CISCO-REMOTE-ACCESS-MONITOR-MIB

All MIBs › CISCO-REMOTE-ACCESS-MONITOR-MIB

Organization: Cisco Systems

Last Updated: 2008--0-8-

Category: Cisco Devices, VPN and Security

Description: Tracks remote access VPN structures spanning Layer 2 (PPTP, L2TP, L2F), Layer 3 (IPSec), and Layer 4 (SSL) VPNs.

IPNetwork Monitor uses several OIDs from this MIB in network discovery and polling the applicable devices. Start monitoring CISCO-REMOTE-ACCESS-MONITOR-MIB with a free 30-day trial of IPNetwork Monitor.

What Is CISCO-REMOTE-ACCESS-MONITOR-MIB?

CISCO-REMOTE-ACCESS-MONITOR-MIB is a Cisco-specific SNMP module for monitoring remote-access VPN infrastructure spanning Layer 2 tunneling (PPTP, L2TP, L2F), Layer 3 IPSec, and Layer 4 SSL/WebVPN technologies on Cisco routers and VPN head-end devices. It exposes data organized around remote-access sessions and administrative groups, including per-protocol session counts, group membership, and aggregate connection statistics for the Remote Access Service (RAS) subsystem. Its primary monitoring value is software/service health rather than hardware: it lets an operator confirm the RAS process is up, track how many VPN sessions and groups are currently active, and spot abnormal drops or spikes that indicate a service outage or overload. The module is explicitly built on top of the underlying PPTP, L2TP, L2F, IPSec, and SSL/WebVPN protocol standards and is meant to complement, not duplicate, protocol-specific MIBs and RFCs for those tunnel types. It is typically deployed on Cisco VPN concentrators, ISP remote-access routers, and enterprise VPN head-ends that terminate large numbers of client-initiated remote-access tunnels, where CISCO-REMOTE-ACCESS-MONITOR-MIB SNMP monitoring gives operators visibility into RAS session health.

IPNetwork Monitor allows you to monitor SNMP objects defined in CISCO-REMOTE-ACCESS-MONITOR-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Cisco VPN concentrator/router
Cisco remote-access router

Monitoring Examples

The MIB source did not expose concrete object or table names in this batch, so no specific OID-level polling scenario can be given without inventing identifiers. In practice a network operations team would poll this module's per-group and per-protocol session counters to see, for example, that IPSec session counts have dropped to zero while SSL VPN sessions remain steady, pointing to an IPSec-specific fault. Because RAS terminology (sessions, groups, RTT-style accounting) is described in the module identity text, any real deployment would use this to distinguish a healthy remote-access service from one silently failing for a subset of VPN technologies.

What Can Be Monitored

active VPN session counts
remote-access group counts
per-protocol tunnel status (PPTP/L2TP/L2F/IPSec/SSL)
RAS subsystem availability

Imported Objects

From CISCO-SMI

ciscoMgmt

OBJECT-IDENTITY

From INET-ADDRESS-MIB

InetAddress
InetAddressType

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Counter64
Gauge32
Integer32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32
zeroDotZero

From SNMPv2-TC

TEXTUAL-CONVENTION
TimeStamp
TruthValue

How to Use in IPNetwork Monitor

Example using crasNumPrevSessions OID:

