ENTERASYS-MGMT-AUTH-NOTIFICATION-MIB

All MIBs › ENTERASYS-MGMT-AUTH-NOTIFICATION-MIB

Organization: Enterasys Networks, Inc

Last Updated: 2011-03-08

Category: Vendor: Enterasys/Cabletron

Description: Enterasys Networks MIB for monitoring network management authentication events including failed and inactive session notifications.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is ENTERASYS-MGMT-AUTH-NOTIFICATION-MIB?

This Enterasys Networks enterprise MIB defines objects and traps for monitoring authentication activity against the device's own network-management interface (e.g., SNMP, CLI, web management logins). It exposes configuration for enabling authentication notifications plus runtime data identifying the authentication type, user name, source network address, and ingress interface of an authentication attempt. Its primary monitoring value is security/software status: it flags failed or unusual management-login attempts, a key input for detecting brute-force attacks or unauthorized management access attempts on network hardware. It is a self-contained enterprise MIB with no explicit dependency on external standard MIBs beyond generic SNMP notification and InetAddress textual conventions. It is typically deployed on Enterasys/Extreme switches and routers where centralized SNMP trap receivers or SIEM systems consume management-authentication events for security monitoring. Network engineers evaluating or troubleshooting this functionality can download the ENTERASYS-MGMT-AUTH-NOTIFICATION-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in ENTERASYS-MGMT-AUTH-NOTIFICATION-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Enterasys/Extreme Networks switch or router

Monitoring Examples

A security operations team would enable etsysMgmtAuthNotificationEnabledStatus and then watch for traps carrying etsysMgmtAuthUserName, etsysMgmtAuthType, and etsysMgmtAuthInetAddress to identify repeated failed logins from an unexpected source IP, indicating a possible credential-stuffing attempt against the switch's management plane. The etsysMgmtAuthInIfIndex object pinpoints which physical or management interface the authentication attempt arrived on, useful for correlating attacks to a specific out-of-band or in-band management path.

What Can Be Monitored

management authentication notification enable status
authentication type used
authenticating user name
source address of authentication attempt
ingress interface of authentication attempt

