HM2-REMOTE-AUTHENTICATION-MIB

All MIBs › HM2-REMOTE-AUTHENTICATION-MIB

Organization: Hirschmann Automation and Control GmbH

Last Updated: 2014-03-06

Category: Domain: Security, Protocol: RADIUS, RADIUS and AAA, Vendor: Belden

Description: Hirschmann HiOS (HM2) remote authentication MIB for RADIUS and TACACS+ server-based user authentication.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is HM2-REMOTE-AUTHENTICATION-MIB?

HM2-REMOTE-AUTHENTICATION-MIB is a Hirschmann HiOS proprietary MIB covering remote authentication protocols, with the sampled objects focused specifically on LDAP client configuration for centralized user authentication (RADIUS/TACACS+ are covered by the broader MIB per its description). It exposes LDAP client admin state, cache timeout, directory search parameters (base DN, search attribute), bind-user credentials, TLS version/cipher settings, and a table of configured LDAP servers. Its monitoring value is confirming that centralized authentication is enabled and correctly reachable, since a failed or misconfigured LDAP client would lock administrators out of remote login or force fallback to local accounts; TLS settings also matter for verifying secure transport to the authentication server. It depends on standard LDAP and TLS protocol concepts rather than any specific IETF SNMP MIB. It is deployed on Hirschmann HiOS industrial switches in enterprises or utilities using centralized directory-based authentication for device administration. Engineers can download the HM2-REMOTE-AUTHENTICATION-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in HM2-REMOTE-AUTHENTICATION-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Hirschmann HiOS industrial Ethernet switch

Monitoring Examples

An administrator checks hm2LdapClientAdminState to confirm LDAP authentication is enabled, then reviews hm2LdapClientServerAddrTable (hm2LdapClientServerAddrEntry, indexed by hm2LdapClientServerIndex) alongside hm2LdapClientServerBaseDN and hm2LdapClientServerSearchAttribute to verify the directory lookup is targeting the correct organizational unit. The hm2LdapClientTlsVersions and hm2LdapClientTlsCipherSuites objects confirm secure transport settings match the LDAP server's requirements, and hm2LdapClientCacheTimeout shows how long successful authentications are cached. If admins are suddenly unable to log in via LDAP, checking these objects (and the hm2RemoteAuthMibNotifications trap group) can reveal whether the LDAP server address or credentials are misconfigured.

What Can Be Monitored

LDAP client admin state
LDAP cache timeout
configured LDAP server address(es)
directory base DN and search attribute
TLS version/cipher configuration

Imported Objects

From HM2-MGMTACCESS-MIB

Hm2TlsCipherSuites
Hm2TlsVersions

From HM2-TC-MIB

HmEnabledStatus
hm2ConfigurationMibs	OBJECT-IDENTITY

From HM2-USERMGMT-MIB

Hm2UserAccessRoles

From INET-ADDRESS-MIB

InetAddress
InetAddressType
InetPortNumber

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-SMI

Integer32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-IDENTITY
OBJECT-TYPE

