ENTERASYS-RADIUS-DYNAMIC-AUTHOR-SERVER-EXT-MIB

All MIBs › ENTERASYS-RADIUS-DYNAMIC-AUTHOR-SERVER-EXT-MIB

Organization: Extreme Networks

Last Updated: 2016-05-18

Category: Protocol: RADIUS, RADIUS and AAA, Vendor: Enterasys/Cabletron

Description: Extreme/Enterasys Networks MIB for the RADIUS Dynamic Authorization server (RFC 5176) CoA and disconnect message handling.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is ENTERASYS-RADIUS-DYNAMIC-AUTHOR-SERVER-EXT-MIB?

This Extreme/Enterasys Networks enterprise MIB extends the standard RADIUS Dynamic Authorization server-side MIB (RFC 4673), adding read-write configuration for handling Change-of-Authorization (CoA) and Disconnect messages from RADIUS clients. It exposes a client table identifying which RADIUS servers are permitted to send dynamic-authorization requests to the device, along with shared-secret and row-status/enable objects. Monitoring-wise it is primarily a configuration-integrity check rather than a live counter feed: verifying enable status and the configured client list confirms the switch is correctly set up to accept CoA/disconnect requests used for dynamic session control (e.g., forcing re-authentication or disconnecting a compromised endpoint). It explicitly builds on RFC 4673 (RADIUS Dynamic Authorization Server MIB) and the underlying RFC 5176 Dynamic Authorization protocol. It is deployed on Enterasys/Extreme switches and wireless controllers where a NAC or policy server needs to dynamically alter or terminate active user sessions. Engineers can download the ENTERASYS-RADIUS-DYNAMIC-AUTHOR-SERVER-EXT-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in ENTERASYS-RADIUS-DYNAMIC-AUTHOR-SERVER-EXT-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Enterasys/Extreme Networks switch or wireless controller

Monitoring Examples

An administrator would check etsysRadiusDynAuthorServerEnable and then review etsysRadiusDynAuthorServerClientTable/etsysRadiusDynAuthorServerClientEntry to confirm the etsysRadiusDynAuthorServerClientAddress and etsysRadiusDynAuthorServerClientSecret match the NAC/policy server issuing CoA requests. If a CoA-triggered disconnect isn't taking effect, etsysRadiusDynAuthorServerClientStatus would be inspected to confirm the client entry is active rather than misconfigured or disabled.

What Can Be Monitored

dynamic authorization server enable status
configured RADIUS client addresses
client shared secret configuration status
client row/active status
virtual router association for RADIUS client

Imported Objects

From ENTERASYS-MIB-NAMES

etsysModules

OBJECT-IDENTITY

From INET-ADDRESS-MIB

InetAddress
InetAddressType

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Integer32
MODULE-IDENTITY
OBJECT-TYPE

