | not-accessible | This table represents the information about the avp entries sent in the authentication and accounting packets to radius servers. These avp entries are populated from the downloaded XML file. | |
| claRadiusServerAvpEntry | 1.3.6.1.4.1.9.9.598.1.2.6.1 | not-accessible | Each entry in this table provides information about a request that is sent to a RADIUS server. Each entry is uniquely identified by the wlan id,radius type and serial entry. | |
| U32 claWlanId | 1.3.6.1.4.1.9.9.598.1.2.6.1.1 | Unsigned32 | not-accessible | This object indicates the wlan id of the ssid profile for which the avp entries are applied. |
| U32 claRadiusType | 1.3.6.1.4.1.9.9.598.1.2.6.1.2 | Unsigned32 | not-accessible | This object indicates the radius type for which the packets are sent, it takes the value auth(1), acct (2) or both (3) |
| U32 claAvpEntryId | 1.3.6.1.4.1.9.9.598.1.2.6.1.3 | Unsigned32 | not-accessible | This object identifies the entry index for this avp pair. |
| U32 claAvpVendorId | 1.3.6.1.4.1.9.9.598.1.2.6.1.4 | Unsigned32 | read-only | This object indicates the vendor id of this radius avp entry |
| U32 claAvpAttribute | 1.3.6.1.4.1.9.9.598.1.2.6.1.5 | Unsigned32 | read-only | This object indicates the attribute id for each vendor in the avp pair |
| INT claAvpType | 1.3.6.1.4.1.9.9.598.1.2.6.1.6 | INTEGER | read-only | This object indicates the value type in the avp pair. |
| STR claAvpValue | 1.3.6.1.4.1.9.9.598.1.2.6.1.7 | SnmpAdminString | read-only | This object indicates the value of the avp pair which is as per the type, currently only the string is returned for all types of values. |
| claGlobalObjects | 1.3.6.1.4.1.9.9.598.1.3 | |||
| T/F claTacacsDnsServerEnabled | 1.3.6.1.4.1.9.9.598.1.3.1 | TruthValue | read-write | This object specifies whether TACACS DNS feature is enabled on the controller A value of 'true' indicates that TACACS DNS feature is enabled. A value of 'false' indicates that TACACS DNS feature is disabled. |
| IPt claTacacsDnsServerAddressType | 1.3.6.1.4.1.9.9.598.1.3.2 | InetAddressType | read-write | This object specifies the TACACS DNS server address type. |
| IP claTacacsDnsServerAddress | 1.3.6.1.4.1.9.9.598.1.3.3 | InetAddress | read-write | This object specifies the TACACS DNS server address. |
| INE claTacacsDnsServerPort | 1.3.6.1.4.1.9.9.598.1.3.4 | InetPortNumber | read-write | This object specifies the port number for TACACS DNS server. |
| CLS claTacacsDnsServerSecretType | 1.3.6.1.4.1.9.9.598.1.3.5 | CLSecKeyFormat | read-write | This object specifies the secret key type of TACACS DNS server. |
| STR claTacacsDnsServerSecret | 1.3.6.1.4.1.9.9.598.1.3.6 | SnmpAdminString | read-write | This object specifies the secret key configured for TACACS DNS server.The secret key and type has to be set together.For get operation this object always returns a string with asterisks. |
| STR claTacacsDnsServerURL | 1.3.6.1.4.1.9.9.598.1.3.7 | CiscoURLString | read-write | This object specifies the URL of the TACACS DNS server. |
| U32 claTacacsDnsServerTimeout | 1.3.6.1.4.1.9.9.598.1.3.8 | Unsigned32 | read-write | This object specifies the TACACS DNS server timeout in days. |
| T/F claRadiusDnsServerEnabled | 1.3.6.1.4.1.9.9.598.1.3.9 | TruthValue | read-write | This object specifies whether Radius DNS feature is enabled on the controller A value of 'true' indicates that Radius DNS feature is enabled. A value of 'false' indicates that Radius DNS feature is disabled. |
