HP-AUTZ-MIB

All MIBs › HP-AUTZ-MIB

Organization: HP Networking

Last Updated: 2017-03-16

Category: Domain: Security, RADIUS and AAA, Vendor: HP/HPE

Description: HP SNMP MIB (hpSwitchAuthorizationMIB) providing authorization policy management for HP ProCurve switches.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is HP-AUTZ-MIB?

HP-AUTZ-MIB (internally hpSwitchAuthorizationMIB) is an HP-proprietary SNMP module for managing user authorization services, such as external authorization/RADIUS-style server settings and local privilege configuration, on HP ProCurve networking switches. It exposes configuration objects for authorization servers (server IP/type, notification enable) and local privilege settings, structured under config-object groups with associated conformance/compliance statements. As a monitoring MIB its value is mostly around software/service configuration status rather than hardware health: hpicfSwitchAuthServerIP and hpicfSwitchAuthServerIPType let an operator confirm which authorization server is configured and reachable, while hpicfSwitchAuthServerNotifyEnable indicates whether the switch will trap on authorization-server-related events, useful for catching an authorization service outage. HP-AUTZ-MIB SNMP monitoring is thus primarily a matter of confirming authorization service reachability and configuration consistency rather than tracking hardware sensors. It is a vendor-specific extension that complements, rather than replaces, standard AAA-related MIBs used elsewhere in HP's ProCurve MIB family. It is deployed on HP ProCurve switches in enterprise networks that enforce centralized user authorization for administrative or network access control.

IPNetwork Monitor allows you to monitor SNMP objects defined in HP-AUTZ-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

HP ProCurve switches

Monitoring Examples

An operator would check hpicfSwitchAuthServerIPType and hpicfSwitchAuthServerIP to verify the configured authorization server address is correct and of the expected address family, and confirm hpicfSwitchAuthServerNotifyEnable is set so that the switch will notify the NMS if that server becomes unreachable. The hpSwitchAuthConfigObjects and hpSwitchAuthLocalPrivConfigObjects groups would be reviewed together to ensure local privilege fallback settings are configured as a backup in case the external authorization server is unavailable, and hpSwitchAuthorizationMIBCompliances defines which conformance level a given switch implementation supports.

What Can Be Monitored

authorization server IP address and type
authorization server notification/trap enable state
local privilege configuration settings
conformance/compliance level supported

Imported Objects

From HP-ICF-OID

hpSwitch

OBJECT-IDENTITY

From INET-ADDRESS-MIB

InetAddress
InetAddressType

From Q-BRIDGE-MIB

VlanIndex

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Integer32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE

From SNMPv2-TC

RowStatus
TEXTUAL-CONVENTION
TruthValue

OIDs

OID symbolic	OID numeric	Type	Access	Description
hpicfSwitchAuthObjects	1.3.6.1.4.1.11.2.14.11.5.1.32.1.2
hpicfSwitchAuthorizationNotificationGroup	1.3.6.1.4.1.11.2.14.11.5.1.32.2.2.2			A group of switch authorization notifications.
hpicfSwitchAuthorizationNotifications	1.3.6.1.4.1.11.2.14.11.5.1.32.0
hpicfSwitchAuthorizationObjectsGroup	1.3.6.1.4.1.11.2.14.11.5.1.32.2.2.3			A group of switch authorization objects.
NTF hpicfSwitchAuthServerFail	1.3.6.1.4.1.11.2.14.11.5.1.32.0.1			This notification indicates that the specified server is not reachable.
IP hpicfSwitchAuthServerIP	1.3.6.1.4.1.11.2.14.11.5.1.32.1.2.3	InetAddress	accessible-for-notify	This object is used in an hpicfSwitchAuthorizationNotification to report the IP address of the affected server.
IPt hpicfSwitchAuthServerIPType	1.3.6.1.4.1.11.2.14.11.5.1.32.1.2.2	InetAddressType	accessible-for-notify	InetAddressType of the address reported in hpicfSwitchAuthServerIP.
INT hpicfSwitchAuthServerNotifyEnable	1.3.6.1.4.1.11.2.14.11.5.1.32.1.3.1	INTEGER	read-write	The operational status of hpicfSwitchAuthServerFail notifications. The default value is 1 (Enabled). A value of 2 represents Disabled. Writing this object requires authentication, such as provided by SNMPv3.
INT hpicfSwitchAuthServerType	1.3.6.1.4.1.11.2.14.11.5.1.32.1.2.1	INTEGER	accessible-for-notify	Authorization server type reported in hpicfSwitchAuthorization notifications.
hpSwitchAuthConfigObjects	1.3.6.1.4.1.11.2.14.11.5.1.32.1.3
hpSwitchAuthLocalPrivConfigObjects	1.3.6.1.4.1.11.2.14.11.5.1.32.1.4
hpSwitchAuthorizationConfig	1.3.6.1.4.1.11.2.14.11.5.1.32.1
hpSwitchAuthorizationConfigGroup	1.3.6.1.4.1.11.2.14.11.5.1.32.2.2.1			A collection of objects to support authorization service.
hpSwitchAuthorizationConformance	1.3.6.1.4.1.11.2.14.11.5.1.32.2
hpSwitchAuthorizationMIB	1.3.6.1.4.1.11.2.14.11.5.1.32			This MIB module contains the definitions of objects for managing the user authorization service on HP networking devices.
hpSwitchAuthorizationMIBCompliance	1.3.6.1.4.1.11.2.14.11.5.1.32.2.1.1			The compliance statement for devices implementing the HP-AUTZ-MIB.
hpSwitchAuthorizationMIBCompliances	1.3.6.1.4.1.11.2.14.11.5.1.32.2.1
hpSwitchAuthorizationMIBGroups	1.3.6.1.4.1.11.2.14.11.5.1.32.2.2
hpSwitchAuthorizationNotificationGrpMIBCompliance	1.3.6.1.4.1.11.2.14.11.5.1.32.2.1.5			The compliance statement for listing the local management privilege methods to be tried for granting different access levels through various access tasks
hpSwitchAuthorizationObjectsGrpMIBCompliance	1.3.6.1.4.1.11.2.14.11.5.1.32.2.1.4			The compliance statement for listing the local management privilege methods to be tried for granting different access levels through various access tasks
hpSwitchAutzLocalMgmtPrivGroup	1.3.6.1.4.1.11.2.14.11.5.1.32.2.2.4			A collection of objects for configuring Local Manangement Privilege Groups
hpSwitchAutzLocalMgmtPrivGroup1	1.3.6.1.4.1.11.2.14.11.5.1.32.2.2.5			A collection of objects for configuring Local Mangement Privilege Groups
hpSwitchAutzRoleGrpCompliance	1.3.6.1.4.1.11.2.14.11.5.1.32.2.1.6			The compliance statement for user roles.
hpSwitchAutzRoleGrpCompliance1	1.3.6.1.4.1.11.2.14.11.5.1.32.2.1.7			The compliance statement for user roles.
hpSwitchAutzRoleGrpCompliance2	1.3.6.1.4.1.11.2.14.11.5.1.32.2.1.8			The compliance statement for user roles.
hpSwitchAutzRoleGrpCompliance3	1.3.6.1.4.1.11.2.14.11.5.1.32.2.1.9			The compliance statement for user roles.
INT hpSwitchAutzServiceCommandsLevel	1.3.6.1.4.1.11.2.14.11.5.1.32.1.1.1.4	INTEGER	read-write	This object specifies the command level that requires authorization. A value of all (1) indicates that authorization is required for all commands. A value of managerLevelOnly (2) indicates that the authorization is required only for manager level commands. This object is only valid when the value of hpSwitchAutzServiceType is 'commands'. The default is 'all'.
hpSwitchAutzServiceEntry	1.3.6.1.4.1.11.2.14.11.5.1.32.1.1.1		not-accessible	An entry (conceptual row) in the hpSwitchAutzServiceTable.
INT hpSwitchAutzServicePrimaryMethod	1.3.6.1.4.1.11.2.14.11.5.1.32.1.1.1.2	INTEGER	read-write	The primary method used for authorization. This object can be set only when the authorization service type is command. A value of local (1) indicates that authorization is performed locally. A value of tacacs (2) indicates that authorization is performed using TACACS+. A value of radius (3) indicates that authorization is performed using RADIUS. A value of none (4) indicates that authorization is not performed. A value of auto (5) indicates that authorization is performed by the same protocol that is configured for authentication.