Imported Objects

From ENTERASYS-MIB-NAMES

etsysModules

OBJECT-IDENTITY

From IF-MIB

InterfaceIndexOrZero

From INET-ADDRESS-MIB

InetAddress
InetAddressType

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE

From SNMPv2-TC

DisplayString
TEXTUAL-CONVENTION

OIDs

OID symbolic	OID numeric	Type	Access	Description
etsysMgmtAuthNotificationMIB	1.3.6.1.4.1.5624.1.2.60			This MIB module defines a portion of the SNMP enterprise MIBs under Enterasys Networks' enterprise OID pertaining to Network management authentication notifications. This MIB was designed to be used for monitoring authentication events on the network management system by various remote monitoring mechanisms.
etsysMgmtAuthObjects	1.3.6.1.4.1.5624.1.2.60.1
etsysMgmtAuthNotificationBranch	1.3.6.1.4.1.5624.1.2.60.1.0
NTF etsysMgmtAuthSuccessNotificiation	1.3.6.1.4.1.5624.1.2.60.1.0.1			Authentication passed notification. The managed entity will send this notification when the remote user is successfully authenticated
NTF etsysMgmtAuthFailNotificiation	1.3.6.1.4.1.5624.1.2.60.1.0.2			Authentication failed notification. The managed entity will send this notification when the remote user fails authentication
NTF etsysMgmtAuthInactiveNotification	1.3.6.1.4.1.5624.1.2.60.1.0.3			Disable unused user(name) notification. The managed entity will send this notification to alert the appropriate administrator that the username has not been used during a specified time interval, so that the administrator may disable or delete that username.
NTF etsysMgmtAuthMaxAuthAttemptNotification	1.3.6.1.4.1.5624.1.2.60.1.0.4			Max user authentication attempt notification. The managed entity will send this notification to alert the appropriate administrator that a particular user has attempted to authenticate on the device a specified number of times.
NTF etsysMgmtAuthMaxFailNotification	1.3.6.1.4.1.5624.1.2.60.1.0.5			Failed authentication threshold notification. The managed entity will send this notification to alert the appropriate administrator when the threshold for failed authentications for a particular user has been exceeded.
etsysMgmtAuthConfigBranch	1.3.6.1.4.1.5624.1.2.60.1.1
ETS etsysMgmtAuthNotificationsSupported	1.3.6.1.4.1.5624.1.2.60.1.1.1	EtsysMgmtAuthNotificationTypes	read-only	Specifies the management notification types supported on this management entity.
ETS etsysMgmtAuthNotificationEnabledStatus	1.3.6.1.4.1.5624.1.2.60.1.1.2	EtsysMgmtAuthNotificationTypes	read-write	The authentication types the management entity is configured to send notifications for.
etsysMgmtAuthAuthenticationBranch	1.3.6.1.4.1.5624.1.2.60.1.2
ETS etsysMgmtAuthType	1.3.6.1.4.1.5624.1.2.60.1.2.1	EtsysMgmtAuthNotificationTypes	accessible-for-notify	The authentication type that was attempted by the user. Only 1 bit MAY be set in any given notification.
STR etsysMgmtAuthUserName	1.3.6.1.4.1.5624.1.2.60.1.2.2	DisplayString	accessible-for-notify	The username supplied by the user in the in the authentication attempt.
IPt etsysMgmtAuthInetAddressType	1.3.6.1.4.1.5624.1.2.60.1.2.3	InetAddressType	accessible-for-notify	A value that represents a type of Internet address specified by etsysMgmtAuthInetAddress.
IP etsysMgmtAuthInetAddress	1.3.6.1.4.1.5624.1.2.60.1.2.4	InetAddress	accessible-for-notify	The Internet Address of the remote user being authenticated. The format of this object is defined by the etsysMgmtAuthInetAddressType object.
NUM etsysMgmtAuthInIfIndex	1.3.6.1.4.1.5624.1.2.60.1.2.5	InterfaceIndexOrZero	accessible-for-notify	The MIB2 interface on the managed entity that the authentication request was received on. This object must return a value of zero if the interface is unknown.
etsysMgmtAuthConformance	1.3.6.1.4.1.5624.1.2.60.2
etsysMgmtAuthGroups	1.3.6.1.4.1.5624.1.2.60.2.1
etsysMgmtAuthConfigGroup	1.3.6.1.4.1.5624.1.2.60.2.1.1			A collection of objects providing basic instrumentation of network management authentication notifications.
etsysMgmtAuthHistoryGroup	1.3.6.1.4.1.5624.1.2.60.2.1.2			A collection of objects providing authentication history information.
etsysMgmtAuthNotificationGroup	1.3.6.1.4.1.5624.1.2.60.2.1.3			The management authentication notifications.
etsysMgmtAuthNotificationUserGroup	1.3.6.1.4.1.5624.1.2.60.2.1.4			The management authentication notifications relating to a particular user's attributes.
etsysMgmtAuthCompliances	1.3.6.1.4.1.5624.1.2.60.2.2
etsysMgmtAuthCompliance	1.3.6.1.4.1.5624.1.2.60.2.2.1			The compliance statement for devices that support Enterasys management authentication notification.
etsysMgmtAuthUserCompliance	1.3.6.1.4.1.5624.1.2.60.2.2.2			The compliance statement for devices that support Enterasys management authentication notifications based on user attributes.

RFC description

Enterasys network management authentication event notifications for monitoring user access and authentication attempts.

Start monitoring Enterasys Networks router/Layer 3 switch (legacy, later Extreme Networks) (management-login authentication events) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download ENTERASYS-MGMT-AUTH-NOTIFICATION-MIB

What Is ENTERASYS-MGMT-AUTH-NOTIFICATION-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description