Select a Cisco VPN concentrator/remote-access router as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type crasNumPrevSessions into the Find box to locate it in the OID tree, then select it and click OK. The number of remote access sessions which were previously active but which where since terminated. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline (in Sessions), since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
ciscoRasActivityGroup	1.3.6.1.4.1.9.9.392.2.2.3			This group consists of the MIB objects pertaining to the Cisco Remote Access MIB Activity group. Following are definitions of some terms used in this compliance group: User: A remote access user. Group: A collection of remote access users grouped and managed together as a single entity for administrative convenience. ISP: Internet Service Provider. Crypto Accelerator 'Crypto Accelerator' denotes a device which the managed entity uses to offload some or all computations pertaining to cryptographic operations. Session A connection terminating on the managed device which has been established to provide remote access connectivity to a user.
ciscoRasActivityGroupRev1	1.3.6.1.4.1.9.9.392.2.2.11			This group contains activity information related to sessions.
ciscoRasCapacityGroup	1.3.6.1.4.1.9.9.392.2.2.1			This group consists of the MIB objects pertaining to Remote Access Service capacity parameters defined in the Cisco Remote Access MIB.
ciscoRasGrpActivityGroup	1.3.6.1.4.1.9.9.392.2.2.4			This group consists of the MIB objects pertaining to activity of user groups.
ciscoRasMandatoryFailureGroup	1.3.6.1.4.1.9.9.392.2.2.5			This group categorizes objects pertaining to failures in the Remote Access Service which are essential for successful monitoring of the service.
ciscoRasMonitorMIBCompliance	1.3.6.1.4.1.9.9.392.2.1.1			The compliance statement for SNMP entities the Cisco Remote Access Monitoring MIB.
ciscoRasMonitorMIBComplianceRev1	1.3.6.1.4.1.9.9.392.2.1.2			The compliance statement for SNMP entities the Cisco Remote Access Monitoring MIB.
ciscoRasMonitorMIBCompliances	1.3.6.1.4.1.9.9.392.2.1
ciscoRasMonitorMIBConform	1.3.6.1.4.1.9.9.392.2
ciscoRasMonitorMIBGroups	1.3.6.1.4.1.9.9.392.2.2
ciscoRasMonitorMIBNotifs	1.3.6.1.4.1.9.9.392.0
ciscoRasMonitorMIBObjects	1.3.6.1.4.1.9.9.392.1
ciscoRasNotificationCntlGroup	1.3.6.1.4.1.9.9.392.2.2.9			This group of objects controls the sending of notifications defined in this MIB module.
ciscoRasNotificationsGroup	1.3.6.1.4.1.9.9.392.2.2.10			This group contains the notifications for the Remote Access MIB.
ciscoRasOptionalFailureGroup	1.3.6.1.4.1.9.9.392.2.2.6			This group categorizes optional objects pertaining to failures in the Remote Access Service.
ciscoRasResourceUsageGroup	1.3.6.1.4.1.9.9.392.2.2.2			This group consists of the MIB objects pertaining to Remote Access Service resource usage parameters defined in the Cisco Remote Access MIB.
ciscoRasSecurityGroup	1.3.6.1.4.1.9.9.392.2.2.7			This group categorizes objects pertaining to the monitoring state of security in the Remote Access Service.
ciscoRasThresholdsGroup	1.3.6.1.4.1.9.9.392.2.2.8			This group categorizes objects which are used to establish baseline values of metrics instrumenting the Remote Access Service.
NTF ciscoRasTooHighThroughput	1.3.6.1.4.1.9.9.392.0.3			This notification is generated when the managed entity detects that the current throughput of the device exceeds the set threshold for throughput (crasThrMaxThroughput). Once the notification has been issued, further notiifcations are suppressed till the value returns below the specified threshold.
NTF ciscoRasTooManyFailedAuths	1.3.6.1.4.1.9.9.392.0.2			This notification is generated when the managed entity detects that the number of login attempts (over all users) exceeds the set threshold for throughput (crasThrMaxFailedAuths). Once the notification has been issued, further notifications are suppressed till the value returns below the specified threshold.
NTF ciscoRasTooManySessions	1.3.6.1.4.1.9.9.392.0.1			This notification is generated when the managed entity detects that the number of sessions established exceeds the set threshold crasThrMaxSessions. Once the notification has been issued, further notifications are suppressed till the value returns below the specified threshold.
