CISCO-RADIUS-EXT-MIB

All MIBs › CISCO-RADIUS-EXT-MIB

Organization: Cisco Systems, Inc.

Last Updated: 2020-09-08

Category: Cisco Devices, RADIUS and AAA

Description: Extends RADIUS client management with Cisco-specific server groups, dead criteria, and statistics objects.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is CISCO-RADIUS-EXT-MIB?

CISCO-RADIUS-EXT-MIB extends the standard IETF RADIUS client/server MIBs (RADIUS-AUTH-CLIENT-MIB, RADIUS-ACC-CLIENT-MIB, RADIUS-DYNAUTH-*-MIB, etc.) with Cisco-specific objects for RADIUS server groups, dead-server detection criteria, source-port management, and aggregate statistics. It exposes configuration data (source port range, per-server grouping) alongside performance/statistics counters such as queue lengths, access accepts/rejects, and average response delay. It supports monitoring the software-level health of a device's AAA (authentication/authorization/accounting) subsystem: rising creClientTotalAccessRejects or a growing creClientTotalMaxWaitQLength can reveal an overloaded or unreachable RADIUS server before it causes login/authentication failures. It explicitly extends multiple RFC-standard RADIUS MIBs (RFC 4668-4673), depending on them for base client/server object definitions. It is deployed on Cisco routers, switches, and access servers that use RADIUS for network access authentication, authorization, or accounting (AAA). Network engineers evaluating or troubleshooting this functionality can download the CISCO-RADIUS-EXT-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in CISCO-RADIUS-EXT-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Cisco router/switch/access server using RADIUS for AAA

Monitoring Examples

creClientTotalAccessRejects and creClientTotalAccessAccepts give an administrator an aggregate view of authentication outcomes across all configured RADIUS servers, and a sudden spike in rejects could indicate a misconfigured shared secret or an expired credential source. creClientTotalMaxInQLength, creClientTotalMaxWaitQLength, and creClientTotalMaxDoneQLength expose RADIUS request queue depths, where sustained high values point to a slow or overloaded RADIUS server. creAuthClientBadAuthenticators and creAuthClientUnknownResponses would be checked when diagnosing intermittent authentication failures, and creClientSourcePortRangeStart/End plus creClientLastUsedSourcePort show how the device is managing source ports for outgoing RADIUS requests.

What Can Be Monitored

RADIUS access accepts/rejects
average response delay
request queue lengths (in/wait/done)
bad authenticator/unknown response counts
source port range usage

Imported Objects

From CISCO-SMI

ciscoMgmt

OBJECT-IDENTITY

From INET-ADDRESS-MIB

InetPortNumber

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Gauge32
MODULE-IDENTITY
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

TEXTUAL-CONVENTION
TimeInterval

How to Use in IPNetwork Monitor

Example using creClientTotalAccessRejects OID:

