HP-AUTZ-MIB

MIB Reference — IPNetwork Monitor

All MIBsHP-AUTZ-MIB

Organization: HP Networking

Last Updated: 2017-03-16

Category: Domain: Security, RADIUS and AAA, Vendor: HP/HPE

Description:

HP SNMP MIB (hpSwitchAuthorizationMIB) providing authorization policy management for HP ProCurve switches.

Imported Objects

From HP-ICF-OID

hpSwitchOBJECT-IDENTITY

From INET-ADDRESS-MIB

InetAddress
InetAddressType

From Q-BRIDGE-MIB

VlanIndex

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Integer32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE

From SNMPv2-TC

RowStatus
TEXTUAL-CONVENTION
TruthValue

What Is HP-AUTZ-MIB?

HP-AUTZ-MIB (internally hpSwitchAuthorizationMIB) is an HP-proprietary SNMP module for managing user authorization services, such as external authorization/RADIUS-style server settings and local privilege configuration, on HP ProCurve networking switches. It exposes configuration objects for authorization servers (server IP/type, notification enable) and local privilege settings, structured under config-object groups with associated conformance/compliance statements. As a monitoring MIB its value is mostly around software/service configuration status rather than hardware health: hpicfSwitchAuthServerIP and hpicfSwitchAuthServerIPType let an operator confirm which authorization server is configured and reachable, while hpicfSwitchAuthServerNotifyEnable indicates whether the switch will trap on authorization-server-related events, useful for catching an authorization service outage. HP-AUTZ-MIB SNMP monitoring is thus primarily a matter of confirming authorization service reachability and configuration consistency rather than tracking hardware sensors. It is a vendor-specific extension that complements, rather than replaces, standard AAA-related MIBs used elsewhere in HP's ProCurve MIB family. It is deployed on HP ProCurve switches in enterprise networks that enforce centralized user authorization for administrative or network access control.

IPNetwork Monitor allows you to monitor SNMP objects defined in HP-AUTZ-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

What Can Be Monitored

  • authorization server IP address and type
  • authorization server notification/trap enable state
  • local privilege configuration settings
  • conformance/compliance level supported

Supported Devices

  • HP ProCurve switches

Monitoring Examples

An operator would check hpicfSwitchAuthServerIPType and hpicfSwitchAuthServerIP to verify the configured authorization server address is correct and of the expected address family, and confirm hpicfSwitchAuthServerNotifyEnable is set so that the switch will notify the NMS if that server becomes unreachable. The hpSwitchAuthConfigObjects and hpSwitchAuthLocalPrivConfigObjects groups would be reviewed together to ensure local privilege fallback settings are configured as a backup in case the external authorization server is unavailable, and hpSwitchAuthorizationMIBCompliances defines which conformance level a given switch implementation supports.