ciscoRemoteAccessMonitorMIB	1.3.6.1.4.1.9.9.392			Acronyms and Definitions The following acronyms and terms are used in this document: IPSec: Secure IP Protocol VPN: Virtual Private Network RAS: Remote Access Service ISP: Internet Service Provider. LAN: Local Area Network Group: A collection of remote access users grouped and managed together as a single entity for administrative convenience. Session: A Remote Access Session. SVC: SSL VPN Client Webvpn: VPN connection established using web browser. Overview of the MIB This is a MIB Module for monitoring the structures in Virtual Private Networks based remote access networks. The MIB seeks to create a common model of Remote Access across implementations of the service on layer 2 (PPTP, L2TP, L2F), layer 3 (IPsec) and layer 4 (SSL) virtual private networks. The MIB defines counters and objects of interest to performance/fault monitoring in a way which is independent of the technology of the remote access implementation. MIB contains eight major groups of objects which are used to manage Remote Access connections: a) Remote Access capacity group This section defines metrics to gauge the limits of resources on this device which are critical to RAS service. b) Remote Access resource usage group This section defines metrics to gauge the usage of resources on this device which are critical to RAS service service. c) Current activity and performance of RAS service This section defines metrics to gauge the current remote access activity. d) Remote Access Service failures This section defines metrics to monitor session failures and failures of the service itself, measured at aggregate level, session level and group level. e) Security violations in the Remote Access service This section defines metrics which reflect the state of remote access service of interest to Security Operations staff in an enterprise. f) Threshold group (allows definition of high water marks) This section allows the management entity to define thresholds to set high water marks on critical metrics. g) Notifications This section defines notifications to signal significant events pertaining to the Remote Access Service.
I32 crasActGrNumUsers	1.3.6.1.4.1.9.9.392.1.3.22.1.2	Integer32	read-only	The number of users in this group currently connected to the managed device.
crasActGroupEntry	1.3.6.1.4.1.9.9.392.1.3.22.1		not-accessible	Each entry contains the attributes, statistics and status of an active session.
crasActGroupTable	1.3.6.1.4.1.9.9.392.1.3.22		not-accessible	This table lists all the currently active remote access user groups. For each group, it lists the attributes (group, aggregate activity, aggregate traffic), and status.
C64 crasActGrpInDropPkts	1.3.6.1.4.1.9.9.392.1.3.22.1.5	Counter64	read-only	The total number of packets dropped by this session which were received for processing.
C64 crasActGrpInOctets	1.3.6.1.4.1.9.9.392.1.3.22.1.7	Counter64	read-only	The total number of octets received by this session.
C64 crasActGrpInPkts	1.3.6.1.4.1.9.9.392.1.3.22.1.3	Counter64	read-only	The total number of packets received by this session.
STR crasActGrpName	1.3.6.1.4.1.9.9.392.1.3.22.1.1	SnmpAdminString	not-accessible	The name of the active user group corresponding to this entry.
C64 crasActGrpOutDropPkts	1.3.6.1.4.1.9.9.392.1.3.22.1.6	Counter64	read-only	The total number of outgoing packets which were dropped during transmit processing by this session.
C64 crasActGrpOutOctets	1.3.6.1.4.1.9.9.392.1.3.22.1.8	Counter64	read-only	The total number of octets transmitted by this session.
C64 crasActGrpOutPkts	1.3.6.1.4.1.9.9.392.1.3.22.1.4	Counter64	read-only	The total number of packets transmitted by this session.
crasActivity	1.3.6.1.4.1.9.9.392.1.3
USE crasAuthenMethod	1.3.6.1.4.1.9.9.392.1.3.21.1.4	UserAuthenMethod	read-only	The method used to authenticate the user prior to establishing the session.
USE crasAuthorMethod	1.3.6.1.4.1.9.9.392.1.3.21.1.5	UserAuthorMethod	read-only	The method used to authorize the user prior to establishing the session.
crasCapacity	1.3.6.1.4.1.9.9.392.1.1
STR crasClientOSVendorString	1.3.6.1.4.1.9.9.392.1.3.21.1.19	SnmpAdminString	read-only	The string identifying the vendor of the operating system on which the client application initiating the Remote Access Session is running.
STR crasClientOSVersionString	1.3.6.1.4.1.9.9.392.1.3.21.1.20	SnmpAdminString	read-only	The string identifying the version of the operating system of the entity which initiated this Remote Access session.
STR crasClientVendorString	1.3.6.1.4.1.9.9.392.1.3.21.1.17	SnmpAdminString	read-only	The string identifying the vendor of the client application initiating this Remote Access session.
