ENTERASYS-WIFI-PROTECTED-ACCESS-MIB

All MIBs › ENTERASYS-WIFI-PROTECTED-ACCESS-MIB

Organization: Enterasys Networks, Inc

Last Updated: 2003-11-06

Category: Domain: Security, Domain: Wireless, Technology: Wireless, Vendor: Enterasys/Cabletron

Description: Enterasys Networks Wi-Fi Protected Access (WPA/TKIP) MIB for configuring wireless security parameters on access points.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is ENTERASYS-WIFI-PROTECTED-ACCESS-MIB?

ENTERASYS-WIFI-PROTECTED-ACCESS-MIB is an Enterasys Networks proprietary MIB configuring Wi-Fi Protected Access (WPA), the TKIP-based wireless security scheme from the Wi-Fi Alliance based on draft IEEE 802.11i, on Enterasys wireless access points/controllers. It exposes a per-interface WPA configuration table covering whether WPA is enabled, the WPA version, supported pairwise key counts, multicast cipher, TKIP replay counter count, and group-key rekey method/time/packet interval. Its monitoring focus is wireless security software-configuration status: confirming WPA is enabled where required and that rekey intervals/methods meet policy, rather than exposing performance counters. It is explicitly modeled on draft 3.0 of IEEE 802.11i and the Wi-Fi Alliance's WPA specification, and is TKIP-only (no AES/WPA2 objects in this initial version). It is deployed on Enterasys wireless access points and controllers securing 802.11 wireless LANs. Engineers can download the ENTERASYS-WIFI-PROTECTED-ACCESS-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in ENTERASYS-WIFI-PROTECTED-ACCESS-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Enterasys/Extreme Networks wireless access points and controllers

Monitoring Examples

An admin would walk etsysWPAConfigTable/etsysWPAConfigEntry to confirm etsysWPAConfigEnabled is true on every wireless interface that should be running WPA, catching one left unsecured. Checking etsysWPAConfigGroupRekeyTime and etsysWPAConfigGroupRekeyPackets against security policy confirms group keys are being rotated frequently enough. etsysWPAConfigTKIPNumberOfReplayCounters and etsysWPAConfigMulticastCipher settings would be reviewed when diagnosing client compatibility issues with older WPA-TKIP-only devices.

What Can Be Monitored

WPA enable state per interface
WPA version
group rekey time/method/packet interval
TKIP replay counter count
multicast cipher configuration

Imported Objects

From ENTERASYS-MIB-NAMES

etsysModules

OBJECT-IDENTITY

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Integer32
MODULE-IDENTITY
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DisplayString
MacAddress
TruthValue

How to Use in IPNetwork Monitor

Example using etsysWPAStatsTKIPICVErrors OID:

Select an Enterasys/Extreme Networks wireless access point/controller (WPA/TKIP wireless security) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type etsysWPAStatsTKIPICVErrors into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. Counts the number of TKIP ICV errors encountered when decrypting packets for the station. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases between polls, since a rising count of errors, failures, or discards often points to a real underlying problem. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
etsysWiFiProtectedAccessMIB	1.3.6.1.4.1.5624.1.2.32			This MIB module defines a portion of the SNMP enterprise MIBs under Enterasys Networks' enterprise OID pertaining to Wi-Fi Protected Access (WPA) management functionality. This implementation includes Enterasys variants of objects that appear in draft 3.0 of IEEE Std 802.11i, and are relevant to the Wi-Fi Alliance's WPA specification. Since the initial WPA implementation is TKIP-based, the initial version of this MIB does not include AES-specific objects.
etsysWiFiProtectedAccessObjects	1.3.6.1.4.1.5624.1.2.32.1
etsysWPAConfigTable	1.3.6.1.4.1.5624.1.2.32.1.1		not-accessible	The table containing WPA configuration objects.
etsysWPAConfigEntry	1.3.6.1.4.1.5624.1.2.32.1.1.1		not-accessible	An entry in the etsysWPAConfigTable.
INT etsysWPAConfigIndex	1.3.6.1.4.1.5624.1.2.32.1.1.1.1	INTEGER	not-accessible	Each 802.11 interface is represented by an entry in the ifTable. If this index is zero, the information in this table shall apply to all 802.11 interfaces.
T/F etsysWPAConfigOptionImplemented	1.3.6.1.4.1.5624.1.2.32.1.1.1.2	TruthValue	read-only	This variable indicates whether the entity is WPA-capable.
T/F etsysWPAConfigEnabled	1.3.6.1.4.1.5624.1.2.32.1.1.1.3	TruthValue	read-write	When this object is set to TRUE, this shall indicate that WPA is enabled on this entity. The entity will advertise the WPA Information Element in its Beacons and Probe Responses. This object requires that dot11PrivacyInvoked also be set to TRUE. If dot11PrivacyInvoked is TRUE and etsysWPAConfigEnabled is FALSE, the security mechanism used is WEP.
INT etsysWPAConfigTKIPNumberOfReplayCounters	1.3.6.1.4.1.5624.1.2.32.1.1.1.4	INTEGER	read-only	Specifies the number of replay counters: (0) - 1 replay counter, (1) - 2 replay counters, (2) - 4 replay counters, (3) - 16 replay counters.
I32 etsysWPAConfigVersion	1.3.6.1.4.1.5624.1.2.32.1.1.1.5	Integer32	read-only	The highest WPA version this entity supports.
U32 etsysWPAConfigPairwiseKeysSupported	1.3.6.1.4.1.5624.1.2.32.1.1.1.6	Unsigned32	read-only	This object indicates how many pairwise keys the entity supports for WPA. When zero, it only supports (four) group keys.
OCT etsysWPAConfigMulticastCipher	1.3.6.1.4.1.5624.1.2.32.1.1.1.7	OCTET STRING	read-write	This object indicates the multicast cipher suite selector the entity must use. The multicast cipher suite in the WPA Information Element shall take its value from this variable. It consists of an OUI (the three most significant octets) and a cipher suite identifier (the least significant octet). The network administrator can always override the automatically selected multicast cipher suite by writing this object.
INT etsysWPAConfigGroupRekeyMethod	1.3.6.1.4.1.5624.1.2.32.1.1.1.8	INTEGER	read-write	This object selects a mechanism for rekeying the WPA Group Key. The default is time-based, once per day. Rekeying the Group key is only applicable to an entity acting in the Authenticator role (an AP in an ESS).
U32 etsysWPAConfigGroupRekeyTime	1.3.6.1.4.1.5624.1.2.32.1.1.1.9	Unsigned32	read-write	The time in seconds after which the WPA group key must be refreshed. The timer shall start at the moment the group key was set using the MLME-SetKeys primitive. The fine granularity (seconds) also enables the network Administrator to 'immediately' refresh the group key.
U32 etsysWPAConfigGroupRekeyPackets	1.3.6.1.4.1.5624.1.2.32.1.1.1.10	Unsigned32	read-write	A packet count (in 1000s of packets) after which the WPA group key shall be refreshed. The packet counter shall start at the moment the group key was set using the MLME-SetKeys primitive and it shall count all packets encrypted using the current group key.
T/F etsysWPAConfigGroupRekeyStrict	1.3.6.1.4.1.5624.1.2.32.1.1.1.11	TruthValue	read-write	This object signals that the WPA group key shall be refreshed whenever a Station leaves the BSS.
OCT etsysWPAConfigPSKValue	1.3.6.1.4.1.5624.1.2.32.1.1.1.12	OCTET STRING	read-write	The Pre-Shared Key (PSK) for when WPA in PSK mode is the selected authentication suite. In that case, the PMK will obtain its value from this object. A string of all 0x00 octets has the meaning 'clear the key'. This object is logically write-only. Reading this variable shall return unsuccessful status or null or zero.