OIDs
OID symbolicOID numericTypeAccessDescription
hpSwitchAuthorizationMIB1.3.6.1.4.1.11.2.14.11.5.1.32This MIB module contains the definitions of objects for managing the user authorization service on HP networking devices.
hpicfSwitchAuthorizationNotifications1.3.6.1.4.1.11.2.14.11.5.1.32.0
NTF hpicfSwitchAuthServerFail1.3.6.1.4.1.11.2.14.11.5.1.32.0.1This notification indicates that the specified server is not reachable.
hpSwitchAuthorizationConfig1.3.6.1.4.1.11.2.14.11.5.1.32.1
hpSwitchAutzServiceTable1.3.6.1.4.1.11.2.14.11.5.1.32.1.1not-accessibleThe (conceptual) table listing the authorization service types.
hpSwitchAutzServiceEntry1.3.6.1.4.1.11.2.14.11.5.1.32.1.1.1not-accessibleAn entry (conceptual row) in the hpSwitchAutzServiceTable.
INT hpSwitchAutzServiceType1.3.6.1.4.1.11.2.14.11.5.1.32.1.1.1.1INTEGERnot-accessibleSignifies the authorization service type for which this entry contains configuration information.
INT hpSwitchAutzServicePrimaryMethod1.3.6.1.4.1.11.2.14.11.5.1.32.1.1.1.2INTEGERread-writeThe primary method used for authorization. This object can be set only when the authorization service type is command. A value of local (1) indicates that authorization is performed locally. A value of tacacs (2) indicates that authorization is performed using TACACS+. A value of radius (3) indicates that authorization is performed using RADIUS. A value of none (4) indicates that authorization is not performed. A value of auto (5) indicates that authorization is performed by the same protocol that is configured for authentication.
INT hpSwitchAutzServiceSecondaryMethod1.3.6.1.4.1.11.2.14.11.5.1.32.1.1.1.3INTEGERread-writeSpecifies the secondary (backup) method used for authorization.
INT hpSwitchAutzServiceCommandsLevel1.3.6.1.4.1.11.2.14.11.5.1.32.1.1.1.4INTEGERread-writeThis object specifies the command level that requires authorization. A value of all (1) indicates that authorization is required for all commands. A value of managerLevelOnly (2) indicates that the authorization is required only for manager level commands. This object is only valid when the value of hpSwitchAutzServiceType is 'commands'. The default is 'all'.
hpicfSwitchAuthObjects1.3.6.1.4.1.11.2.14.11.5.1.32.1.2
INT hpicfSwitchAuthServerType1.3.6.1.4.1.11.2.14.11.5.1.32.1.2.1INTEGERaccessible-for-notifyAuthorization server type reported in hpicfSwitchAuthorization notifications.
IPt hpicfSwitchAuthServerIPType1.3.6.1.4.1.11.2.14.11.5.1.32.1.2.2InetAddressTypeaccessible-for-notifyInetAddressType of the address reported in hpicfSwitchAuthServerIP.
IP hpicfSwitchAuthServerIP1.3.6.1.4.1.11.2.14.11.5.1.32.1.2.3InetAddressaccessible-for-notifyThis object is used in an hpicfSwitchAuthorizationNotification to report the IP address of the affected server.
hpSwitchAuthConfigObjects1.3.6.1.4.1.11.2.14.11.5.1.32.1.3
INT hpicfSwitchAuthServerNotifyEnable1.3.6.1.4.1.11.2.14.11.5.1.32.1.3.1INTEGERread-writeThe operational status of hpicfSwitchAuthServerFail notifications. The default value is 1 (Enabled). A value of 2 represents Disabled. Writing this object requires authentication, such as provided by SNMPv3.
hpSwitchAuthLocalPrivConfigObjects1.3.6.1.4.1.11.2.14.11.5.1.32.1.4
hpSwitchLocalMgmtPrivGroupsTable1.3.6.1.4.1.11.2.14.11.5.1.32.1.4.1not-accessibleThis table lists the local management privilege group names.
hpSwitchLocalMgmtPrivGroupsEntry1.3.6.1.4.1.11.2.14.11.5.1.32.1.4.1.1not-accessibleLocal Management Groups entry.
I32 hpSwitchLocalMgmtPrivGroupIndex1.3.6.1.4.1.11.2.14.11.5.1.32.1.4.1.1.1Integer32not-accessibleThe index value which uniquely identifies a row in the group table. The values, One (1) is reserved for a predefined manager group, Two (2) is reserved for usernames that are not assigned to a group. The privileges for usernames that do not have a group assignment is the same as operator'.
OCT hpSwitchLocalMgmtPrivGroupName1.3.6.1.4.1.11.2.14.11.5.1.32.1.4.1.1.2OCTET STRINGread-createThe name of a given Local Management server group.
ROW hpSwitchLocalMgmtPrivGroupStatus1.3.6.1.4.1.11.2.14.11.5.1.32.1.4.1.1.3RowStatusread-createThe status of the local management privilege group row.
hpSwitchLocalMgmtPrivCommandsTable1.3.6.1.4.1.11.2.14.11.5.1.32.1.4.2not-accessibleThis table lists the local management Privilege Command Match strings.
