All MIBs › HP-AUTZ-MIB
Organization: HP Networking
Last Updated: 2017-03-16
Category: Domain: Security, RADIUS and AAA, Vendor: HP/HPE
Description:
HP SNMP MIB (hpSwitchAuthorizationMIB) providing authorization policy management for HP ProCurve switches.
Imported Objects
From HP-ICF-OID
| hpSwitch | OBJECT-IDENTITY |
From INET-ADDRESS-MIB
| InetAddress | |
| InetAddressType |
From Q-BRIDGE-MIB
| VlanIndex |
From SNMP-FRAMEWORK-MIB
| SnmpAdminString |
From SNMPv2-CONF
| MODULE-COMPLIANCE | |
| NOTIFICATION-GROUP | |
| OBJECT-GROUP |
From SNMPv2-SMI
| Integer32 | |
| MODULE-IDENTITY | |
| NOTIFICATION-TYPE | |
| OBJECT-TYPE |
From SNMPv2-TC
| RowStatus | |
| TEXTUAL-CONVENTION | |
| TruthValue |
What Is HP-AUTZ-MIB?
HP-AUTZ-MIB (internally hpSwitchAuthorizationMIB) is an HP-proprietary SNMP module for managing user authorization services, such as external authorization/RADIUS-style server settings and local privilege configuration, on HP ProCurve networking switches. It exposes configuration objects for authorization servers (server IP/type, notification enable) and local privilege settings, structured under config-object groups with associated conformance/compliance statements. As a monitoring MIB its value is mostly around software/service configuration status rather than hardware health: hpicfSwitchAuthServerIP and hpicfSwitchAuthServerIPType let an operator confirm which authorization server is configured and reachable, while hpicfSwitchAuthServerNotifyEnable indicates whether the switch will trap on authorization-server-related events, useful for catching an authorization service outage. HP-AUTZ-MIB SNMP monitoring is thus primarily a matter of confirming authorization service reachability and configuration consistency rather than tracking hardware sensors. It is a vendor-specific extension that complements, rather than replaces, standard AAA-related MIBs used elsewhere in HP's ProCurve MIB family. It is deployed on HP ProCurve switches in enterprise networks that enforce centralized user authorization for administrative or network access control.
IPNetwork Monitor allows you to monitor SNMP objects defined in HP-AUTZ-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.
What Can Be Monitored
- authorization server IP address and type
- authorization server notification/trap enable state
- local privilege configuration settings
- conformance/compliance level supported
Supported Devices
- HP ProCurve switches
Monitoring Examples
An operator would check hpicfSwitchAuthServerIPType and hpicfSwitchAuthServerIP to verify the configured authorization server address is correct and of the expected address family, and confirm hpicfSwitchAuthServerNotifyEnable is set so that the switch will notify the NMS if that server becomes unreachable. The hpSwitchAuthConfigObjects and hpSwitchAuthLocalPrivConfigObjects groups would be reviewed together to ensure local privilege fallback settings are configured as a backup in case the external authorization server is unavailable, and hpSwitchAuthorizationMIBCompliances defines which conformance level a given switch implementation supports.