STR crasClientVersionString	1.3.6.1.4.1.9.9.392.1.3.21.1.18	SnmpAdminString	read-only	The string identifying the version of the of the client application initiating the Remote Access session. This can be used by the administrator to identify which users are running unsupported client versions.
T/F crasCntlTooHighThroughput	1.3.6.1.4.1.9.9.392.1.7.3	TruthValue	read-write	This object defines the administrative state of sending the trap to signal the violation of the Max throughput threshold.
T/F crasCntlTooManyFailedAuths	1.3.6.1.4.1.9.9.392.1.7.2	TruthValue	read-write	This object defines the administrative state of sending the trap to signal the violation of the Max authentication failure count threshold.
T/F crasCntlTooManySessions	1.3.6.1.4.1.9.9.392.1.7.1	TruthValue	read-write	This object defines the administrative state of sending the trap to signal the violation of the Max session threshold.
IP crasDHCPServer	1.3.6.1.4.1.9.9.392.1.3.21.1.30	InetAddress	read-only	The IP address of the DHCP server assigned by the managed entity to this client session.
IPt crasDHCPServerAddrType	1.3.6.1.4.1.9.9.392.1.3.21.1.29	InetAddressType	read-only	The type of the address returned in 'crasDHCPServer'.
C32 crasEmailCumulateSessions	1.3.6.1.4.1.9.9.392.1.3.24	Counter32	read-only	The number of cumulative Email proxy sessions since system up.
G32 crasEmailNumSessions	1.3.6.1.4.1.9.9.392.1.3.23	Gauge32	read-only	The number of currently active Email proxy sessions.
U32 crasEmailPeakConcurrentSessions	1.3.6.1.4.1.9.9.392.1.3.25	Unsigned32	read-only	The number of peak concurrent Email proxy sessions since system up.
crasFailGlobalCntl	1.3.6.1.4.1.9.9.392.1.4.2
FAI crasFailLastFailIndex	1.3.6.1.4.1.9.9.392.1.4.3.2	FailureRecordIndex	read-only	The value of column 'crasSessFailIndex' corresponding to the last row added to the crasSessFailTable. The value of this object is undefined and should not be processed by the management entity if the value of the object 'crasFailTableSize' is 0.
U32 crasFailTableSize	1.3.6.1.4.1.9.9.392.1.4.2.1	Unsigned32	read-write	The window size of the Remote Access Failure tables. The failure tables for session and group failures maintain only the last crasFailTableSize number of failure records. A value of 0 for this MIB variable indicates that archiving of the failures is disabled. An implementation may choose suitable minimum and maximum values for this element based on the local policy and available resources. If an SNMP SET request specifies a value outside this window for this element, a BAD VALUE may be returned.
crasFailures	1.3.6.1.4.1.9.9.392.1.4
crasFailuresGlobals	1.3.6.1.4.1.9.9.392.1.4.1
G32 crasGlobalBwUsage	1.3.6.1.4.1.9.9.392.1.2.1	Gauge32	read-only	The average bandwidth used by all the active remote access sessions.
C64 crasGlobalInDecompOctets	1.3.6.1.4.1.9.9.392.1.3.8	Counter64	read-only	The total number of decompressed octets received by all current and previous remote access sessions. This value is accumulated AFTER the packet is decompressed. If compression is not being used, this value will match the value of crasGlobalInOctets.
C64 crasGlobalInDropPkts	1.3.6.1.4.1.9.9.392.1.3.11	Counter64	read-only	The total number of packets which were dropped during receive processing by all currently and previously active remote access sessions.
C64 crasGlobalInOctets	1.3.6.1.4.1.9.9.392.1.3.7	Counter64	read-only	The total number of octets received by all currently and previously active remote access sessions. This value is accumulated BEFORE determining whether or not the packet should be decompressed.
C64 crasGlobalInPkts	1.3.6.1.4.1.9.9.392.1.3.5	Counter64	read-only	The total number of packets received by all currently and previously active remote access sessions.
C64 crasGlobalOutDropPkts	1.3.6.1.4.1.9.9.392.1.3.12	Counter64	read-only	The total number of packets which were dropped during receive processing by all currently and previously active remote access sessions.
C64 crasGlobalOutOctets	1.3.6.1.4.1.9.9.392.1.3.9	Counter64	read-only	The total number of octets transmitted by all currently and previously active remote access sessions. This value is accumulated AFTER determining whether or not the packet should be compressed.
C64 crasGlobalOutPkts	1.3.6.1.4.1.9.9.392.1.3.6	Counter64	read-only	The total number of packets transmitted by all currently and previously active remote access sessions.
