ENTERASYS-VLAN-AUTHORIZATION-MIB

All MIBs › ENTERASYS-VLAN-AUTHORIZATION-MIB

Organization: Enterasys Networks, Inc

Last Updated: 2004-06-02

Category: Technology: VLAN, Vendor: Enterasys/Cabletron

Description: Enterasys Networks MIB for enabling RADIUS-based dynamic VLAN assignment per RFC 3580 on authenticated switch ports.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is ENTERASYS-VLAN-AUTHORIZATION-MIB?

ENTERASYS-VLAN-AUTHORIZATION-MIB is an Enterasys Networks enterprise MIB that extends the IETF Q-BRIDGE-MIB to support RFC 3580 RADIUS-based dynamic VLAN assignment on authenticated switch ports. It exposes a table of per-port VLAN authorization entries showing whether VLAN authorization is enabled and the administrative versus operational egress VLAN tagging state resulting from a RADIUS-assigned Tunnel-Type attribute. This MIB is primarily a security/configuration module, but it does let administrators monitor the operational state of VLAN authorization per port, revealing whether a port's VLAN assignment from RADIUS actually took effect as expected. It explicitly depends on the IETF Q-BRIDGE-MIB (RFC 2674) and the RFC 3580 VLAN authorization standard it implements. It is deployed on Enterasys switches in 802.1X-enabled networks using dynamic VLAN assignment for network access control. Engineers can download the ENTERASYS-VLAN-AUTHORIZATION-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in ENTERASYS-VLAN-AUTHORIZATION-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Enterasys managed switch

Monitoring Examples

An administrator would poll etsysVlanAuthorizationTable entries and compare etsysVlanAuthorizationAdminEgress against etsysVlanAuthorizationOperEgress for a given port to confirm the RADIUS-assigned etsysVlanAuthorizationVlanID actually took effect operationally after a user authenticated. A mismatch between admin and operational egress state, combined with etsysVlanAuthorizationStatus, would reveal a failed dynamic VLAN assignment for that authenticated session.

What Can Be Monitored

VLAN authorization enable state
per-port VLAN authorization status
admin vs operational egress VLAN
RADIUS-assigned VLAN ID

Imported Objects

From BRIDGE-MIB

dot1dBasePortEntry

OBJECT-TYPE

From ENTERASYS-MIB-NAMES

etsysModules

OBJECT-IDENTITY

From P-BRIDGE-MIB

EnabledStatus

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Integer32
MODULE-IDENTITY
OBJECT-TYPE