INT hpSwitchAutzServiceSecondaryMethod	1.3.6.1.4.1.11.2.14.11.5.1.32.1.1.1.3	INTEGER	read-write	Specifies the secondary (backup) method used for authorization.
hpSwitchAutzServiceTable	1.3.6.1.4.1.11.2.14.11.5.1.32.1.1		not-accessible	The (conceptual) table listing the authorization service types.
INT hpSwitchAutzServiceType	1.3.6.1.4.1.11.2.14.11.5.1.32.1.1.1.1	INTEGER	not-accessible	Signifies the authorization service type for which this entry contains configuration information.
hpSwitchAutzUserRole	1.3.6.1.4.1.11.2.14.11.5.1.32.1.5
OCT hpSwitchAutzUserRoleCaptivePortalProfileName	1.3.6.1.4.1.11.2.14.11.5.1.32.1.5.3.1.4	OCTET STRING	read-create	The name of the captive portal profile (hpicfUsrAuthCaptivePortalProfileName) associated with this role. All printable ASCII characters are allowed except '.', ' ', and '~'.
T/F hpSwitchAutzUserRoleDownloadedEnabled	1.3.6.1.4.1.11.2.14.11.5.1.32.1.5.4	TruthValue	read-write	This object enables or disables the downlodable user role feature. The hpSwitchAutzUserRoleEnabled object should be enabled before configuring this object.
T/F hpSwitchAutzUserRoleEnabled	1.3.6.1.4.1.11.2.14.11.5.1.32.1.5.1	TruthValue	read-write	Enable user role-based authorization. When enabled, authenticated clients are assigned roles that determine authorization level. When disabled, roles are not used.
hpSwitchAutzUserRoleEntry	1.3.6.1.4.1.11.2.14.11.5.1.32.1.5.3.1		not-accessible	A user role table entry.
hpSwitchAutzUserRoleGroup	1.3.6.1.4.1.11.2.14.11.5.1.32.2.2.6			A collection of objects for supporting local user roles.
hpSwitchAutzUserRoleGroup1	1.3.6.1.4.1.11.2.14.11.5.1.32.2.2.7			A collection of objects for supporting local user roles.
hpSwitchAutzUserRoleGroup2	1.3.6.1.4.1.11.2.14.11.5.1.32.2.2.8			A collection of objects for supporting local user roles.
hpSwitchAutzUserRoleGroup3	1.3.6.1.4.1.11.2.14.11.5.1.32.2.2.9			A collection of objects for supporting local user roles.
OCT hpSwitchAutzUserRoleIngressUserPolicyName	1.3.6.1.4.1.11.2.14.11.5.1.32.1.5.3.1.5	OCTET STRING	read-create	The name associated with hpicfGppcv2NpPolicyName of hpicfGppcv2NpSubType 'policyUser' assigned to this role.
HPA hpSwitchAutzUserRoleInitialRoleName	1.3.6.1.4.1.11.2.14.11.5.1.32.1.5.2	HpAutzUserRoleName	read-write	The value of this object must match the hpSwitchAutzUserRoleName of an entry in the hpSwithcAutzUserRoleTable.
HPA hpSwitchAutzUserRoleName	1.3.6.1.4.1.11.2.14.11.5.1.32.1.5.3.1.1	HpAutzUserRoleName	not-accessible	The name of this user role.
I32 hpSwitchAutzUserRoleReauthPeriod	1.3.6.1.4.1.11.2.14.11.5.1.32.1.5.3.1.6	Integer32	read-create	Specifies the period, in seconds, at which an authenticated client must re-authenticate. A value of 0 signifies that an authenticated client will never have to re-authenticate.
ROW hpSwitchAutzUserRoleRowStatus	1.3.6.1.4.1.11.2.14.11.5.1.32.1.5.3.1.2	RowStatus	read-create	The Row Status of this entry. To create a new entry, send an SNMP SET request with a RowStatus of 'createAndGo'. active - the entry is ready to use. notInService - not valid for this table. notReady - the entry is not fully configured. createAndGo - create a new entry. Entries of hpSwitchAutzUserRoleType 'downloaded' cannot be created or modified. createAndWait - not valid for this table. delete - delete the entry. Entries of hpSwitchAutzUserRoleType 'predefined' and the entry assigned to hpSwitchAutzUserRoleInitialRoleName cannot be deleted.
hpSwitchAutzUserRoleTable	1.3.6.1.4.1.11.2.14.11.5.1.32.1.5.3		not-accessible	A table of configured user roles. The maximum number of entries is implementation dependent.
VLA hpSwitchAutzUserRoleTaggedVlanId	1.3.6.1.4.1.11.2.14.11.5.1.32.1.5.3.1.11	VlanIndex	read-create	The tagged VLAN ID for this role. A value of 0 indicates unset. This column is mutually exclusive with hpSwitchAutzUserRoleTaggedVlanName,.
STR hpSwitchAutzUserRoleTaggedVlanName	1.3.6.1.4.1.11.2.14.11.5.1.32.1.5.3.1.12	SnmpAdminString	read-create	The tagged VLAN name for this role. This column is mutually exclusive with hpSwitchAutzUserRoleTaggedVlanId.