OIDs
| OID symbolic | OID numeric | Type | Access | Description |
|---|---|---|---|---|
| hpSwitchAuthorizationMIB | 1.3.6.1.4.1.11.2.14.11.5.1.32 | This MIB module contains the definitions of objects for managing the user authorization service on HP networking devices. | ||
| hpicfSwitchAuthorizationNotifications | 1.3.6.1.4.1.11.2.14.11.5.1.32.0 | |||
| NTF hpicfSwitchAuthServerFail | 1.3.6.1.4.1.11.2.14.11.5.1.32.0.1 | This notification indicates that the specified server is not reachable. | ||
| hpSwitchAuthorizationConfig | 1.3.6.1.4.1.11.2.14.11.5.1.32.1 | |||
| hpSwitchAutzServiceTable | 1.3.6.1.4.1.11.2.14.11.5.1.32.1.1 | not-accessible | The (conceptual) table listing the authorization service types. | |
| hpSwitchAutzServiceEntry | 1.3.6.1.4.1.11.2.14.11.5.1.32.1.1.1 | not-accessible | An entry (conceptual row) in the hpSwitchAutzServiceTable. | |
| INT hpSwitchAutzServiceType | 1.3.6.1.4.1.11.2.14.11.5.1.32.1.1.1.1 | INTEGER | not-accessible | Signifies the authorization service type for which this entry contains configuration information. |
| INT hpSwitchAutzServicePrimaryMethod | 1.3.6.1.4.1.11.2.14.11.5.1.32.1.1.1.2 | INTEGER | read-write | The primary method used for authorization. This object can be set only when the authorization service type is command. A value of local (1) indicates that authorization is performed locally. A value of tacacs (2) indicates that authorization is performed using TACACS+. A value of radius (3) indicates that authorization is performed using RADIUS. A value of none (4) indicates that authorization is not performed. A value of auto (5) indicates that authorization is performed by the same protocol that is configured for authentication. |
| INT hpSwitchAutzServiceSecondaryMethod | 1.3.6.1.4.1.11.2.14.11.5.1.32.1.1.1.3 | INTEGER | read-write | Specifies the secondary (backup) method used for authorization. |
| INT hpSwitchAutzServiceCommandsLevel | 1.3.6.1.4.1.11.2.14.11.5.1.32.1.1.1.4 | INTEGER | read-write | This object specifies the command level that requires authorization. A value of all (1) indicates that authorization is required for all commands. A value of managerLevelOnly (2) indicates that the authorization is required only for manager level commands. This object is only valid when the value of hpSwitchAutzServiceType is 'commands'. The default is 'all'. |
| hpicfSwitchAuthObjects | 1.3.6.1.4.1.11.2.14.11.5.1.32.1.2 | |||
| INT hpicfSwitchAuthServerType | 1.3.6.1.4.1.11.2.14.11.5.1.32.1.2.1 | INTEGER | accessible-for-notify | Authorization server type reported in hpicfSwitchAuthorization notifications. |
| IPt hpicfSwitchAuthServerIPType | 1.3.6.1.4.1.11.2.14.11.5.1.32.1.2.2 | InetAddressType | accessible-for-notify | InetAddressType of the address reported in hpicfSwitchAuthServerIP. |
| IP hpicfSwitchAuthServerIP | 1.3.6.1.4.1.11.2.14.11.5.1.32.1.2.3 | InetAddress | accessible-for-notify | This object is used in an hpicfSwitchAuthorizationNotification to report the IP address of the affected server. |
| hpSwitchAuthConfigObjects | 1.3.6.1.4.1.11.2.14.11.5.1.32.1.3 | |||
| INT hpicfSwitchAuthServerNotifyEnable | 1.3.6.1.4.1.11.2.14.11.5.1.32.1.3.1 | INTEGER | read-write | The operational status of hpicfSwitchAuthServerFail notifications. The default value is 1 (Enabled). A value of 2 represents Disabled. Writing this object requires authentication, such as provided by SNMPv3. |
| hpSwitchAuthLocalPrivConfigObjects | 1.3.6.1.4.1.11.2.14.11.5.1.32.1.4 | |||
