CISCO-SNMP-VACM-EXT-MIB

All MIBs › CISCO-SNMP-VACM-EXT-MIB

Organization: Cisco Systems, Inc.

Last Updated: 2004-05-19

Category: Cisco Devices, SNMP Framework

Description: Extends SNMP VACM with Cisco-specific access control enhancements for fine-grained view-based security policies.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is CISCO-SNMP-VACM-EXT-MIB?

CISCO-SNMP-VACM-EXT-MIB extends the standard SNMP View-based Access Control Model (VACM, RFC 3415) with Cisco-specific enhancements that allow each securityModel/securityName combination to map into additional group names beyond what the base vacmSecurityToGroupTable provides. It belongs to the SNMP security/management-infrastructure technology area and exposes configuration data about extended security-to-group mappings used to fine-tune SNMP access control policy. Rather than hardware or performance status, this MIB is used to monitor and audit the device's SNMP access-control configuration — confirming which extra groups a given security principal has been granted, and the storage type/row status of those mappings, which matters for security compliance rather than fault detection. It has an explicit and direct dependency on the standards-based SNMP-VIEW-BASED-ACM-MIB (RFC 3415), which it extends rather than replaces. It is typically deployed on Cisco routers and switches where administrators need finer-grained SNMPv3 access control than the base VACM model provides. Engineers can download the CISCO-SNMP-VACM-EXT-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in CISCO-SNMP-VACM-EXT-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

vendor-neutral, standards-based extension applied to Cisco routers and switches running SNMPv3

Monitoring Examples

An operator or auditor would poll cvacmSecurityToGroupTable's cvacmSecurityGrpName and cvacmSecurityGrpStatus per entry to confirm which additional groups a given security principal has been mapped into beyond the standard vacmSecurityToGroupTable entry. Checking cvacmSecurityGrpStorageType would reveal whether an extended mapping is persisted (nonVolatile) or would be lost on reload, which matters when verifying that a security policy change will survive a device reboot.

What Can Be Monitored

extended security-to-group mappings
mapping storage type
mapping row status

Imported Objects

From CISCO-SMI

ciscoMgmt

OBJECT-IDENTITY

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMP-VIEW-BASED-ACM-MIB

vacmSecurityModel	OBJECT-TYPE
vacmSecurityName	OBJECT-TYPE

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

MODULE-IDENTITY
OBJECT-TYPE

From SNMPv2-TC

RowStatus
StorageType

OIDs

OID symbolic	OID numeric	Type	Access	Description
ciscoSnmpVacmExtMIB	1.3.6.1.4.1.9.9.409			The management information definitions to extend the View-based Access Control Model (RFC3415) for SNMP. This MIB extends the 'SNMP-VIEW-BASED-ACM-MIB' to allow each combination of a 'securityModel' and a 'securityName' to be mapped into additional groupNames. The groups identified by these mappings are in addition to those identified by 'vacmGroupName' of the 'vacmSecurityToGroupTable'.
ciscoSnmpVacmExtMIBObjects	1.3.6.1.4.1.9.9.409.1
cvacmSecurityToGroupTable	1.3.6.1.4.1.9.9.409.1.1		not-accessible	An Extension table to the 'vacmSecurityToGroupTable' defined in 'SNMP-VIEW-BASED-ACM-MIB. This table provides a mechanism to map a combination of 'securityModel' and 'securityName' into one or more groups in addition to the 'vacmGroupName' mapped in the 'vacmSecurityToGroupTable'. These groups provide additional access control policies for a principal. The agent must allow the same group mapping entry to be present in both the 'cvacmSecurityToGroupTable' and the 'vacmSecurityToGroupTable'. A row in this table can not exist without a corresponding row for the same combination of 'securityModel' and 'securityName in the 'vacmSecurityToGroupTable'. While creating a row in this table, if there is no corresponding row for the same combination of 'securityModel' and 'securityName in the 'vacmSecurityToGroupTable', the same mapping entry in is created in the 'vacmSecurityToGroupTable' by the agent using the values of instance variables of the entry in this table. The deletion of a row in the 'vacmSecurityToGroupTable' also causes the deletion of all the group mapping entries for the same combination of 'vacmSecurityModel' and 'vacmSecurityName' in the 'cvacmSecurityToGroupTable'. The deletion of a row in this table does not affect 'vacmSecurityToGroupTable'entries.
cvacmSecurityToGroupEntry	1.3.6.1.4.1.9.9.409.1.1.1		not-accessible	An entry (conceptual row) in the 'cvacmSecurityToGroupTable'. Each row represents one groupName mapping for the combination of 'securityModel' and 'securityName' in the system.
STR cvacmSecurityGrpName	1.3.6.1.4.1.9.9.409.1.1.1.1	SnmpAdminString	not-accessible	The name of the group for the mapping represented by this row. This is in addition to the 'vacmGroupName' mapped in the 'vacmSecurityToGroupTable'. For example a user principal represented by 'securityName' maps to a group represented by 'cvacmSecurityGrpName' under a security model represented by 'securityModel'. This groupName is used as index into the 'vacmAccessTable' to select an access control policy. However, a value in this table does not imply that an instance with the value exists in table 'vacmAccesTable'.
STO cvacmSecurityGrpStorageType	1.3.6.1.4.1.9.9.409.1.1.1.2	StorageType	read-create	The storage type for this conceptual row. Conceptual rows having the value 'permanent' need not allow write-access to any columnar objects in the row.
ROW cvacmSecurityGrpStatus	1.3.6.1.4.1.9.9.409.1.1.1.3	RowStatus	read-create	The status of this conceptual row. The value of this object has no effect on whether other objects in this conceptual row can be modified.
ciscoSnmpVacmExtMIBConformance	1.3.6.1.4.1.9.9.409.2
ciscoSnmpVacmExtMIBCompliances	1.3.6.1.4.1.9.9.409.2.1
ciscoSnmpVacmExtMIBCompliance	1.3.6.1.4.1.9.9.409.2.1.1			The compliance statement for SNMP engines which implement the CISCO-SNMP-VACM-EXT-MIB.
ciscoSnmpVacmExtMIBGroups	1.3.6.1.4.1.9.9.409.2.2
ciscoSnmpVacmExtGroup	1.3.6.1.4.1.9.9.409.2.2.1			A collection of objects providing for remote configuration of an SNMP engine which extends the SNMP View-based Access Control Model.

RFC description

Cisco vendor-private extension to SNMP View-based Access Control Model (VACM) for advanced authentication and authorization policies.

Start monitoring Cisco routers and switches running SNMPv3 with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download CISCO-SNMP-VACM-EXT-MIB

What Is CISCO-SNMP-VACM-EXT-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description