C64 crasGlobalOutUncompOctets	1.3.6.1.4.1.9.9.392.1.3.10	Counter64	read-only	The total number of uncompressed octets sent by all current and previous remote access sessions. This value is accumulated BEFORE the packet is compressed. If compression is not being used, this value will match the value of crasGlobalOutOctets.
STR crasGroup	1.3.6.1.4.1.9.9.392.1.3.21.1.2	SnmpAdminString	read-only	The name of the user group to which this remote access session belongs.
crasGroupFailures	1.3.6.1.4.1.9.9.392.1.4.4
crasGrpFailEntry	1.3.6.1.4.1.9.9.392.1.4.4.1.1		not-accessible	Each entry contains the summary of failures for a specific user group.
STR crasGrpFailGroupname	1.3.6.1.4.1.9.9.392.1.4.4.1.1.1	SnmpAdminString	not-accessible	The name of the user group to which this failure record corresponds. This is the index of the group failure table.
C64 crasGrpFailNumDeclined	1.3.6.1.4.1.9.9.392.1.4.4.1.1.4	Counter64	read-only	The number of session setup attempts which were declined by the managed entity due to local policy. These would include sessions which were denied due to rate control settings.
C64 crasGrpFailNumFailAuths	1.3.6.1.4.1.9.9.392.1.4.4.1.1.2	Counter64	read-only	The number of sessions belonging to this group which failed authentication; counted since last reboot.
C64 crasGrpFailNumResourceFailures	1.3.6.1.4.1.9.9.392.1.4.4.1.1.3	Counter64	read-only	The number of session setup attempts which failed due to insufficient resources.
C64 crasGrpFailNumTerminatedMgmt	1.3.6.1.4.1.9.9.392.1.4.4.1.1.5	Counter64	read-only	The number of established sessions which were terminated by explicit management action. The termination may have been triggered locally or based on a request from the peer.
C64 crasGrpFailNumTerminatedOther	1.3.6.1.4.1.9.9.392.1.4.4.1.1.6	Counter64	read-only	The number of established sessions which were terminated due to insufficient reasons, internal error or other reasons not caused by management action.
crasGrpFailTable	1.3.6.1.4.1.9.9.392.1.4.4.1		not-accessible	This table records the last 'N' occurrences of failures (setup or operational) per user group, where 'N' is the value of the MIB element 'crasFailTableSize' defined earlier. When 'N' entries have been created, the failure information about a new user group must be created by deleting the oldest entry in this table.
U32 crasHeartbeatInterval	1.3.6.1.4.1.9.9.392.1.3.21.1.16	Unsigned32	read-only	The interval in seconds between two successive heartbeats employed by this session. Value of 0 denotes that no heartbeat is used.
C32 crasIPSecCumulateSessions	1.3.6.1.4.1.9.9.392.1.3.27	Counter32	read-only	The number of cumulative IPSec sessions since system up.
G32 crasIPSecNumSessions	1.3.6.1.4.1.9.9.392.1.3.26	Gauge32	read-only	The number of currently active IPSec sessions.
U32 crasIPSecPeakConcurrentSessions	1.3.6.1.4.1.9.9.392.1.3.28	Unsigned32	read-only	The number of peak concurrent Email proxy sessions since system up.
IP crasISPAddress	1.3.6.1.4.1.9.9.392.1.3.21.1.10	InetAddress	read-only	The IP address of the peer (client) assigned by the ISP. This is the address of the client device in the public network.
IPt crasISPAddressType	1.3.6.1.4.1.9.9.392.1.3.21.1.9	InetAddressType	read-only	The type of the address returned in 'crasISPAddress'.
C32 crasL2LCumulateSessions	1.3.6.1.4.1.9.9.392.1.3.30	Counter32	read-only	The number of cumulative LAN to LAN sessions since system up.
G32 crasL2LNumSessions	1.3.6.1.4.1.9.9.392.1.3.29	Gauge32	read-only	The number of currently active LAN to LAN sessions.
U32 crasL2LPeakConcurrentSessions	1.3.6.1.4.1.9.9.392.1.3.31	Unsigned32	read-only	The number of peak concurrent LAN to LAN sessions since system up.
C32 crasLBCumulateSessions	1.3.6.1.4.1.9.9.392.1.3.33	Counter32	read-only	The number of cumulative Load Balancing sessions since system up.
G32 crasLBNumSessions	1.3.6.1.4.1.9.9.392.1.3.32	Gauge32	read-only	The number of currently active Load Balancing sessions.
U32 crasLBPeakConcurrentSessions	1.3.6.1.4.1.9.9.392.1.3.34	Unsigned32	read-only	The number of peak concurrent Load Balancing sessions since system up.
IP crasLocalAddress	1.3.6.1.4.1.9.9.392.1.3.21.1.8	InetAddress	read-only	The IP address assigned to the client of this session in the private network assigned by the managed entity.
IPt crasLocalAddressType	1.3.6.1.4.1.9.9.392.1.3.21.1.7	InetAddressType	read-only	The type of the address returned in 'crasLocalAddress'.