INT hpSwitchAutzUserRoleTunneledNodeServerRedirect	1.3.6.1.4.1.11.2.14.11.5.1.32.1.5.3.1.9	INTEGER	read-create	Enables or disables the traffic redirection to the tunnel. If the MIB object 'hpSwitchAutzUserRoleCaptivePortalProfileName' is already enabled and an attempt is made to enable this object, it will result in an error. The MIB object can be enabled only if there is a tagged or untagged VLAN present in the user role.
OCT hpSwitchAutzUserRoleTunneledNodeServerSecondaryRole	1.3.6.1.4.1.11.2.14.11.5.1.32.1.5.3.1.10	OCTET STRING	read-create	The secondary role associated with this user role. This will be applied to user traffic at tunnel-node server end. All printable ASCII characters are allowed except '.', ' ' and '~'. This object returns an error if the secondary role name is greater than 63 characters.
INT hpSwitchAutzUserRoleType	1.3.6.1.4.1.11.2.14.11.5.1.32.1.5.3.1.3	INTEGER	read-only	This object defines different user role types supported. Predefined user roles cannot be modified or deleted. Downloaded user roles cannot be modified or created.
VLA hpSwitchAutzUserRoleVlanId	1.3.6.1.4.1.11.2.14.11.5.1.32.1.5.3.1.7	VlanIndex	read-create	The untagged VLAN ID for this role. A value of 0 indicates unset. This column is mutually exclusive with hpSwitchAutzUserRoleVlanName.
STR hpSwitchAutzUserRoleVlanName	1.3.6.1.4.1.11.2.14.11.5.1.32.1.5.3.1.8	SnmpAdminString	read-create	The untagged VLAN name for this role. This column is mutually exclusive with hpSwitchAutzUserRoleVlanId.
OCT hpSwitchLocalMgmtPrivCmdMatchStr	1.3.6.1.4.1.11.2.14.11.5.1.32.1.4.2.1.2	OCTET STRING	read-create	The syntax of a command within a group. See the documentation for the maximum length of the command name.
INT hpSwitchLocalMgmtPrivCmdPriv	1.3.6.1.4.1.11.2.14.11.5.1.32.1.4.2.1.3	INTEGER	read-create	The privilege associated with commands that match the command string.
INT hpSwitchLocalMgmtPrivCmdSendLog	1.3.6.1.4.1.11.2.14.11.5.1.32.1.4.2.1.4	INTEGER	read-create	Determines if a log message is generated when commands matching this command string are attempted.
I32 hpSwitchLocalMgmtPrivCmdSequenceIndex	1.3.6.1.4.1.11.2.14.11.5.1.32.1.4.2.1.1	Integer32	not-accessible	The index value which uniquely identifies a row in the command table. See the documentation for the number of sequences allowed.
ROW hpSwitchLocalMgmtPrivCmdStatus	1.3.6.1.4.1.11.2.14.11.5.1.32.1.4.2.1.5	RowStatus	read-create	The status of the local management privilege command row.
hpSwitchLocalMgmtPrivCommandsEntry	1.3.6.1.4.1.11.2.14.11.5.1.32.1.4.2.1		not-accessible	Local Management Commands entry.
hpSwitchLocalMgmtPrivCommandsTable	1.3.6.1.4.1.11.2.14.11.5.1.32.1.4.2		not-accessible	This table lists the local management Privilege Command Match strings.
I32 hpSwitchLocalMgmtPrivGroupIndex	1.3.6.1.4.1.11.2.14.11.5.1.32.1.4.1.1.1	Integer32	not-accessible	The index value which uniquely identifies a row in the group table. The values, One (1) is reserved for a predefined manager group, Two (2) is reserved for usernames that are not assigned to a group. The privileges for usernames that do not have a group assignment is the same as operator'.
OCT hpSwitchLocalMgmtPrivGroupName	1.3.6.1.4.1.11.2.14.11.5.1.32.1.4.1.1.2	OCTET STRING	read-create	The name of a given Local Management server group.
hpSwitchLocalMgmtPrivGroupsEntry	1.3.6.1.4.1.11.2.14.11.5.1.32.1.4.1.1		not-accessible	Local Management Groups entry.
hpSwitchLocalMgmtPrivGroupsTable	1.3.6.1.4.1.11.2.14.11.5.1.32.1.4.1		not-accessible	This table lists the local management privilege group names.
ROW hpSwitchLocalMgmtPrivGroupStatus	1.3.6.1.4.1.11.2.14.11.5.1.32.1.4.1.1.3	RowStatus	read-create	The status of the local management privilege group row.
hpSwitchLocalMgmtPrivGrpMIBCompliance	1.3.6.1.4.1.11.2.14.11.5.1.32.2.1.2			The compliance statement for listing the local management privilege methods to be tried for granting different access levels through various access tasks
hpSwitchLocalMgmtPrivGrpMIBCompliance1	1.3.6.1.4.1.11.2.14.11.5.1.32.2.1.3			The compliance statement for listing the local management privilege methods to be tried for granting different access levels through various access tasks

RFC description

HP/HPE switch authorization MIB providing read/write access to switch authentication configuration and security settings via SNMP.

Start monitoring HP ProCurve switch (user authorization service) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download HP-AUTZ-MIB

What Is HP-AUTZ-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description