| hpSwitchLocalMgmtPrivGroupsTable | 1.3.6.1.4.1.11.2.14.11.5.1.32.1.4.1 | not-accessible | This table lists the local management privilege group names. | |
| hpSwitchLocalMgmtPrivGroupsEntry | 1.3.6.1.4.1.11.2.14.11.5.1.32.1.4.1.1 | not-accessible | Local Management Groups entry. | |
| I32 hpSwitchLocalMgmtPrivGroupIndex | 1.3.6.1.4.1.11.2.14.11.5.1.32.1.4.1.1.1 | Integer32 | not-accessible | The index value which uniquely identifies a row in the group table. The values, One (1) is reserved for a predefined manager group, Two (2) is reserved for usernames that are not assigned to a group. The privileges for usernames that do not have a group assignment is the same as operator'. |
| OCT hpSwitchLocalMgmtPrivGroupName | 1.3.6.1.4.1.11.2.14.11.5.1.32.1.4.1.1.2 | OCTET STRING | read-create | The name of a given Local Management server group. |
| ROW hpSwitchLocalMgmtPrivGroupStatus | 1.3.6.1.4.1.11.2.14.11.5.1.32.1.4.1.1.3 | RowStatus | read-create | The status of the local management privilege group row. |
| hpSwitchLocalMgmtPrivCommandsTable | 1.3.6.1.4.1.11.2.14.11.5.1.32.1.4.2 | not-accessible | This table lists the local management Privilege Command Match strings. | |
| hpSwitchLocalMgmtPrivCommandsEntry | 1.3.6.1.4.1.11.2.14.11.5.1.32.1.4.2.1 | not-accessible | Local Management Commands entry. | |
| I32 hpSwitchLocalMgmtPrivCmdSequenceIndex | 1.3.6.1.4.1.11.2.14.11.5.1.32.1.4.2.1.1 | Integer32 | not-accessible | The index value which uniquely identifies a row in the command table. See the documentation for the number of sequences allowed. |
| OCT hpSwitchLocalMgmtPrivCmdMatchStr | 1.3.6.1.4.1.11.2.14.11.5.1.32.1.4.2.1.2 | OCTET STRING | read-create | The syntax of a command within a group. See the documentation for the maximum length of the command name. |
| INT hpSwitchLocalMgmtPrivCmdPriv | 1.3.6.1.4.1.11.2.14.11.5.1.32.1.4.2.1.3 | INTEGER | read-create | The privilege associated with commands that match the command string. |
| INT hpSwitchLocalMgmtPrivCmdSendLog | 1.3.6.1.4.1.11.2.14.11.5.1.32.1.4.2.1.4 | INTEGER | read-create | Determines if a log message is generated when commands matching this command string are attempted. |
| ROW hpSwitchLocalMgmtPrivCmdStatus | 1.3.6.1.4.1.11.2.14.11.5.1.32.1.4.2.1.5 | RowStatus | read-create | The status of the local management privilege command row. |
| hpSwitchAutzUserRole | 1.3.6.1.4.1.11.2.14.11.5.1.32.1.5 | |||
| T/F hpSwitchAutzUserRoleEnabled | 1.3.6.1.4.1.11.2.14.11.5.1.32.1.5.1 | TruthValue | read-write | Enable user role-based authorization. When enabled, authenticated clients are assigned roles that determine authorization level. When disabled, roles are not used. |
| HPA hpSwitchAutzUserRoleInitialRoleName | 1.3.6.1.4.1.11.2.14.11.5.1.32.1.5.2 | HpAutzUserRoleName | read-write | The value of this object must match the hpSwitchAutzUserRoleName of an entry in the hpSwithcAutzUserRoleTable. |
| hpSwitchAutzUserRoleTable | 1.3.6.1.4.1.11.2.14.11.5.1.32.1.5.3 | not-accessible | A table of configured user roles. The maximum number of entries is implementation dependent. | |
| hpSwitchAutzUserRoleEntry | 1.3.6.1.4.1.11.2.14.11.5.1.32.1.5.3.1 | not-accessible | A user role table entry. | |
| HPA hpSwitchAutzUserRoleName | 1.3.6.1.4.1.11.2.14.11.5.1.32.1.5.3.1.1 | HpAutzUserRoleName | not-accessible | The name of this user role. |