I32 crasMaxGroupsSupportable	1.3.6.1.4.1.9.9.392.1.1.3	Integer32	read-only	The maximum number of remote access groups that may be defined on this device. 'Group' refers to a collection of users grouped together for administrative convenience. If the device imposes no arbitrary limit on the maximum number of groups, it should return a value of 0.
I32 crasMaxSessionsSupportable	1.3.6.1.4.1.9.9.392.1.1.1	Integer32	read-only	The maximum number of remote access sessions that may be supported on this device. If the device imposes no arbitrary limit on the maximum number of sessions, it should return a value of 0.
I32 crasMaxUsersSupportable	1.3.6.1.4.1.9.9.392.1.1.2	Integer32	read-only	The maximum number of remote access users for whom Remote Access sessions may be supported on this device. If the device imposes no arbitrary limit on the maximum number of users, it should return a value of 0.
crasNotifCntl	1.3.6.1.4.1.9.9.392.1.7
C64 crasNumAbortedSessions	1.3.6.1.4.1.9.9.392.1.4.1.4	Counter64	read-only	The number of sessions which were successfully setup but were since terminated abnormally.
I32 crasNumCryptoAccelerators	1.3.6.1.4.1.9.9.392.1.1.4	Integer32	read-only	The maximum number of hardware crypto accelerators which can be installed on this device to support remote access sessions. 'cryptoaccelerator' denotes a hardware/software entity which the managed entity uses to offload some or all computations pertaining to cryptographic operations. If the device imposes no arbitrary limit on the number of crypto accelerators to support Remote Access function, it should return a value of 0.
U32 crasNumDeclinedSessions	1.3.6.1.4.1.9.9.392.1.4.1.2	Unsigned32	read-only	The number of session setup attempts, counted since the last time the notification 'ciscoRasTooManyFailedAuths' was issued, which were declined due to authentication or authorization failure.
C64 crasNumDisabledAccounts	1.3.6.1.4.1.9.9.392.1.5.1.1	Counter64	read-only	The total number of user accounts which were disabled due to repeated login failures.
G32 crasNumGroups	1.3.6.1.4.1.9.9.392.1.3.4	Gauge32	read-only	The number of user groups whose members have active sessions.
C32 crasNumPrevSessionsEx	1.3.6.1.4.1.9.9.392.1.3.2	Counter32	read-only	The number of remote access sessions which were previously active but which where since terminated. Measured since the last reboot of the device.
G32 crasNumSessions	1.3.6.1.4.1.9.9.392.1.3.1	Gauge32	read-only	The number of currently active sessions. A session is a connection terminating on the managed entity which has been established to provide remote access connectivity to a user. A session is said to be 'active' if it is ready to carry application traffic between the user and the managed entity. A session which is not active is defined to be 'dormant'.
C64 crasNumSetupFailInsufResources	1.3.6.1.4.1.9.9.392.1.4.1.3	Counter64	read-only	The number of session setup attempts that failed due to insufficient resources.
C64 crasNumTotalFailures	1.3.6.1.4.1.9.9.392.1.4.1.1	Counter64	read-only	The number of attempts to establish sessions which failed, since the last reboot of the managed device.
G32 crasNumUsers	1.3.6.1.4.1.9.9.392.1.3.3	Gauge32	read-only	The number of users who have active sessions.
IP crasPrimDNSServer	1.3.6.1.4.1.9.9.392.1.3.21.1.26	InetAddress	read-only	The IP address of the primary DNS server assigned by the managed entity to this client session.
IPt crasPrimDNSServerAddrType	1.3.6.1.4.1.9.9.392.1.3.21.1.25	InetAddressType	read-only	The type of the address returned in 'crasPrimDNSServer'.
IP crasPrimWINSServer	1.3.6.1.4.1.9.9.392.1.3.21.1.22	InetAddress	read-only	The IP address of the primary WINS server assigned managed entity to this client session.
IPt crasPrimWINSServerAddrType	1.3.6.1.4.1.9.9.392.1.3.21.1.21	InetAddressType	read-only	The type of the address returned in 'crasPrimWINSServer'.
OID crasProtocolElement	1.3.6.1.4.1.9.9.392.1.3.21.1.12	OBJECT IDENTIFIER	read-only	A reference to MIB definitions specific to the protocol underlying corresponding to the session or tunnel used to realized the remote access session corresponding to this conceptual row. For instance, if this remote access session is based on IPsec, then this object must contain the complete instance identifier of the IPsec tunnel corresponding to this remote access session. If no MIB definitions specific to the underlying protocol are available, the value should be set to the OBJECT IDENTIFIER { 0 0 }.
crasResourceUsage	1.3.6.1.4.1.9.9.392.1.2
IP crasSecDNSServer	1.3.6.1.4.1.9.9.392.1.3.21.1.28	InetAddress	read-only	The IP address of the secondary DNS server assigned by the managed entity to this client session.
