ENTERASYS-8021X-REKEYING-MIB

All MIBs › ENTERASYS-8021X-REKEYING-MIB

Organization: Enterasys Networks, Inc

Last Updated: 2004-07-14

Category: Domain: Security, Protocol: 802.1X, Vendor: Enterasys/Cabletron

Description: Enterasys Networks proprietary MIB for configuring rapid rekeying of wireless LAN encryption keys on a per-port basis.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is ENTERASYS-8021X-REKEYING-MIB?

ENTERASYS-8021X-REKEYING-MIB is a proprietary Enterasys Networks MIB that configures the vendor's 'rapid rekeying' feature, which periodically rotates wireless LAN encryption keys to strengthen 802.1X-based Wi-Fi security. It exposes a per-port configuration table controlling whether rekeying is enabled and its timing and key parameters, rather than traffic or hardware sensor data. Its monitoring role is limited to security-configuration status: an administrator can confirm on which ports rapid rekeying is enabled and audit the configured rekey period and key length to verify compliance with a security policy, rather than tracking hardware health or performance. It is explicitly designed to supplement the standard IEEE 802.1X MIB, adding vendor-specific rekeying controls not present in that standard. It is deployed on Enterasys (later Extreme Networks) wireless infrastructure requiring enhanced dynamic key rotation for regulatory or security-hardening purposes. Engineers can download the ENTERASYS-8021X-REKEYING-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in ENTERASYS-8021X-REKEYING-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Enterasys (Extreme Networks) wireless access point/controller

Monitoring Examples

An administrator would walk etsysDot1xRekeyConfigTable/etsysDot1xRekeyConfigEntry to check etsysDot1xRekeyEnabled on each port and confirm rekeying is active where required, then inspect etsysDot1xRekeyPeriod and etsysDot1xRekeyLength to verify the rotation interval and key length meet the organization's security baseline. etsysDot1xRekeyAsymmetric and etsysDot1xRekeyPairwise indicate whether asymmetric or pairwise key modes are in use, which would be checked after a security policy change to confirm the new setting propagated correctly. This is a configuration-audit MIB rather than a live traffic/performance monitoring one.

What Can Be Monitored

per-port rekeying enabled state
rekey period
rekey key length
asymmetric/pairwise rekey mode

Imported Objects

From ENTERASYS-MIB-NAMES

etsysModules

OBJECT-IDENTITY

From IEEE8021-PAE-MIB

dot1xPaePortNumber

OBJECT-TYPE

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

MODULE-IDENTITY
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

TruthValue

OIDs

OID symbolic	OID numeric	Type	Access	Description
etsys8021xRekeyingMIB	1.3.6.1.4.1.5624.1.2.17			This MIB module defines a portion of the SNMP enterprise MIBs under Enterasys Networks' enterprise OID pertaining to IEEE 802.1x authentication. This MIB is designed to supplement and be used in connection with the standard IEEE 802.1x MIB. It provides configuration controls for Enterasys Networks' rapid rekeying feature -- a feature that enhances wireless LAN security by changing the network's radio keys on a regular basis.
etsysDot1xRekeyingObjects	1.3.6.1.4.1.5624.1.2.17.1
etsysDot1xRekeyBaseBranch	1.3.6.1.4.1.5624.1.2.17.1.1
etsysDot1xRekeyConfigTable	1.3.6.1.4.1.5624.1.2.17.1.1.1		not-accessible	A table that contains encryption-key-related configuration objects for ports on which Authenticator PAEs can run.
etsysDot1xRekeyConfigEntry	1.3.6.1.4.1.5624.1.2.17.1.1.1.1		not-accessible	Each conceptual row holds encryption key configuration information for the Authenticator PAEs associated with one port.
T/F etsysDot1xRekeyEnabled	1.3.6.1.4.1.5624.1.2.17.1.1.1.1.1	TruthValue	read-write	Determines how an access point selects radio encryption keys. If the selected port/Authenticator PAE does not support the EAPOL-Key feature (e.g., because radio keys are not applicable to Ethernet ports), this object's value will be FALSE and attempts to write TRUE will fail. Normally, if radio keys are present, the manager enters them into the access point through some manual process. The manager or the users may also need to configure the keys into each laptop (access points can distribute the keys automatically to 802.1x EAP-TLS clients). However laptops get keys, the keys remain static until somebody goes to the trouble of changing them. If the keys stay unchanged for long periods, this can make it easier for a determined attacker to launch a cryptographic attack. When rapid rekeying is enabled, an access point ignores its manually-set keys. It generates pseudo-random keys on a periodic basis, using IEEE 802.1x key distribution to deliver the keys to new and current clients. Do not enable rapid rekeying unless ALL of your clients support IEEE 802.1x and an authentication method (e.g., EAP-TLS) that supports key distribution. Before enabling rapid rekeying, make sure that you have set 'dot1xAuthKeyTxEnabled' to TRUE. Changing the keys without telling any of the clients about the changes is not a very useful mode of operation.
U32 etsysDot1xRekeyPeriod	1.3.6.1.4.1.5624.1.2.17.1.1.1.1.2	Unsigned32	read-write	When rapid rekeying (periodic changing of radio keys) is enabled, the value of this object determines the period, in seconds, between key changes.
INT etsysDot1xRekeyLength	1.3.6.1.4.1.5624.1.2.17.1.1.1.1.3	INTEGER	read-write	Determines the number of bits/bytes used in the encryption keys. Currently supports either 128-bit (16-octet) encryption keys or 40-bit (5-octet) encryption keys.
T/F etsysDot1xRekeyAsymmetric	1.3.6.1.4.1.5624.1.2.17.1.1.1.1.4	TruthValue	read-write	Determines the association between the supplicant and authenticator transmit keys. If true(1), the authenticator and supplicant will use different encryption keys in order to transmit data. If false(2), the authenticator and supplicant will use a single key pattern to encrypt the transmitted data.
T/F etsysDot1xRekeyPairwise	1.3.6.1.4.1.5624.1.2.17.1.1.1.1.5	TruthValue	read-write	Determines whether Rapid Rekeying tumbles Pairwise keys (when it is enabled, and the radio card supports them). If true(1), it indicates that the access point should tumble both Pairwise and Group keys. If false(2), it indicates that the access point should tumble only Group keys.
etsysDot1xRekeyingConformance	1.3.6.1.4.1.5624.1.2.17.2
etsysDot1xRekeyingGroups	1.3.6.1.4.1.5624.1.2.17.2.1
etsysDot1xRekeyingBaseGroup	1.3.6.1.4.1.5624.1.2.17.2.1.1			A collection of objects providing rekeying configuration information about a port on which Authenticator PAEs can run.
etsysDot1xRekeyingPairwiseGroup	1.3.6.1.4.1.5624.1.2.17.2.1.2			A collection of objects providing rekeying configuration information related to Pairwise keys.
etsysDot1xRekeyingCompliances	1.3.6.1.4.1.5624.1.2.17.2.2
etsysDot1xRekeyingCompliance	1.3.6.1.4.1.5624.1.2.17.2.2.1			The compliance statement for devices that support the Enterasys IEEE 802.1x extensions MIB.

RFC description

Manages IEEE 802.1x rapid rekeying to enhance wireless LAN security by changing network radio keys regularly.

Start monitoring Enterasys Networks switch (legacy, later Extreme Networks)/AP (802.1X rapid rekeying) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download ENTERASYS-8021X-REKEYING-MIB

What Is ENTERASYS-8021X-REKEYING-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description