| IPt claRadiusDnsServerAddressType | 1.3.6.1.4.1.9.9.598.1.3.10 | InetAddressType | read-write | This object specifies the Radius DNS server address type. |
| IP claRadiusDnsServerAddress | 1.3.6.1.4.1.9.9.598.1.3.11 | InetAddress | read-write | This object specifies the Radius DNS server address. |
| INE claRadiusDnsServerPort | 1.3.6.1.4.1.9.9.598.1.3.12 | InetPortNumber | read-write | This object specifies the port number for Radius DNS server. |
| CLS claRadiusDnsServerSecretType | 1.3.6.1.4.1.9.9.598.1.3.13 | CLSecKeyFormat | read-write | This object specifies the secret key type of Radius DNS server. |
| STR claRadiusDnsServerSecret | 1.3.6.1.4.1.9.9.598.1.3.14 | SnmpAdminString | read-write | This object specifies the secret key configured for Radius DNS server.The secret key and type has to be set together.For get operation this object always returns a string with asterisks. |
| STR claRadiusDnsServerURL | 1.3.6.1.4.1.9.9.598.1.3.15 | CiscoURLString | read-write | This object specifies the URL of the Radius DNS server. |
| U32 claRadiusDnsServerTimeout | 1.3.6.1.4.1.9.9.598.1.3.16 | Unsigned32 | read-write | This object specifies the Radius DNS server timeout in days. |
| INT claAAARadiusAuthCallStationIdType | 1.3.6.1.4.1.9.9.598.1.3.17 | INTEGER | read-write | This object specifies the call station ID information sent in RADIUS auth messages. ipAddr(0) : Sets Call Station Id Type to the system's IP Address. macAddr(1) : Sets Call Station Id Type to the system's MAC Address. apMacAddress(2) : Sets Call Station Id Type to the AP's Radio MAC Address. apMacAddressSsid(3) : Sets Call Station Id Type to the format :. apNameSsid(4) : Sets Called Station Id to the format :. apName(5) : Sets Called Station Id to the AP Name. apGroupName(6) : Sets Called Station Id to the AP Group Name. flexGroupName(7) : Sets Called Station Id to the Flex Connect Group Name. apLocation(8) : Sets Called Station Id to the AP Location. apVlanId(9) : Sets Called Station Id to the VLAN id. apMacEthAddress(10) : Sets Called Station Id Type to the AP's Ethernet MAC address. apMacEthAddressSsid(11) : Sets Called Station Id Type to the format :. apLabelMac(12) : Sets Call Station Id Type to the AP MAC address printed on APLabel. apLableMacSsid(13) : Sets Call Station Id Type to the format :. apMacSsidApGroup(14) : Sets Called Station Id Type to the format ::. |
| T/F claRadiusDnsAuthnetworkState | 1.3.6.1.4.1.9.9.598.1.3.18 | TruthValue | read-write | This object specifies whether the Radius DNS server auth network flag is enabled (true) or disabled (false). A value of 'true' indicates that auth network flag is enabled. A value of 'false' indicates that auth network flag is disabled. |
| T/F claRadiusDnsAuthmgmtState | 1.3.6.1.4.1.9.9.598.1.3.19 | TruthValue | read-write | This object specifies whether the Radius DNS server auth management flag is enabled (true) or disabled(false). A value of 'true' indicates that auth management flag is enabled. A value of 'false' indicates that auth management flag is disabled. |