IPt crasSecDNSServerAddrType	1.3.6.1.4.1.9.9.392.1.3.21.1.27	InetAddressType	read-only	The type of the address returned in 'crasSecDNSServer'.
crasSecurity	1.3.6.1.4.1.9.9.392.1.5
crasSecurityGlobals	1.3.6.1.4.1.9.9.392.1.5.1
IP crasSecWINSServer	1.3.6.1.4.1.9.9.392.1.3.21.1.24	InetAddress	read-only	The IP address of the secondary WINS server assigned by the managed entity to this client session.
IPt crasSecWINSServerAddrType	1.3.6.1.4.1.9.9.392.1.3.21.1.23	InetAddressType	read-only	The type of the address returned in 'crasSecWINSServer'.
crasSessFailEntry	1.3.6.1.4.1.9.9.392.1.4.3.1.1		not-accessible	Each entry contains the attributes associated with a remote access session failure.
STR crasSessFailGroupname	1.3.6.1.4.1.9.9.392.1.4.3.1.1.3	SnmpAdminString	read-only	The name of the user group to which this failed remote access session belongs.
FAI crasSessFailIndex	1.3.6.1.4.1.9.9.392.1.4.3.1.1.1	FailureRecordIndex	not-accessible	The index of the session failure table. The value of the index is a number which begins at one and is incremented with each session failure. The value of this object will wrap at 4,294,967,295.
IP crasSessFailISPAddr	1.3.6.1.4.1.9.9.392.1.4.3.1.1.9	InetAddress	read-only	The public address of the peer.
IPt crasSessFailISPAddrType	1.3.6.1.4.1.9.9.392.1.4.3.1.1.8	InetAddressType	read-only	The type of the address returned in 'crasSessFailISPAddr'.
IP crasSessFailLocalAddr	1.3.6.1.4.1.9.9.392.1.4.3.1.1.11	InetAddress	read-only	The address assigned to the peer by the local address management mechanism. In case no address was assigned to the peer when the failure occurred, this MIB variable would contain the IPv4 address value 0.0.0.0
IPt crasSessFailLocalAddrType	1.3.6.1.4.1.9.9.392.1.4.3.1.1.10	InetAddressType	read-only	The type of the address returned in 'crasSessFailLocalAddr'.
INT crasSessFailReason	1.3.6.1.4.1.9.9.392.1.4.3.1.1.5	INTEGER	read-only	The reason for the failure. Possible reasons include: 1 = other (error which cannot be classified in any of the types listed below). 2 = internal error occurred 3 = failed to authenticate the peer/user 4 = failed to authorize the peer/user 5 = system capacity exceeded (memory, cpu, max users etc) 6 = peer requested to abort the session or the setup 7 = lost peer's heartbeat 8 = local management request.
SES crasSessFailSessionIndex	1.3.6.1.4.1.9.9.392.1.4.3.1.1.7	SessionIndex	read-only	The index of the session which failed (in case this was an operational failure). In case of setup failures (where the value of 'crasSessFailType' of this conceptual row is 'operationalFailure'), the value of this object is undefined and should not be processed.
crasSessFailTable	1.3.6.1.4.1.9.9.392.1.4.3.1		not-accessible	This table records the last 'N' session failures, where 'N' is the value of the MIB element 'crasFailTableSize' defined earlier. A failure could be a failure to establish a session ('setup' failure) or a failure of a session after it was established ('operational' failure).
TIM crasSessFailTime	1.3.6.1.4.1.9.9.392.1.4.3.1.1.6	TimeStamp	read-only	The value of the MIB element 'sysUpTime' at the time of the failure.
INT crasSessFailType	1.3.6.1.4.1.9.9.392.1.4.3.1.1.4	INTEGER	read-only	The type of the failure: 1 = failure occurred during session setup 2 = failed occurred after the session was setup successfully.
crasSessFailures	1.3.6.1.4.1.9.9.392.1.4.3
STR crasSessFailUsername	1.3.6.1.4.1.9.9.392.1.4.3.1.1.2	SnmpAdminString	read-only	The name of the user associated with this failed remote access session.
SES crasSessionCompressionAlgo	1.3.6.1.4.1.9.9.392.1.3.21.1.15	SessionCompressionAlgo	read-only	The algorithm used by this remote access session to compress packets.
C32 crasSessionDuration	1.3.6.1.4.1.9.9.392.1.3.21.1.6	Counter32	read-only	The number of seconds elapsed since this session was established.
SES crasSessionEncryptionAlgo	1.3.6.1.4.1.9.9.392.1.3.21.1.13	SessionEncrAlgo	read-only	The algorithm used by this remote access session to encrypt its payload.
crasSessionEntry	1.3.6.1.4.1.9.9.392.1.3.21.1		not-accessible	Each entry contains the attributes, statistics and status of an active session.
SES crasSessionIndex	1.3.6.1.4.1.9.9.392.1.3.21.1.3	SessionIndex	not-accessible	Unique index to distinguish between multiple Remote Access Sessions associated with the same user. The value of crasSessionIndex must increase monotonically till it wraps. An implementation may choose to wrap this index before the value of 2147483647.