| ROW hpSwitchAutzUserRoleRowStatus | 1.3.6.1.4.1.11.2.14.11.5.1.32.1.5.3.1.2 | RowStatus | read-create | The Row Status of this entry. To create a new entry, send an SNMP SET request with a RowStatus of 'createAndGo'. active - the entry is ready to use. notInService - not valid for this table. notReady - the entry is not fully configured. createAndGo - create a new entry. Entries of hpSwitchAutzUserRoleType 'downloaded' cannot be created or modified. createAndWait - not valid for this table. delete - delete the entry. Entries of hpSwitchAutzUserRoleType 'predefined' and the entry assigned to hpSwitchAutzUserRoleInitialRoleName cannot be deleted. |
| INT hpSwitchAutzUserRoleType | 1.3.6.1.4.1.11.2.14.11.5.1.32.1.5.3.1.3 | INTEGER | read-only | This object defines different user role types supported. Predefined user roles cannot be modified or deleted. Downloaded user roles cannot be modified or created. |
| OCT hpSwitchAutzUserRoleCaptivePortalProfileName | 1.3.6.1.4.1.11.2.14.11.5.1.32.1.5.3.1.4 | OCTET STRING | read-create | The name of the captive portal profile (hpicfUsrAuthCaptivePortalProfileName) associated with this role. All printable ASCII characters are allowed except '.', ' ', and '~'. |
| OCT hpSwitchAutzUserRoleIngressUserPolicyName | 1.3.6.1.4.1.11.2.14.11.5.1.32.1.5.3.1.5 | OCTET STRING | read-create | The name associated with hpicfGppcv2NpPolicyName of hpicfGppcv2NpSubType 'policyUser' assigned to this role. |
| I32 hpSwitchAutzUserRoleReauthPeriod | 1.3.6.1.4.1.11.2.14.11.5.1.32.1.5.3.1.6 | Integer32 | read-create | Specifies the period, in seconds, at which an authenticated client must re-authenticate. A value of 0 signifies that an authenticated client will never have to re-authenticate. |
| VLA hpSwitchAutzUserRoleVlanId | 1.3.6.1.4.1.11.2.14.11.5.1.32.1.5.3.1.7 | VlanIndex | read-create | The untagged VLAN ID for this role. A value of 0 indicates unset. This column is mutually exclusive with hpSwitchAutzUserRoleVlanName. |
| STR hpSwitchAutzUserRoleVlanName | 1.3.6.1.4.1.11.2.14.11.5.1.32.1.5.3.1.8 | SnmpAdminString | read-create | The untagged VLAN name for this role. This column is mutually exclusive with hpSwitchAutzUserRoleVlanId. |
| INT hpSwitchAutzUserRoleTunneledNodeServerRedirect | 1.3.6.1.4.1.11.2.14.11.5.1.32.1.5.3.1.9 | INTEGER | read-create | Enables or disables the traffic redirection to the tunnel. If the MIB object 'hpSwitchAutzUserRoleCaptivePortalProfileName' is already enabled and an attempt is made to enable this object, it will result in an error. The MIB object can be enabled only if there is a tagged or untagged VLAN present in the user role. |
| OCT hpSwitchAutzUserRoleTunneledNodeServerSecondaryRole | 1.3.6.1.4.1.11.2.14.11.5.1.32.1.5.3.1.10 | OCTET STRING | read-create | The secondary role associated with this user role. This will be applied to user traffic at tunnel-node server end. All printable ASCII characters are allowed except '.', ' ' and '~'. This object returns an error if the secondary role name is greater than 63 characters. |
| VLA hpSwitchAutzUserRoleTaggedVlanId | 1.3.6.1.4.1.11.2.14.11.5.1.32.1.5.3.1.11 | VlanIndex | read-create | The tagged VLAN ID for this role. A value of 0 indicates unset. This column is mutually exclusive with hpSwitchAutzUserRoleTaggedVlanName,. |
| STR hpSwitchAutzUserRoleTaggedVlanName | 1.3.6.1.4.1.11.2.14.11.5.1.32.1.5.3.1.12 | SnmpAdminString | read-create | The tagged VLAN name for this role. This column is mutually exclusive with hpSwitchAutzUserRoleTaggedVlanId. |