| T/F claRadiusDnsAcctnetworkState | 1.3.6.1.4.1.9.9.598.1.3.20 | TruthValue | read-write | This object specifies whether the Radius DNS server accounting network flag is enabled (true) or disabled (false). A value of 'true' indicates that accounting network flag is enabled. A value of 'false' indicates that accounting network flag is disabled. |
| U32 claRadiusDnsAuthRetransmitTimeout | 1.3.6.1.4.1.9.9.598.1.3.21 | Unsigned32 | read-write | This object specifies the Radius Authentication DNS server's re-transmit Timeout. |
| U32 claRadiusDnsAcctRetransmitTimeout | 1.3.6.1.4.1.9.9.598.1.3.22 | Unsigned32 | read-write | This object specifies the Radius Accounting DNS server's re-transmit Timeout. |
| T/F claRadiusDnsAuthRfc3576State | 1.3.6.1.4.1.9.9.598.1.3.23 | TruthValue | read-write | This object specifies whether the Radius DNS server authentication server RFC3576 flag is enabled (true) or disabled(false). A value of 'true' indicates that authentication server flag is enabled. A value of 'false' indicates that authentication server flag is disabled. |
| U32 claRadiusFramedMtu | 1.3.6.1.4.1.9.9.598.1.3.24 | Unsigned32 | read-write | This object specifies framed-mtu-size for Radius EAP |
| U32 claRadiusDnsAuthMgmtRetransmitTimeout | 1.3.6.1.4.1.9.9.598.1.3.25 | Unsigned32 | read-write | This object specifies the Radius Authentication DNS server's Mgmt-Retransmit Timeout. |
| U32 claMgmtUserReauthInterval | 1.3.6.1.4.1.9.9.598.1.3.26 | Unsigned32 | read-write | This object specifies termination-interval for management users. |
| ciscoLwappAAAMIBConform | 1.3.6.1.4.1.9.9.598.2 | |||
| ciscoLwappAAAMIBCompliances | 1.3.6.1.4.1.9.9.598.2.1 | |||
| ciscoLwappAAAMIBCompliance | 1.3.6.1.4.1.9.9.598.2.1.1 | The compliance statement for the SNMP entities that implement the ciscoLwappAAAMIB module. | ||
| ciscoLwappAAAMIBComplianceRev1 | 1.3.6.1.4.1.9.9.598.2.1.2 | The compliance statement for the SNMP entities that implement the ciscoLwappAAAMIB module. | ||
| ciscoLwappAAAMIBGroups | 1.3.6.1.4.1.9.9.598.2.2 | |||
| ciscoLwappAAAMIBConfigGroup | 1.3.6.1.4.1.9.9.598.2.2.1 | This collection of objects specifies the required parameters for AAA. | ||
| ciscoLwappAAAMIBSaveUserConfigGroup | 1.3.6.1.4.1.9.9.598.2.2.2 | These is the configuration parameter related to guest user configuration saving. | ||
| ciscoLwappAAAMIBNotifsGroup | 1.3.6.1.4.1.9.9.598.2.2.3 | This collection of objects specifies the notifications for AAA. | ||
| ciscoLwappAAAMIBStatusObjsGroup | 1.3.6.1.4.1.9.9.598.2.2.4 | This collection of objects represents the information about the general status attributes for AAA. | ||
| ciscoLwappAAAMIBDBEntriesGroup | 1.3.6.1.4.1.9.9.598.2.2.5 | This is the additional object which represent the information about the general status attributes for AAA. | ||
| ciscoLwappAAAMIBRadiusConfigGroup | 1.3.6.1.4.1.9.9.598.2.2.6 | These are the RADIUS web authentication and fallback related configuration parameters on the WLC. | ||
| ciscoLwappAAAMIBAPPolicyConfigGroup | 1.3.6.1.4.1.9.9.598.2.2.7 | These are the AP Policy related configuration parameters on the WLC. | ||
| ciscoLwappAAAMIBWlanAuthAccServerConfigGroup | 1.3.6.1.4.1.9.9.598.2.2.8 | These are the authentication and account server configuration parameters per wlan. |
RFC description
Manages authentication, authorization, and accounting configuration on Cisco wireless LAN controllers.
Start monitoring Cisco Wireless LAN Controllers (LWAPP-based) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.