C64 crasSessionInDropPkts	1.3.6.1.4.1.9.9.392.1.3.21.1.33	Counter64	read-only	The total number of packets received for processing on this session which were dropped by the managed entity.
C64 crasSessionInOctets	1.3.6.1.4.1.9.9.392.1.3.21.1.35	Counter64	read-only	The total number of octets received by this Remote Access Session. This value is accumulated BEFORE determining whether or not the packet should be decompressed.
C64 crasSessionInPkts	1.3.6.1.4.1.9.9.392.1.3.21.1.31	Counter64	read-only	The total number of packets received by this Remote Access session.
C64 crasSessionOutDropPkts	1.3.6.1.4.1.9.9.392.1.3.21.1.34	Counter64	read-only	The total number of outgoing packets on this session which were dropped during transmit processing by the managed entity.
C64 crasSessionOutOctets	1.3.6.1.4.1.9.9.392.1.3.21.1.36	Counter64	read-only	The total number of octets transmitted by this Remote Access Session. This value is accumulated AFTER determining whether or not the packet should be compressed.
C64 crasSessionOutPkts	1.3.6.1.4.1.9.9.392.1.3.21.1.32	Counter64	read-only	The total number of packets transmitted by this Remote Access Session.
SES crasSessionPktAuthenAlgo	1.3.6.1.4.1.9.9.392.1.3.21.1.14	SessionAuthAlgo	read-only	The algorithm used by this remote access session to to validate packets.
RAS crasSessionProtocol	1.3.6.1.4.1.9.9.392.1.3.21.1.11	RasProtocol	read-only	The protocol underlying this remote access session.
SES crasSessionState	1.3.6.1.4.1.9.9.392.1.3.21.1.37	SessionStatus	read-write	The state of the remote access session corresponding to this conceptual row. The management entity may use this object to terminate an established session by setting value of the object to 'terminating'.
crasSessionTable	1.3.6.1.4.1.9.9.392.1.3.21		not-accessible	This table lists all the currently active sessions. For each session, it lists the attributes (user, group, protocol, security), statistics (packet and octets) and status.
C32 crasSVCCumulateSessions	1.3.6.1.4.1.9.9.392.1.3.36	Counter32	read-only	The number of cumulative SVC sessions since system up.
G32 crasSVCNumSessions	1.3.6.1.4.1.9.9.392.1.3.35	Gauge32	read-only	The number of currently active SVC sessions.
U32 crasSVCPeakConcurrentSessions	1.3.6.1.4.1.9.9.392.1.3.37	Unsigned32	read-only	The number of peak concurrent SVC sessions since system up.
crasThresholds	1.3.6.1.4.1.9.9.392.1.6
U32 crasThrMaxFailedAuths	1.3.6.1.4.1.9.9.392.1.6.2	Unsigned32	read-only	The value of object 'crasNumDeclinedSessions' at which the managed entity should alert the network management entity using the notification 'ciscoRasTooManyFailedAuths', if the notification has been enabled. A value of 0 indicates that the threshold has not been set.
I32 crasThrMaxSessions	1.3.6.1.4.1.9.9.392.1.6.1	Integer32	read-only	The maximum number of sessions which are successfully setup after which the managed entity should alert the network management entity using the notification 'ciscoRasTooManySessions', if the notification has been enabled. A value of 0 indicates that the threshold has not been set.
I32 crasThrMaxThroughput	1.3.6.1.4.1.9.9.392.1.6.3	Integer32	read-only	The highest throughput of the Remote Access Service at which the managed entity should alert the network management entity using the notification 'ciscoRasTooHighThroughput', if the notification has been enabled. The notification is disabled till the value of the aggregate throughput of the managed entity drops below the value of this object. A value of 0 indicates that the threshold has not been set.
STR crasUsername	1.3.6.1.4.1.9.9.392.1.3.21.1.1	SnmpAdminString	not-accessible	The name of the user associated with this remote access session.
C32 crasWebvpnCumulateSessions	1.3.6.1.4.1.9.9.392.1.3.39	Counter32	read-only	The number of cumulative Webvpn sessions since system up.
G32 crasWebvpnNumSessions	1.3.6.1.4.1.9.9.392.1.3.38	Gauge32	read-only	The number of currently active Webvpn sessions.
U32 crasWebvpnPeakConcurrentSessions	1.3.6.1.4.1.9.9.392.1.3.40	Unsigned32	read-only	The number of peak concurrent Webvpn sessions since system up.

RFC description

Monitors remote access VPN structures across Layer 2 (PPTP, L2TP, L2F), Layer 3 (IPSec), and Layer 4 (SSL) virtual private networks.

Start monitoring Cisco VPN concentrator/remote-access router with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download CISCO-REMOTE-ACCESS-MONITOR-MIB