| T/F hpSwitchAutzUserRoleDownloadedEnabled | 1.3.6.1.4.1.11.2.14.11.5.1.32.1.5.4 | TruthValue | read-write | This object enables or disables the downlodable user role feature. The hpSwitchAutzUserRoleEnabled object should be enabled before configuring this object. |
| hpSwitchAuthorizationConformance | 1.3.6.1.4.1.11.2.14.11.5.1.32.2 | |||
| hpSwitchAuthorizationMIBCompliances | 1.3.6.1.4.1.11.2.14.11.5.1.32.2.1 | |||
| hpSwitchAuthorizationMIBCompliance | 1.3.6.1.4.1.11.2.14.11.5.1.32.2.1.1 | The compliance statement for devices implementing the HP-AUTZ-MIB. | ||
| hpSwitchLocalMgmtPrivGrpMIBCompliance | 1.3.6.1.4.1.11.2.14.11.5.1.32.2.1.2 | The compliance statement for listing the local management privilege methods to be tried for granting different access levels through various access tasks | ||
| hpSwitchLocalMgmtPrivGrpMIBCompliance1 | 1.3.6.1.4.1.11.2.14.11.5.1.32.2.1.3 | The compliance statement for listing the local management privilege methods to be tried for granting different access levels through various access tasks | ||
| hpSwitchAuthorizationObjectsGrpMIBCompliance | 1.3.6.1.4.1.11.2.14.11.5.1.32.2.1.4 | The compliance statement for listing the local management privilege methods to be tried for granting different access levels through various access tasks | ||
| hpSwitchAuthorizationNotificationGrpMIBCompliance | 1.3.6.1.4.1.11.2.14.11.5.1.32.2.1.5 | The compliance statement for listing the local management privilege methods to be tried for granting different access levels through various access tasks | ||
| hpSwitchAutzRoleGrpCompliance | 1.3.6.1.4.1.11.2.14.11.5.1.32.2.1.6 | The compliance statement for user roles. | ||
| hpSwitchAutzRoleGrpCompliance1 | 1.3.6.1.4.1.11.2.14.11.5.1.32.2.1.7 | The compliance statement for user roles. | ||
| hpSwitchAutzRoleGrpCompliance2 | 1.3.6.1.4.1.11.2.14.11.5.1.32.2.1.8 | The compliance statement for user roles. | ||
| hpSwitchAutzRoleGrpCompliance3 | 1.3.6.1.4.1.11.2.14.11.5.1.32.2.1.9 | The compliance statement for user roles. | ||
| hpSwitchAuthorizationMIBGroups | 1.3.6.1.4.1.11.2.14.11.5.1.32.2.2 | |||
| hpSwitchAuthorizationConfigGroup | 1.3.6.1.4.1.11.2.14.11.5.1.32.2.2.1 | A collection of objects to support authorization service. | ||
| hpicfSwitchAuthorizationNotificationGroup | 1.3.6.1.4.1.11.2.14.11.5.1.32.2.2.2 | A group of switch authorization notifications. | ||
| hpicfSwitchAuthorizationObjectsGroup | 1.3.6.1.4.1.11.2.14.11.5.1.32.2.2.3 | A group of switch authorization objects. | ||
| hpSwitchAutzLocalMgmtPrivGroup | 1.3.6.1.4.1.11.2.14.11.5.1.32.2.2.4 | A collection of objects for configuring Local Manangement Privilege Groups | ||
| hpSwitchAutzLocalMgmtPrivGroup1 | 1.3.6.1.4.1.11.2.14.11.5.1.32.2.2.5 | A collection of objects for configuring Local Mangement Privilege Groups | ||
| hpSwitchAutzUserRoleGroup | 1.3.6.1.4.1.11.2.14.11.5.1.32.2.2.6 | A collection of objects for supporting local user roles. | ||
| hpSwitchAutzUserRoleGroup1 | 1.3.6.1.4.1.11.2.14.11.5.1.32.2.2.7 | A collection of objects for supporting local user roles. | ||
| hpSwitchAutzUserRoleGroup2 | 1.3.6.1.4.1.11.2.14.11.5.1.32.2.2.8 | A collection of objects for supporting local user roles. | ||
| hpSwitchAutzUserRoleGroup3 | 1.3.6.1.4.1.11.2.14.11.5.1.32.2.2.9 | A collection of objects for supporting local user roles. |
RFC description
HP/HPE switch authorization MIB providing read/write access to switch authentication configuration and security settings via SNMP.
Start monitoring HP ProCurve switch (user authorization service) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.