Select a Cisco router/switch/access server using RADIUS for AAA as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type creClientTotalAccessRejects into the Find box to locate it in the OID tree, then select it and click OK. This object indicates the number of access reject packets received by the RADIUS client. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases between polls, since a rising count of errors, failures, or discards often points to a real underlying problem. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
ciscoRadiusExtMIB	1.3.6.1.4.1.9.9.736			This MIB module defines objects describing RADIUS (Remote Access Dialin User Service), serving as an extension of the following MIB modules: - - RADIUS-AUTH-CLIENT-MIB [RFC4668] - RADIUS-AUTH-SERVER-MIB [RFC4669] - RADIUS-ACC-CLIENT-MIB [RFC4670] - RADIUS-ACC-SERVER-MIB [RFC4671] - RADIUS-DYNAUTH-CLIENT-MIB [RFC4672] - RADIUS-DYNAUTH-SERVER-MIB [RFC4673] - [RFC4668] D. Nelson, RADIUS Authentication Client MIB for IPv6, RFC-4668, August 2006. - [RFC4669] D. Nelson, RADIUS Authentication Server MIB for IPv6, RFC-4669, August 2006. - [RFC4670] D. Nelson, RADIUS Accounting Client MIB for IPv6, RFC-4670, August 2006. - [RFC4671] D. Nelson, RADIUS Accounting Server MIB for IPv6, RFC-4671, August 2006. - [RFC4672] S. De Cnodder, N. Jonnala, M. Chiba, RADIUS Dynamic Authorization Client MIB, RFC-4672, September 2006. - [RFC4673] S. De Cnodder, N. Jonnala, M. Chiba, RADIUS Dynamic Authorization Server MIB, RFC-4673, September 2006.
cRadiusExtMIBObjects	1.3.6.1.4.1.9.9.736.1
creClientGlobal	1.3.6.1.4.1.9.9.736.1.1
G32 creClientTotalMaxInQLength	1.3.6.1.4.1.9.9.736.1.1.1	Gauge32	read-only	This object indicates the maximum length of the queue which stores the incoming RADIUS packets.
G32 creClientTotalMaxWaitQLength	1.3.6.1.4.1.9.9.736.1.1.2	Gauge32	read-only	This object indicates the maximum length of the queue which stores the pending RADIUS packets for which the responses are outstanding.
G32 creClientTotalMaxDoneQLength	1.3.6.1.4.1.9.9.736.1.1.3	Gauge32	read-only	This object indicates the maximum length of the queue which stores those RADIUS packets for which the responses are received.
C32 creClientTotalAccessRejectsEx	1.3.6.1.4.1.9.9.736.1.1.4	Counter32	read-only	This object indicates the number of access reject packets received by the RADIUS client.
NUM creClientTotalAverageResponseDelay	1.3.6.1.4.1.9.9.736.1.1.5	TimeInterval	read-only	This object indicates the overall response delay experienced by RADIUS packets (both authentication and accounting).
INE creClientSourcePortRangeStart	1.3.6.1.4.1.9.9.736.1.1.6	InetPortNumber	read-only	If the 'extended RADIUS source ports' is configured, multiple source ports are used for sending out RADIUS authentication or accounting requests. This MIB object indicates the port value from where this range starts.
INE creClientSourcePortRangeEnd	1.3.6.1.4.1.9.9.736.1.1.7	InetPortNumber	read-only	If the 'extended RADIUS source port' is configured, multiple source ports are used for sending out RADIUS authentication or accounting requests. This MIB object indicates the port value where this range ends.
INE creClientLastUsedSourcePort	1.3.6.1.4.1.9.9.736.1.1.8	InetPortNumber	read-only	If the 'extended RADIUS source ports' is configured, multiple source ports are used for sending out RADIUS authentication or accounting requests. This MIB object indicates the last source port that was used to send out a RADIUS authentication or accounting request.
OID creClientLastUsedSourceId	1.3.6.1.4.1.9.9.736.1.1.9	RadiusSourceIdentifier	read-only	This MIB object indicates the last source identifier that was used to send out a RADIUS packet when 'extended RADIUS source ports' is configured. The source identifier is a counter that is incremented everytime a RADIUS authentication or an accounting packet is sent.
C32 creClientTotalAccessAccepts	1.3.6.1.4.1.9.9.736.1.1.10	Counter32	read-only	This object indicates the number of access accept packets\n\ received by the RADIUS client.
creClientAuthentication	1.3.6.1.4.1.9.9.736.1.2
C32 creAuthClientBadAuthenticators	1.3.6.1.4.1.9.9.736.1.2.1	Counter32	read-only	This object indicates the number of RADIUS authentication response packets received which contained invalid authenticators.
C32 creAuthClientUnknownResponses	1.3.6.1.4.1.9.9.736.1.2.2	Counter32	read-only	This object indicates the number of unknown RADIUS authentication responses received.
C32 creAuthClientTotalPacketsWithResponses	1.3.6.1.4.1.9.9.736.1.2.3	Counter32	read-only	This object indicates the number of RADIUS authentication packets that received responses.
C32 creAuthClientBufferAllocFailures	1.3.6.1.4.1.9.9.736.1.2.4	Counter32	read-only	This object indicates the number of buffer allocation failures encountered during RADIUS request formation.
C32 creAuthClientTotalResponses	1.3.6.1.4.1.9.9.736.1.2.5	Counter32	read-only	This object indicates the number of RADIUS authentication response packets received by the RADIUS client.
C32 creAuthClientTotalPacketsWithoutResponses	1.3.6.1.4.1.9.9.736.1.2.6	Counter32	read-only	This object indicates the number of RADIUS authentication packets that never received a response.
NUM creAuthClientAverageResponseDelay	1.3.6.1.4.1.9.9.736.1.2.7	TimeInterval	read-only	This object indicates the average response delay experienced for RADIUS authentication requests.