From SNMPv2-TC

RowStatus

OIDs

OID symbolic	OID numeric	Type	Access	Description
hm2RemoteAuthMib	1.3.6.1.4.1.248.11.26			Hirschmann MIB for remote authentication protocols. Copyright (C) 2014. All Rights Reserved.
hm2RemoteAuthMibNotifications	1.3.6.1.4.1.248.11.26.0
NTF hm2LdapConfigStatusTrap	1.3.6.1.4.1.248.11.26.0.1			This notification is send when authentication via Ldap to a remote authentication server is done.
hm2RemoteAuthMibObjects	1.3.6.1.4.1.248.11.26.1
hm2LdapGroup	1.3.6.1.4.1.248.11.26.1.1
hm2LdapConfigGroup	1.3.6.1.4.1.248.11.26.1.1.10
HME hm2LdapClientAdminState	1.3.6.1.4.1.248.11.26.1.1.10.1	HmEnabledStatus	read-write	Enables/disables the LDAP client admin mode.
I32 hm2LdapClientCacheTimeout	1.3.6.1.4.1.248.11.26.1.1.10.2	Integer32	read-write	Configures the LDAP user cache entry timeout in minutes. Default timeout value is 10 minutes.
STR hm2LdapClientServerBaseDN	1.3.6.1.4.1.248.11.26.1.1.10.3	SnmpAdminString	read-write	Base distinguished name for LDAP query to remote authentication server.
STR hm2LdapClientServerSearchAttribute	1.3.6.1.4.1.248.11.26.1.1.10.4	SnmpAdminString	read-write	Search attribute for LDAP query to remote authentication server, e.g. 'userPrincipalName'.
STR hm2LdapClientServerBindUser	1.3.6.1.4.1.248.11.26.1.1.10.5	SnmpAdminString	read-write	User name of user that has permission to do user requests on a remote authentication server.
STR hm2LdapClientServerBindUserPasswd	1.3.6.1.4.1.248.11.26.1.1.10.6	SnmpAdminString	read-write	Password of user that has permission to do user requests on a remote authentication server.
STR hm2LdapClientServerDefaultDomain	1.3.6.1.4.1.248.11.26.1.1.10.7	SnmpAdminString	read-write	Default domain used for users without a domain name.
HM2 hm2LdapClientTlsVersions	1.3.6.1.4.1.248.11.26.1.1.10.8	Hm2TlsVersions	read-write	The TLS version supported by the LDAP client.
HM2 hm2LdapClientTlsCipherSuites	1.3.6.1.4.1.248.11.26.1.1.10.9	Hm2TlsCipherSuites	read-write	The cipher suite supported by the LDAP client.
hm2LdapClientServerAddrTable	1.3.6.1.4.1.248.11.26.1.1.10.20		not-accessible	This table contains objects to configure client connections to remote authentication server(s).
hm2LdapClientServerAddrEntry	1.3.6.1.4.1.248.11.26.1.1.10.20.1		not-accessible	The Ldap client connection objects.
I32 hm2LdapClientServerIndex	1.3.6.1.4.1.248.11.26.1.1.10.20.1.1	Integer32	accessible-for-notify	Index for remote authentication server table.
STR hm2LdapClientServerDescr	1.3.6.1.4.1.248.11.26.1.1.10.20.1.2	SnmpAdminString	read-create	The description of the server configured.
IPt hm2LdapClientServerAddrType	1.3.6.1.4.1.248.11.26.1.1.10.20.1.3	InetAddressType	read-create	Address type.
IP hm2LdapClientServerAddr	1.3.6.1.4.1.248.11.26.1.1.10.20.1.4	InetAddress	read-create	IP address of remote authentication server.
INE hm2LdapClientServerPort	1.3.6.1.4.1.248.11.26.1.1.10.20.1.5	InetPortNumber	read-create	The port number of the remote authentication server.
INT hm2LdapClientServerSecurity	1.3.6.1.4.1.248.11.26.1.1.10.20.1.6	INTEGER	read-create	Configures connection security options. - none -> connection to AD server is unprotected. (Attention: passwords are transmitted as plain text) - ssl -> SSL connection is established between device and AD server and AD server certificate is proved valid with loaded certificate authority (CA certificate). - startTLS -> TLS connection is established between device and AD server and AD server certificate is proved valid with loaded certificate authority (CA certificate).
INT hm2LdapClientServerStatus	1.3.6.1.4.1.248.11.26.1.1.10.20.1.7	INTEGER	read-only	Status of authentication against remote authentication server: - ok -> Server reachable, authentication succeeded - unreachable -> Server (primary and backup) not reachable - other -> any other error state
ROW hm2LdapClientServerRowStatus	1.3.6.1.4.1.248.11.26.1.1.10.20.1.8	RowStatus	read-create	Indicates the status of an entry in this table, and is used to create/delete entries. Objects within this table can by changed while the status is 'active'.
hm2LdapMappingGroup	1.3.6.1.4.1.248.11.26.1.1.20
INT hm2LdapRoleMatchingPolicy	1.3.6.1.4.1.248.11.26.1.1.20.1	INTEGER	read-write	Configures the way role mapping table entries are applied. If set to first (2) the first matching entry determines the user's role. If set to highest (1) the the matching entry with the highest role is used.
hm2LdapRoleMappingTable	1.3.6.1.4.1.248.11.26.1.1.20.10		not-accessible	This table contains string objects to configure the mapping to an available user role.
hm2LdapRoleMappingEntry	1.3.6.1.4.1.248.11.26.1.1.20.10.1		not-accessible	The role mapping string objects.
I32 hm2LdapRoleMappingIndex	1.3.6.1.4.1.248.11.26.1.1.20.10.1.1	Integer32	accessible-for-notify	Index for remote authentication role mapping table.
HM2 hm2LdapRoleMappingAccessRole	1.3.6.1.4.1.248.11.26.1.1.20.10.1.2	Hm2UserAccessRoles	read-create	The access role to be mapped.
INT hm2LdapRoleMappingType	1.3.6.1.4.1.248.11.26.1.1.20.10.1.3	INTEGER	read-create	Type of this entry
STR hm2LdapRoleMappingParameter	1.3.6.1.4.1.248.11.26.1.1.20.10.1.4	SnmpAdminString	read-create	The search string for the entry. For hm2LdapRoleMappingType attribute(1) this is in the form attribute=value. For hm2LdapRoleMappingType group(2) this is the group.
ROW hm2LdapRoleMappingRowStatus	1.3.6.1.4.1.248.11.26.1.1.20.10.1.5	RowStatus	read-create	Indicates the status of an entry in this table, and is used to create/delete entries. Objects within this table can by changed while the status is 'active'.
hm2RemoteAuthMibSNMPExtensionGroup	1.3.6.1.4.1.248.11.26.3
hm2LdapSESGroup	1.3.6.1.4.1.248.11.26.3.1
hm2LdapSESDuplicateIPorHost	1.3.6.1.4.1.248.11.26.3.1.1			Indicates that there exists a remote authentication client server entry with the same IP address or host name.

RFC description

Manages remote authentication protocols including LDAP client configuration and user mapping for Hirschmann network devices.

Start monitoring Hirschmann HiOS industrial switch (LDAP/RADIUS/TACACS+ remote authentication) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download HM2-REMOTE-AUTHENTICATION-MIB

What Is HM2-REMOTE-AUTHENTICATION-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description