FOUNDRY-SN-MAC-AUTHENTICATION-MIB

All MIBs › FOUNDRY-SN-MAC-AUTHENTICATION-MIB

Organization: Brocade Communications Systems, Inc.

Last Updated: 2010-06-02

Category: Domain: Security, Vendor: Foundry/Brocade

Description: Brocade Foundry MAC authentication MIB providing port-based MAC address authentication configuration and session management for network access control.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is FOUNDRY-SN-MAC-AUTHENTICATION-MIB?

FOUNDRY-SN-MAC-AUTHENTICATION-MIB is a Brocade/Foundry proprietary MIB for port-based MAC address authentication, a network access control mechanism on FastIron switches. It exposes a global enable/state object, a per-port command table for clearing authentication state, and a session table mapping authenticated MAC addresses to ports and VLANs. Its monitoring value is software/security state: which devices are currently authenticated on which port and VLAN, revealing authentication failures or unauthorized-device attempts rather than any hardware condition. It functions as an alternative to 802.1X-based access control found in other standard MIBs. It is deployed on FastIron access switches enforcing MAC-based network access control in campus environments.

IPNetwork Monitor allows you to monitor SNMP objects defined in FOUNDRY-SN-MAC-AUTHENTICATION-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Brocade/Foundry FastIron access switch

Monitoring Examples

The snMacAuthTable (snMacAuthIfIndex, snMacAuthVlanId, snMacAuthMac, snMacAuthState) lets an admin see which MAC addresses are currently authenticated on which port and VLAN; a device stuck in a pending or failed authentication state would reveal a RADIUS server communication problem or a misconfigured MAC entry, prompting an administrator to download the FOUNDRY-SN-MAC-AUTHENTICATION-MIB file to review object definitions during troubleshooting.

What Can Be Monitored

global MAC authentication enable state
per-port/VLAN MAC authentication sessions
authentication state per MAC address
clear-authentication command status

Imported Objects

From IF-MIB

InterfaceIndex

From SNMPv2-SMI

Integer32
MODULE-IDENTITY
OBJECT-TYPE

From SNMPv2-TC

MacAddress
TimeStamp

How to Use in IPNetwork Monitor

Example using snMacAuthAge OID:

Select a Brocade/Foundry FastIron access switch as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type snMacAuthAge into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. It reports the age of the mac session in which the MAC address is authenticated. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is an Integer32-type OID, Value bounds is the most useful condition here — trigger an alert if the value drifts significantly from its normal baseline, since an unexpected change often points to a real underlying issue. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
snMacAuth	1.3.6.1.4.1.1991.1.1.3.28			Management Information Base module for MAC authentication configuration and statistics. Copyright 1996-2010 Brocade Communications Systems, Inc. All rights reserved. This Brocade Communications Systems SNMP Management Information Base Specification embodies Brocade Communications Systems' confidential and proprietary intellectual property. Brocade Communications Systems retains all title and ownership in the Specification, including any revisions. This Specification is supplied AS IS, and Brocade Communications Systems makes no warranty, either express or implied, as to the use, operation, condition, or performance of the specification, and any unintended consequence it may on the user environment.
snMacAuthGlobal	1.3.6.1.4.1.1991.1.1.3.28.1
INT snMacAuthClearGlobalCmd	1.3.6.1.4.1.1991.1.1.3.28.1.1	INTEGER	read-write	valid(0) - a SNMP-GET of this mib shows that it is valid command to use. clear(1) - represents clear MAC Authentication table for all ports.
INT snMacAuthGlobalConfigState	1.3.6.1.4.1.1991.1.1.3.28.1.2	INTEGER	read-write	Enable/disable MAC authentication on the global level.
snMacAuthClearIfCmdTable	1.3.6.1.4.1.1991.1.1.3.28.2		not-accessible	The status of clearing an MAC Authentication entry for an interface.
snMacAuthClearIfCmdEntry	1.3.6.1.4.1.1991.1.1.3.28.2.1		not-accessible	An entry of clearing an MAC Authentication entry for an interface.
NUM snMacAuthClearIfCmdIfIndex	1.3.6.1.4.1.1991.1.1.3.28.2.1.1	InterfaceIndex	not-accessible	ifIndex value of the local interface on which a clear command is issued and monitored.
INT snMacAuthClearIfCmdAction	1.3.6.1.4.1.1991.1.1.3.28.2.1.2	INTEGER	read-write	valid(0) - a SNMP-GET of this mib shows that it is valid command to use. clear(1) - represents clearing an MAC Authentication entry for an interface.
snMacAuthTable	1.3.6.1.4.1.1991.1.1.3.28.3		not-accessible	MAC Authentication table.
snMacAuthEntry	1.3.6.1.4.1.1991.1.1.3.28.3.1		not-accessible	An entry in the MAC Authentication table.
NUM snMacAuthIfIndex	1.3.6.1.4.1.1991.1.1.3.28.3.1.1	InterfaceIndex	not-accessible	In order to identify a particular interface, this object shall identify the instance of the ifIndex object, defined in RFC 2863.
I32 snMacAuthVlanId	1.3.6.1.4.1.1991.1.1.3.28.3.1.2	Integer32	not-accessible	The ID of a VLAN of which this port is a member. Port must be untagged. For tagged port which belongs to multiple VLANs, this object return 0 which is an invalid VLAN ID value.
MAC snMacAuthMac	1.3.6.1.4.1.1991.1.1.3.28.3.1.3	MacAddress	not-accessible	MAC Address to be authenticated.
INT snMacAuthState	1.3.6.1.4.1.1991.1.1.3.28.3.1.4	INTEGER	read-only	.
TIM snMacAuthTimeStamp	1.3.6.1.4.1.1991.1.1.3.28.3.1.5	TimeStamp	read-only	Timestamp at which the MAC was authenticated or failed to be authenticated.
I32 snMacAuthAgeEx	1.3.6.1.4.1.1991.1.1.3.28.3.1.6	Integer32	read-only	Age of the mac session in which the MAC address is authenticated.
INT snMacAuthDot1x	1.3.6.1.4.1.1991.1.1.3.28.3.1.7	INTEGER	read-only	Indicates whether the Dot1x is enabled or not.
snMacAuthClearMacSessionTable	1.3.6.1.4.1.1991.1.1.3.28.4		not-accessible	The status of clearing an MAC Session entry indexed by a MAC address.
snMacAuthClearMacSessionEntry	1.3.6.1.4.1.1991.1.1.3.28.4.1		not-accessible	An entry of clearing an MAC Session entry indexed by a MAC address.
NUM snMacAuthClearMacSessionIfIndex	1.3.6.1.4.1.1991.1.1.3.28.4.1.1	InterfaceIndex	not-accessible	ifIndex value of the local interface on which a clear command is issued and monitored.
MAC snMacAuthClearMacSessionMac	1.3.6.1.4.1.1991.1.1.3.28.4.1.2	MacAddress	not-accessible	An MAC Session entry indexed by a MAC address.
INT snMacAuthClearMacSessionAction	1.3.6.1.4.1.1991.1.1.3.28.4.1.3	INTEGER	read-write	valid(0) - a SNMP-GET of this mib shows that it is valid command to use. clear(1) - represents clearing an MAC Session entry indexed by a MAC address.

RFC description

Brocade/Foundry MAC authentication configuration and statistics MIB for switch port-based MAC authentication control.

Start monitoring Brocade/Foundry FastIron access switches with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download FOUNDRY-SN-MAC-AUTHENTICATION-MIB