From SNMPv2-TC

TEXTUAL-CONVENTION

OIDs

OID symbolic	OID numeric	Type	Access	Description
etsysVlanAuthorizationMIB	1.3.6.1.4.1.5624.1.2.48			This MIB module defines a portion of the SNMP MIB under Enterasys Networks' enterprise OID pertaining to proprietary extensions to the IETF Q-BRIDGE-MIB, as specified in RFC2674, pertaining to VLAN authorization, as specified in RFC3580. Specifically, the enabling and disabling of support for the VLAN Tunnel-Type attribute returned from a RADIUS authentication, and how that attribute is applied to the port which initiated the authentication.
etsysVlanAuthorizationObjects	1.3.6.1.4.1.5624.1.2.48.1
etsysVlanAuthorizationSystem	1.3.6.1.4.1.5624.1.2.48.1.1
ENA etsysVlanAuthorizationEnable	1.3.6.1.4.1.5624.1.2.48.1.1.1	EnabledStatus	read-write	The enable/disable state for the VLAN authorization feature. When disabled, no modifications to the VLAN attributes related to packet switching should be enforced.
etsysVlanAuthorizationPorts	1.3.6.1.4.1.5624.1.2.48.1.2
etsysVlanAuthorizationTable	1.3.6.1.4.1.5624.1.2.48.1.2.1		not-accessible	Extensions to the table that contains information about every port that is associated with this transparent bridge.
etsysVlanAuthorizationEntry	1.3.6.1.4.1.5624.1.2.48.1.2.1.1		not-accessible	A list of extensions that support the management of proprietary features for each port of a transparent bridge. This is indexed by dot1dBasePort.
ENA etsysVlanAuthorizationStatus	1.3.6.1.4.1.5624.1.2.48.1.2.1.1.1	EnabledStatus	read-write	The enabled/disabled status for the application of VLAN authorization on this port, if disabled, the information returned in the VLAN-Tunnel-Type from the authentication will not be applied to the port (although it should be represented in this table). If enabled, those results will be applied to the port.
VLA etsysVlanAuthorizationAdminEgress	1.3.6.1.4.1.5624.1.2.48.1.2.1.1.2	VlanAuthEgressStatus	read-write	Controls the modification of the current vlan egress list (of the vlan returned in the VLAN-Tunnel-Type, and reported by etsysVlanAuthorizationVlanID) upon successful authentication in the following manner: none(1) No egress manipulation will be made. tagged(2) The authenticating port will be added to the current egress for the VLAN-ID returned. untagged(3) The authenticating port will be added to the current untagged egress for the VLAN-ID returned. dynamic(4) The authenticating port will use information returned in the authentication response to modify the current egress lists. This value is supported only if the device supports a mechanism through which the egress status may be returned through the RADIUS response. Should etsysVlanAuthorizationEnable become disabled, etsysVlanAuthorizationStatus become disabled for a port, or should etsysVlanAuthorizationVlanID become 0 or 4095, all effect on the port egress MUST be removed.
VLA etsysVlanAuthorizationOperEgress	1.3.6.1.4.1.5624.1.2.48.1.2.1.1.3	VlanAuthEgressStatus	read-only	Reports the current state of modification to the current vlan egress list (of the vlan returned in the VLAN-Tunnel-Type) upon successful authentication, if etsysVlanAuthorizationStatus is enabled, in the following manner: none(1) No egress manipulation will be made. tagged(2) The authenticating port will be added to the current egress for the VLAN-ID returned. untagged(3) The authenticating port will be added to the current untagged egress for the VLAN-ID returned. The purpose of this leaf is to report, specifically when etsysVlanAuthorizationAdminEgress has been set to dynamic(4), the currently enforced egress modification. If the port is unauthenticated, or no VLAN-ID has been applied, this leaf should return none(1).
I32 etsysVlanAuthorizationVlanID	1.3.6.1.4.1.5624.1.2.48.1.2.1.1.4	Integer32	read-only	The 12 bit VLAN identifier for a given port, used to override the PVID of the given port, obtained as a result of an authentication. A value of zero indicates that there is no authenticated VLAN ID for the given port. Should a port become unauthenticated this value MUST be returned to zero. A value of 4095 indicates that a the port has been authenticated, but that the VLAN returned could not be applied to the port (possibly because of resource constraints or misconfiguration). In this instance, the original PVID should still be applied. Should the feature become disabled or the session terminate, all effect on the Port VLAN ID MUST be removed.
etsysVlanAuthorizationConformance	1.3.6.1.4.1.5624.1.2.48.2
etsysVlanAuthorizationGroups	1.3.6.1.4.1.5624.1.2.48.2.1
etsysVlanAuthorizationGroup	1.3.6.1.4.1.5624.1.2.48.2.1.1			A collection of objects relating to VLAN Authorization.
etsysVlanAuthorizationCompliances	1.3.6.1.4.1.5624.1.2.48.2.2
etsysVlanAuthorizationCompliance	1.3.6.1.4.1.5624.1.2.48.2.2.1			The compliance statement for devices that support the Enterasys VLAN Authorization MIB.

RFC description

Enterasys Networks vendor-private MIB for VLAN authorization; controls port VLAN membership and access policies.

Start monitoring Enterasys Networks switch (legacy, later Extreme Networks) (RADIUS-based dynamic VLAN assignment, RFC 3580) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download ENTERASYS-VLAN-AUTHORIZATION-MIB

What Is ENTERASYS-VLAN-AUTHORIZATION-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description