hpSwitchLocalMgmtPrivCommandsEntry1.3.6.1.4.1.11.2.14.11.5.1.32.1.4.2.1not-accessibleLocal Management Commands entry.
I32 hpSwitchLocalMgmtPrivCmdSequenceIndex1.3.6.1.4.1.11.2.14.11.5.1.32.1.4.2.1.1Integer32not-accessibleThe index value which uniquely identifies a row in the command table. See the documentation for the number of sequences allowed.
OCT hpSwitchLocalMgmtPrivCmdMatchStr1.3.6.1.4.1.11.2.14.11.5.1.32.1.4.2.1.2OCTET STRINGread-createThe syntax of a command within a group. See the documentation for the maximum length of the command name.
INT hpSwitchLocalMgmtPrivCmdPriv1.3.6.1.4.1.11.2.14.11.5.1.32.1.4.2.1.3INTEGERread-createThe privilege associated with commands that match the command string.
INT hpSwitchLocalMgmtPrivCmdSendLog1.3.6.1.4.1.11.2.14.11.5.1.32.1.4.2.1.4INTEGERread-createDetermines if a log message is generated when commands matching this command string are attempted.
ROW hpSwitchLocalMgmtPrivCmdStatus1.3.6.1.4.1.11.2.14.11.5.1.32.1.4.2.1.5RowStatusread-createThe status of the local management privilege command row.
hpSwitchAutzUserRole1.3.6.1.4.1.11.2.14.11.5.1.32.1.5
T/F hpSwitchAutzUserRoleEnabled1.3.6.1.4.1.11.2.14.11.5.1.32.1.5.1TruthValueread-writeEnable user role-based authorization. When enabled, authenticated clients are assigned roles that determine authorization level. When disabled, roles are not used.
HPA hpSwitchAutzUserRoleInitialRoleName1.3.6.1.4.1.11.2.14.11.5.1.32.1.5.2HpAutzUserRoleNameread-writeThe value of this object must match the hpSwitchAutzUserRoleName of an entry in the hpSwithcAutzUserRoleTable.
hpSwitchAutzUserRoleTable1.3.6.1.4.1.11.2.14.11.5.1.32.1.5.3not-accessibleA table of configured user roles. The maximum number of entries is implementation dependent.
hpSwitchAutzUserRoleEntry1.3.6.1.4.1.11.2.14.11.5.1.32.1.5.3.1not-accessibleA user role table entry.
HPA hpSwitchAutzUserRoleName1.3.6.1.4.1.11.2.14.11.5.1.32.1.5.3.1.1HpAutzUserRoleNamenot-accessibleThe name of this user role.
ROW hpSwitchAutzUserRoleRowStatus1.3.6.1.4.1.11.2.14.11.5.1.32.1.5.3.1.2RowStatusread-createThe Row Status of this entry. To create a new entry, send an SNMP SET request with a RowStatus of 'createAndGo'. active - the entry is ready to use. notInService - not valid for this table. notReady - the entry is not fully configured. createAndGo - create a new entry. Entries of hpSwitchAutzUserRoleType 'downloaded' cannot be created or modified. createAndWait - not valid for this table. delete - delete the entry. Entries of hpSwitchAutzUserRoleType 'predefined' and the entry assigned to hpSwitchAutzUserRoleInitialRoleName cannot be deleted.
INT hpSwitchAutzUserRoleType1.3.6.1.4.1.11.2.14.11.5.1.32.1.5.3.1.3INTEGERread-onlyThis object defines different user role types supported. Predefined user roles cannot be modified or deleted. Downloaded user roles cannot be modified or created.
OCT hpSwitchAutzUserRoleCaptivePortalProfileName1.3.6.1.4.1.11.2.14.11.5.1.32.1.5.3.1.4OCTET STRINGread-createThe name of the captive portal profile (hpicfUsrAuthCaptivePortalProfileName) associated with this role. All printable ASCII characters are allowed except '.', ' ', and '~'.
OCT hpSwitchAutzUserRoleIngressUserPolicyName1.3.6.1.4.1.11.2.14.11.5.1.32.1.5.3.1.5OCTET STRINGread-createThe name associated with hpicfGppcv2NpPolicyName of hpicfGppcv2NpSubType 'policyUser' assigned to this role.
I32 hpSwitchAutzUserRoleReauthPeriod1.3.6.1.4.1.11.2.14.11.5.1.32.1.5.3.1.6Integer32read-createSpecifies the period, in seconds, at which an authenticated client must re-authenticate. A value of 0 signifies that an authenticated client will never have to re-authenticate.
VLA hpSwitchAutzUserRoleVlanId1.3.6.1.4.1.11.2.14.11.5.1.32.1.5.3.1.7VlanIndexread-createThe untagged VLAN ID for this role. A value of 0 indicates unset. This column is mutually exclusive with hpSwitchAutzUserRoleVlanName.
STR hpSwitchAutzUserRoleVlanName1.3.6.1.4.1.11.2.14.11.5.1.32.1.5.3.1.8SnmpAdminStringread-createThe untagged VLAN name for this role. This column is mutually exclusive with hpSwitchAutzUserRoleVlanId.
INT hpSwitchAutzUserRoleTunneledNodeServerRedirect1.3.6.1.4.1.11.2.14.11.5.1.32.1.5.3.1.9INTEGERread-createEnables or disables the traffic redirection to the tunnel. If the MIB object 'hpSwitchAutzUserRoleCaptivePortalProfileName' is already enabled and an attempt is made to enable this object, it will result in an error. The MIB object can be enabled only if there is a tagged or untagged VLAN present in the user role.