STR etsysWPAConfigPSKPassPhrase	1.3.6.1.4.1.5624.1.2.32.1.1.1.13	DisplayString	read-write	The PSK, for when WPA in PSK mode is the selected authentication suite, is configured by etsysWPAConfigPSKValue. An alternative manner of setting the PSK uses the password-to-key algorithm defined in section XXX. This variable provides a means to enter a pass phrase. When this object is written, the WPA entity shall use the password-to-key algorithm specified in section XXX to derive a pre-shared key and populate etsysWPAConfigPSKValue with this key. This object is logically write-only. Reading this variable shall return unsuccessful status or null or zero.
T/F etsysWPAConfigPSKValueEntered	1.3.6.1.4.1.5624.1.2.32.1.1.1.14	TruthValue	read-only	Indicates whether the Pre-Shared Key (etsysWPAConfigPSKValue) is set. This allows a network management system to prompt the network manager, when appropriate, to enter the initial value of the key.
T/F etsysWPAConfigMultipleAuthSuitesSupported	1.3.6.1.4.1.5624.1.2.32.1.1.1.15	TruthValue	read-only	Indicates whether the entity can take advantage of multiple selections in the etsysWPAConfigAuthenticationSuitesTable. On radios that allow use of only one key management suite at a time, the access point may choose among the selected suites in an arbitrary fashion.
U32 etsysWPAConfigGroupMasterRekeyTime	1.3.6.1.4.1.5624.1.2.32.1.1.1.16	Unsigned32	read-write	The time in seconds after which the WPA group master key must be changed. The timer shall start at the moment the group master key was set. A group key refresh will occur on a group master key change. The fine granularity (seconds) also enables the network Administrator to 'immediately' refresh the group master key.
U32 etsysWPAConfigGroupUpdateTimeOut	1.3.6.1.4.1.5624.1.2.32.1.1.1.17	Unsigned32	read-write	The time in seconds after which the WPA group update handshake will be retried. The timer shall start at the moment the group update message is sent.
U32 etsysWPAConfigGroupUpdateCount	1.3.6.1.4.1.5624.1.2.32.1.1.1.18	Unsigned32	read-write	The number of times the WPA Group update will be retried.
U32 etsysWPAConfigPairwiseUpdateTimeOut	1.3.6.1.4.1.5624.1.2.32.1.1.1.19	Unsigned32	read-write	The time in seconds after which the WPA 4-way handshake will be retried. The timer shall start at the moment a 4-way message is sent.
U32 etsysWPAConfigPairwiseUpdateCount	1.3.6.1.4.1.5624.1.2.32.1.1.1.20	Unsigned32	read-write	The number of times the WPA 4-way handshake will be retried.
T/F etsysWPAConfigLegacyOptionSupported	1.3.6.1.4.1.5624.1.2.32.1.1.1.21	TruthValue	read-only	This object indicates whether the entity supports the 'Allow Legacy Clients' option. The answer may vary depending upon the currently-installed radio card model.
T/F etsysWPAConfigAllowLegacyClients	1.3.6.1.4.1.5624.1.2.32.1.1.1.22	TruthValue	read-write	This object provides a way to indicate that an access point in WPA mode should accept associations from both WPA clients and legacy (pre-WPA, pre-RSN) clients. When this object is true(1), the etsysWPAConfigMulticastCipher must be WEP-40 or WEP-104 (a.k.a. 128-bit WEP). Using WEP Group keys and letting legacy clients associate may weaken security. To minimize this, 1. Enable legacy associations only on radios that support Pairwise keys. 2. Enable frequent Group key rekeying. With TKIP and AES, there's much less threat of key cracking than with WEP, so the default is 'once in a blue moon'. With WEP, you need to think more in terms of Rapid Rekeying. Access points implementing this feature are under no obligation to support non-802.1X clients. For instance, an access point might use one-time dynamic WEP keys when WPA Group key rotation is disabled. Static WEP clients would not know these keys.
T/F etsysWPAConfigRekeyPairwiseWEP	1.3.6.1.4.1.5624.1.2.32.1.1.1.23	TruthValue	read-write	This object applies when WPA is enabled (dot11PrivacyInvoked, etsysWPAConfigEnabled) and management has chosen to allow a mix of WPA and non-WPA clients (etsysWPAConfigAllowLegacyClients). It specifies whether the access point should tumble Pairwise WEP keys belonging to non-WPA clients. The access point uses Group key rotation as a trigger for Pairwise WEP key tumbling; if you want the latter, be sure to configure the former. See also: etsysDot1xRekeyPairwise.
etsysWPAConfigUnicastCiphersTable	1.3.6.1.4.1.5624.1.2.32.1.2		not-accessible	This table lists the unicast ciphers supported by this entity. It allows enabling and disabling of each unicast cipher by network management. The Unicast Cipher Suite list in the WPA Information Element is formed using the information in this table.
etsysWPAConfigUnicastCiphersEntry	1.3.6.1.4.1.5624.1.2.32.1.2.1		not-accessible	The table entry, indexed by the interface index (or all interfaces) and the unicast cipher.
U32 etsysWPAConfigUnicastCipherIndex	1.3.6.1.4.1.5624.1.2.32.1.2.1.1	Unsigned32	not-accessible	The auxiliary index into the etsysWPAConfigUnicastCiphersTable.