NUM creAuthClientMaxResponseDelay	1.3.6.1.4.1.9.9.736.1.2.8	TimeInterval	read-only	This object indicates the maximum delay experienced for RADIUS authentication requests.
U32 creAuthClientMaxBufferSize	1.3.6.1.4.1.9.9.736.1.2.9	Unsigned32	read-only	This object indicates the maximum buffer size for RADIUS authentication packet.
C32 creAuthClientTimeouts	1.3.6.1.4.1.9.9.736.1.2.10	Counter32	read-only	This object indicates the number of timeouts that have occurred for RADIUS authentication. After a timeout the client may retry sending the request to the same server or to a different server or give up depending on the configuration.
C32 creAuthClientDupIDs	1.3.6.1.4.1.9.9.736.1.2.11	Counter32	read-only	This object indicates the number of times client has received duplicate authentication responses with the same identifier. Out of these two packets, the later packet is considered as a true match.
C32 creAuthClientMalformedResponses	1.3.6.1.4.1.9.9.736.1.2.12	Counter32	read-only	This object indicates the number of malformed RADIUS authentication responses received. Malformed packets include packets with an invalid length.
OID creAuthClientLastUsedSourceId	1.3.6.1.4.1.9.9.736.1.2.13	RadiusSourceIdentifier	read-only	This MIB object indicates the last source identifier that was used to send out a RADIUS authentication request when 'extended RADIUS source ports' is configured. The source identifier is a counter that is incremented everytime a RADIUS authentication request is sent.
creClientAccounting	1.3.6.1.4.1.9.9.736.1.3
C32 creAcctClientBadAuthenticators	1.3.6.1.4.1.9.9.736.1.3.1	Counter32	read-only	This object indicates the number of RADIUS Accounting-Response packets received with invalid authenticators.
C32 creAcctClientUnknownResponses	1.3.6.1.4.1.9.9.736.1.3.2	Counter32	read-only	This object indicates the number of unknown RADIUS accounting responses received.
C32 creAcctClientTotalPacketsWithResponses	1.3.6.1.4.1.9.9.736.1.3.3	Counter32	read-only	This object indicates the number of RADIUS accounting packets that received responses.
C32 creAcctClientBufferAllocFailures	1.3.6.1.4.1.9.9.736.1.3.4	Counter32	read-only	This object indicates the number of buffer allocation failures encountered for RADIUS accounting request.
C32 creAcctClientTotalResponses	1.3.6.1.4.1.9.9.736.1.3.5	Counter32	read-only	This object indicates the number of RADIUS accounting response packets received by the RADIUS client.
C32 creAcctClientTotalPacketsWithoutResponses	1.3.6.1.4.1.9.9.736.1.3.6	Counter32	read-only	This object indicates the number of RADIUS accounting packets that never received a response.
NUM creAcctClientAverageResponseDelay	1.3.6.1.4.1.9.9.736.1.3.7	TimeInterval	read-only	This object indicates the average response delay experienced for RADIUS accounting.
NUM creAcctClientMaxResponseDelay	1.3.6.1.4.1.9.9.736.1.3.8	TimeInterval	read-only	This object indicates the maximum delay experienced for RADIUS accounting.
U32 creAcctClientMaxBufferSize	1.3.6.1.4.1.9.9.736.1.3.9	Unsigned32	read-only	This object indicates the maximum buffer size for RADIUS accounting packets.
C32 creAcctClientTimeouts	1.3.6.1.4.1.9.9.736.1.3.10	Counter32	read-only	This object indicates the number of timeouts that have occurred for RADIUS accounting. After a timeout the client may retry sending the request to the same server or to a different server or give up depending on the configuration.
C32 creAcctClientDupIDs	1.3.6.1.4.1.9.9.736.1.3.11	Counter32	read-only	This object indicates the number of times client has received duplicate accounting responses with the same identifier. Out of these two packets, the later packet is considered as a true match.
C32 creAcctClientMalformedResponses	1.3.6.1.4.1.9.9.736.1.3.12	Counter32	read-only	This object indicates the number of malformed RADIUS accounting responses received. Malformed packets include packets with an invalid length.
OID creAcctClientLastUsedSourceId	1.3.6.1.4.1.9.9.736.1.3.13	RadiusSourceIdentifier	read-only	This MIB object indicates the last source identifier that was used to send out a RADIUS accounting request when 'extended RADIUS source ports' is configured. The source identifier is a counter that is incremented everytime a RADIUS accounting request is sent.
creClientDynAuth	1.3.6.1.4.1.9.9.736.1.4
creServerGlobal	1.3.6.1.4.1.9.9.736.1.5
creServerAuthentication	1.3.6.1.4.1.9.9.736.1.6
creServerAccounting	1.3.6.1.4.1.9.9.736.1.7
creServerDynAuth	1.3.6.1.4.1.9.9.736.1.8
cRadiusExtMIBConformance	1.3.6.1.4.1.9.9.736.2
creMIBCompliances	1.3.6.1.4.1.9.9.736.2.1
creMIBCompliance	1.3.6.1.4.1.9.9.736.2.1.1			The compliance statement for entities which implement the CISCO RADIUS Extention MIB
creMIBGroups	1.3.6.1.4.1.9.9.736.2.2
creClientGlobalGroup	1.3.6.1.4.1.9.9.736.2.2.1			Objects for providing aggregated statistics of RADIUS client.
creClientAuthenenticationGroup	1.3.6.1.4.1.9.9.736.2.2.2			Objects for providing statistics of RADIUS client authentication packets.
creClientAccountingGroup	1.3.6.1.4.1.9.9.736.2.2.3			Objects for providing statistics of RADIUS client accounting packets.

RFC description

Extends RADIUS authentication, accounting and dynamic authorization capabilities for Cisco network access control.

Start monitoring Cisco router/switch/access server using RADIUS for AAA with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download CISCO-RADIUS-EXT-MIB