OCT hpSwitchAutzUserRoleTunneledNodeServerSecondaryRole1.3.6.1.4.1.11.2.14.11.5.1.32.1.5.3.1.10OCTET STRINGread-createThe secondary role associated with this user role. This will be applied to user traffic at tunnel-node server end. All printable ASCII characters are allowed except '.', ' ' and '~'. This object returns an error if the secondary role name is greater than 63 characters.
VLA hpSwitchAutzUserRoleTaggedVlanId1.3.6.1.4.1.11.2.14.11.5.1.32.1.5.3.1.11VlanIndexread-createThe tagged VLAN ID for this role. A value of 0 indicates unset. This column is mutually exclusive with hpSwitchAutzUserRoleTaggedVlanName,.
STR hpSwitchAutzUserRoleTaggedVlanName1.3.6.1.4.1.11.2.14.11.5.1.32.1.5.3.1.12SnmpAdminStringread-createThe tagged VLAN name for this role. This column is mutually exclusive with hpSwitchAutzUserRoleTaggedVlanId.
T/F hpSwitchAutzUserRoleDownloadedEnabled1.3.6.1.4.1.11.2.14.11.5.1.32.1.5.4TruthValueread-writeThis object enables or disables the downlodable user role feature. The hpSwitchAutzUserRoleEnabled object should be enabled before configuring this object.
hpSwitchAuthorizationConformance1.3.6.1.4.1.11.2.14.11.5.1.32.2
hpSwitchAuthorizationMIBCompliances1.3.6.1.4.1.11.2.14.11.5.1.32.2.1
hpSwitchAuthorizationMIBCompliance1.3.6.1.4.1.11.2.14.11.5.1.32.2.1.1The compliance statement for devices implementing the HP-AUTZ-MIB.
hpSwitchLocalMgmtPrivGrpMIBCompliance1.3.6.1.4.1.11.2.14.11.5.1.32.2.1.2The compliance statement for listing the local management privilege methods to be tried for granting different access levels through various access tasks
hpSwitchLocalMgmtPrivGrpMIBCompliance11.3.6.1.4.1.11.2.14.11.5.1.32.2.1.3The compliance statement for listing the local management privilege methods to be tried for granting different access levels through various access tasks
hpSwitchAuthorizationObjectsGrpMIBCompliance1.3.6.1.4.1.11.2.14.11.5.1.32.2.1.4The compliance statement for listing the local management privilege methods to be tried for granting different access levels through various access tasks
hpSwitchAuthorizationNotificationGrpMIBCompliance1.3.6.1.4.1.11.2.14.11.5.1.32.2.1.5The compliance statement for listing the local management privilege methods to be tried for granting different access levels through various access tasks
hpSwitchAutzRoleGrpCompliance1.3.6.1.4.1.11.2.14.11.5.1.32.2.1.6The compliance statement for user roles.
hpSwitchAutzRoleGrpCompliance11.3.6.1.4.1.11.2.14.11.5.1.32.2.1.7The compliance statement for user roles.
hpSwitchAutzRoleGrpCompliance21.3.6.1.4.1.11.2.14.11.5.1.32.2.1.8The compliance statement for user roles.
hpSwitchAutzRoleGrpCompliance31.3.6.1.4.1.11.2.14.11.5.1.32.2.1.9The compliance statement for user roles.
hpSwitchAuthorizationMIBGroups1.3.6.1.4.1.11.2.14.11.5.1.32.2.2
hpSwitchAuthorizationConfigGroup1.3.6.1.4.1.11.2.14.11.5.1.32.2.2.1A collection of objects to support authorization service.
hpicfSwitchAuthorizationNotificationGroup1.3.6.1.4.1.11.2.14.11.5.1.32.2.2.2A group of switch authorization notifications.
hpicfSwitchAuthorizationObjectsGroup1.3.6.1.4.1.11.2.14.11.5.1.32.2.2.3A group of switch authorization objects.
hpSwitchAutzLocalMgmtPrivGroup1.3.6.1.4.1.11.2.14.11.5.1.32.2.2.4A collection of objects for configuring Local Manangement Privilege Groups
hpSwitchAutzLocalMgmtPrivGroup11.3.6.1.4.1.11.2.14.11.5.1.32.2.2.5A collection of objects for configuring Local Mangement Privilege Groups
hpSwitchAutzUserRoleGroup1.3.6.1.4.1.11.2.14.11.5.1.32.2.2.6A collection of objects for supporting local user roles.
hpSwitchAutzUserRoleGroup11.3.6.1.4.1.11.2.14.11.5.1.32.2.2.7A collection of objects for supporting local user roles.
hpSwitchAutzUserRoleGroup21.3.6.1.4.1.11.2.14.11.5.1.32.2.2.8A collection of objects for supporting local user roles.
hpSwitchAutzUserRoleGroup31.3.6.1.4.1.11.2.14.11.5.1.32.2.2.9A collection of objects for supporting local user roles.

RFC description

HP/HPE switch authorization MIB providing read/write access to switch authentication configuration and security settings via SNMP.

Start monitoring HP ProCurve switch (user authorization service) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download HP-AUTZ-MIB