From SNMPv2-TC

RowStatus
TruthValue

OIDs

OID symbolic	OID numeric	Type	Access	Description
etsysRadiusDynAuthorServerMIB	1.3.6.1.4.1.5624.1.2.80			This MIB module defines a portion of the SNMP enterprise MIBs under Enterasys Networks' enterprise OID pertaining to the server side of the Remote Access Dialin User Service (RADIUS) Dynamic Authorization protocol (RFC5176). This MIB provides read-write access to configuration objects not provided in the standard RADIUS Dynamic Authorization MIB (RFC4673). However, the write capability must only be supported for SNMPv3, or other SNMP versions with adequately strong security. Security concerns include Object ID verification, source address verification and timeliness verification.
etsysRadiusDynAuthorServerMIBObjects	1.3.6.1.4.1.5624.1.2.80.1
INT etsysRadiusDynAuthorServerEnable	1.3.6.1.4.1.5624.1.2.80.1.1	INTEGER	read-write	This object indicates whether or not RADIUS Dynamic Authorization is enabled or disabled. This parameter value MUST be maintained across system reboots.
etsysRadiusDynAuthorServerClientTable	1.3.6.1.4.1.5624.1.2.80.1.2		not-accessible	The (conceptual) table listing the RADIUS Accounting servers.
etsysRadiusDynAuthorServerClientEntry	1.3.6.1.4.1.5624.1.2.80.1.2.1		not-accessible	An entry (conceptual row) representing a RADIUS dynamic authorization server with which the server shares a secret. If RADIUS dynamic authorization is not enabled, this table is ignored. All created conceptual rows are non-volatile and as such MUST be maintained upon restart of the agent.
I32 etsysRadiusDynAuthorServerClientIndex	1.3.6.1.4.1.5624.1.2.80.1.2.1.1	Integer32	not-accessible	A number uniquely identifying each conceptual row in the etsysRadiusDynAuthorServerClientTable. In the event of an agent restart, the same value of etsysRadiusDynAuthorServerClientIndex MUST be used to identify each conceptual row in etsysRadiusDynAuthorServerClientTable as was used prior to the restart.
IPt etsysRadiusDynAuthorServerClientAddressType	1.3.6.1.4.1.5624.1.2.80.1.2.1.2	InetAddressType	read-create	The type of Internet address by which the RADIUS Dynamic Authorization Client is reachable.
IP etsysRadiusDynAuthorServerClientAddress	1.3.6.1.4.1.5624.1.2.80.1.2.1.3	InetAddress	read-create	The Internet address for the RADIUS Dynamic Authorization Client. Note that implementations MUST limit themselves to a single entry in this table per reachable server. The etsysRadiusDynAuthorServerClientAddress may not be empty due to the SIZE restriction. Also the size of a DNS name is limited to 64 characters. This parameter value is maintained across system reboots.
OCT etsysRadiusDynAuthorServerClientSecret	1.3.6.1.4.1.5624.1.2.80.1.2.1.4	OCTET STRING	read-create	This object is the secret shared between the RADIUS Dynamic Authorization client and RADIUS server. This parameter value is maintained across system reboots. While the 'official' MAX-ACCESS for this object is read-create, all implementations MUST return an empty string on a read.
T/F etsysRadiusDynAuthorServerClientSecretEntered	1.3.6.1.4.1.5624.1.2.80.1.2.1.5	TruthValue	read-only	true(1) - Indicates that etsysRadiusDynAuthorServerClientSecret was last set with some value other than the empty string. false(2) - Indicates that etsysRadiusDynAuthorServerClientSecret has never been set, or was last set to the empty string.
ROW etsysRadiusDynAuthorServerClientStatus	1.3.6.1.4.1.5624.1.2.80.1.2.1.6	RowStatus	read-create	Lets users create and delete RADIUS Dynamic Authorization client entries on systems that support this capability. Rules 1. When creating a RADIUS Dynamic Authorization Client, it is up to the management station to determine a suitable etsysRadiusDynAuthorServerClientIndex. To facilitate interoperability, agents SHOULD not put any restrictions on the etsysRadiusDynAuthorServerClientIndex beyond the obvious ones that it be valid and unused. 2. Before a new row can become 'active', values must be supplied for the columnar objects etsysRadiusDynAuthorServerClientAddress, etsysRadiusDynAuthorServerClientSecret, etsysRadiusDynAuthorServerClientAddress, and etsysRadiusDynAuthorClientServerClientVirtualRouterName. 3. The value of etsysRadiusDynAuthorServerClientStatus must be set to 'notInService' in order to modify a writable object in the same conceptual row. 4. etsysRadiusDynAuthorServerClient entries whose status is 'notReady' or 'notInService' will not be used for Dynamic Authorization.
IPt etsysRadiusDynAuthorClientServerClientAddressType	1.3.6.1.4.1.5624.1.2.80.1.2.1.7	InetAddressType	read-create	This object specifies how etsysRadiusDynAuthorServerClientAddressType is encoded. Support for all possible enumerations defined by InetAddressType is NOT REQUIRED.
IP etsysRadiusDynAuthorClientServerClientAddress	1.3.6.1.4.1.5624.1.2.80.1.2.1.8	InetAddress	read-create	The encoded unicast IP address of a local system interface. RADIUS Dynamic Authorization responses will be sent from this address.
OCT etsysRadiusDynAuthorClientServerClientVirtualRouterName	1.3.6.1.4.1.5624.1.2.80.1.2.1.9	OCTET STRING	read-create	The name of the local system virtual router that traffic sent to this RADIUS Dynamic Authorization server should be associated with. Writing this object with a zero length string clears the virtual router name for this server.
etsysRadiusDynAuthorServerMIBConformance	1.3.6.1.4.1.5624.1.2.80.2
etsysRadiusDynAuthorServerMIBCompliances	1.3.6.1.4.1.5624.1.2.80.2.1
etsysRadiusDynAuthorServerMIBCompliance	1.3.6.1.4.1.5624.1.2.80.2.1.1			The compliance statement for Dynamic Authorization servers implementing the RADIUS Dynamic Authorization ServerMIB.
etsysRadiusDynAuthorServerMIBCompliance2	1.3.6.1.4.1.5624.1.2.80.2.1.2			The compliance statement for Dynamic Authorization servers implementing the RADIUS Dynamic Authorization ServerMIB.
etsysRadiusDynAuthorServerMIBGroups	1.3.6.1.4.1.5624.1.2.80.2.2
etsysRadiusDynAuthorServerMIBGroup	1.3.6.1.4.1.5624.1.2.80.2.2.1			The basic collection of objects providing a proprietary extension to the standard RADIUS Dynamic Authorization MIB. This MIB provides read-write access to configuration objects not provided in the standard RADIUS Dynamic Authorization MIB (RFC4763). However, the write capability must only be supported for SNMPv3, or other SNMP versions with adequately strong security.
etsysRadiusDynAuthorServerMIBGroup2	1.3.6.1.4.1.5624.1.2.80.2.2.2			The basic collection of objects providing a proprietary extension to the standard RADIUS Dynamic Authorization MIB. This MIB provides read-write access to configuration objects not provided in the standard RADIUS Dynamic Authorization MIB (RFC4763). However, the write capability must only be supported for SNMPv3, or other SNMP versions with adequately strong security.

RFC description

RADIUS Dynamic Authorization server configuration for Extreme Networks devices (RFC5176).

Start monitoring Enterasys/Extreme Networks wireless switch/controller (RADIUS Dynamic Authorization/CoA) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download ENTERASYS-RADIUS-DYNAMIC-AUTHOR-SERVER-EXT-MIB

What Is ENTERASYS-RADIUS-DYNAMIC-AUTHOR-SERVER-EXT-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description