OCT etsysWPAConfigUnicastCipher	1.3.6.1.4.1.5624.1.2.32.1.2.1.2	OCTET STRING	read-only	The selector of a supported unicast cipher. It consists of an OUI (the three most significant octets) and a cipher suite identifier (the least significant octet).
T/F etsysWPAConfigUnicastCipherEnabled	1.3.6.1.4.1.5624.1.2.32.1.2.1.3	TruthValue	read-write	This object enables or disables the unicast cipher.
etsysWPAConfigAuthenticationSuitesTable	1.3.6.1.4.1.5624.1.2.32.1.3		not-accessible	This table lists the authentication suites supported by this entity. Each authentication suite can be individually enabled and disabled. The Authentication Suite List in the WPA IE is formed using the information in this table.
etsysWPAConfigAuthenticationSuitesEntry	1.3.6.1.4.1.5624.1.2.32.1.3.1		not-accessible	An entry (row) in the etsysWPAConfigAuthenticationSuitesTable.
U32 etsysWPAConfigAuthenticationSuiteIndex	1.3.6.1.4.1.5624.1.2.32.1.3.1.1	Unsigned32	not-accessible	The auxiliary variable used as an index into the etsysWPAConfigAuthenticationSuitesTable.
OCT etsysWPAConfigAuthenticationSuite	1.3.6.1.4.1.5624.1.2.32.1.3.1.2	OCTET STRING	read-only	The selector of an authentication suite. It consists of an OUI (the three most significant octets) and a cipher suite identifier (the least significant octet).
T/F etsysWPAConfigAuthenticationSuiteEnabled	1.3.6.1.4.1.5624.1.2.32.1.3.1.3	TruthValue	read-write	This variable indicates whether the corresponding authentication suite is enabled/disabled.
etsysWPAStatsTable	1.3.6.1.4.1.5624.1.2.32.1.4		not-accessible	This table maintains per-STA statistics for SN. The entry with etsysWPAStatsSTAAddress set to FF-FF-FF-FF-FF-FF shall contain statistics for broadcast/multicast traffic.
etsysWPAStatsEntry	1.3.6.1.4.1.5624.1.2.32.1.4.1		not-accessible	An entry in the etsysWPAStatsTable.
U32 etsysWPAStatsIndex	1.3.6.1.4.1.5624.1.2.32.1.4.1.1	Unsigned32	not-accessible	An auxiliary index into the etsysWPAStatsTable.
MAC etsysWPAStatsSTAAddress	1.3.6.1.4.1.5624.1.2.32.1.4.1.2	MacAddress	read-only	The MAC address of the station the statistics in this conceptual row belong to.
U32 etsysWPAStatsVersion	1.3.6.1.4.1.5624.1.2.32.1.4.1.3	Unsigned32	read-only	The WPA version which the station associated with.
OCT etsysWPAStatsSelectedUnicastCipher	1.3.6.1.4.1.5624.1.2.32.1.4.1.4	OCTET STRING	read-only	The Authentication Suite the station selected during association. The value consists of a three octet OUI followed by a one octet Type as follows: OUI Value Authentication Type Key Management Type -------- ----- ------------------- ------------------- 00:00:00 0 Reserved Reserved 00:00:00 1 Unspecified authentication 802.1X Key Management over 802.1X 00:00:00 2 None 802.1X Key Management using pre-shared Key 00:00:00 3-255 Reserved Reserved Vendor any Vendor Specific Vendor Specific other any Reserved Reserved
C32 etsysWPAStatsTKIPICVErrorsEx	1.3.6.1.4.1.5624.1.2.32.1.4.1.5	Counter32	read-only	Counts the number of TKIP ICV errors encountered when decrypting packets for the station.
C32 etsysWPAStatsTKIPLocalMICFailures	1.3.6.1.4.1.5624.1.2.32.1.4.1.6	Counter32	read-only	Counts the number of Michael MIC failure encountered when checking the integrity of packets received from the station at this entity.
C32 etsysWPAStatsTKIPRemoteMICFailures	1.3.6.1.4.1.5624.1.2.32.1.4.1.7	Counter32	read-only	Counts the number of Michael MIC failures encountered by the station identified by dot11StatsSTAAddress and reported back to this entity.
C32 etsysWPAStatsTKIPCounterMeasuresInvoked	1.3.6.1.4.1.5624.1.2.32.1.4.1.8	Counter32	read-only	Counts the number of times a MIC failure occurred two times within 60 seconds and counter-measures were invoked. This variables counts this for both local and remote. It counts every time countermeasures are invoked.
etsysWpaConformance	1.3.6.1.4.1.5624.1.2.32.2
etsysWpaGroups	1.3.6.1.4.1.5624.1.2.32.2.1
etsysWpaBaseGroup	1.3.6.1.4.1.5624.1.2.32.2.1.1			A collection of objects providing configuration information for the WPA service.
etsysWpaUnicastCipherGroup	1.3.6.1.4.1.5624.1.2.32.2.1.2			A collection of objects providing configuration information for the WPA service.
etsysWpaAuthSuiteGroup	1.3.6.1.4.1.5624.1.2.32.2.1.3			A collection of objects providing configuration information for the WPA service.
etsysWpaStatsGroup	1.3.6.1.4.1.5624.1.2.32.2.1.4			A collection of objects providing statistics information for the WPA service.
etsysWpaCompliances	1.3.6.1.4.1.5624.1.2.32.2.2
etsysWpaCompliance	1.3.6.1.4.1.5624.1.2.32.2.2.1			The compliance statement for devices that support the Enterasys Wi-Fi Protected Access (WPA) MIB.

RFC description

Wi-Fi Protected Access (WPA) configuration and security management for Enterasys networks.

Start monitoring Enterasys/Extreme Networks wireless access point/controller (WPA/TKIP wireless security) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download ENTERASYS-WIFI-PROTECTED-ACCESS-MIB