JUNIPER-USER-AAA-MIB

All MIBs › JUNIPER-USER-AAA-MIB

Organization: Juniper Networks, Inc.

Last Updated: 2013-07-10

Category: Domain: Subscriber Management, RADIUS and AAA, Vendor: Juniper

Description: Juniper Networks MIB for monitoring user Authentication, Authorization, and Accounting (AAA) session statistics on Juniper platforms.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is JUNIPER-USER-AAA-MIB?

JUNIPER-USER-AAA-MIB is a Juniper Networks enterprise MIB defining objects for monitoring user Authentication, Authorization, and Accounting (AAA) session activity on Juniper platforms. It is intended to expose statistics and status related to user login sessions, authentication attempts, authorization decisions, and accounting records processed by the device's AAA subsystem (commonly backed by RADIUS or TACACS+). Its monitoring value is software/service status: tracking authentication success/failure counts and active session counts would reveal AAA server connectivity problems, authentication attack attempts, or session-capacity issues, though no concrete sample objects were supplied for this module. AAA functionality conceptually relies on standard protocols such as RADIUS and TACACS+, though no explicit MIB-level dependency is stated in the module description. It is deployed on Juniper routers, switches, and security appliances configured with centralized AAA for administrative or subscriber access control. Network engineers evaluating or troubleshooting this functionality can download the JUNIPER-USER-AAA-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in JUNIPER-USER-AAA-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Juniper Networks routers
Juniper Networks switches
Juniper Networks security appliances

Monitoring Examples

No sample object names were provided for this module, so specific table or counter names cannot be confirmed from source; the module description only indicates it covers user authentication, authorization, and accounting objects. In practice an administrator would expect to poll authentication success/failure and active-session counters to detect a spike in failed logins (a possible brute-force attempt) or an AAA server outage on a Juniper device, but naming exact objects here would be speculative given the lack of grounding data.

Imported Objects

From INET-ADDRESS-MIB

InetAddress
InetAddressPrefixLength
InetAddressType

From IPV6-TC

Ipv6Address
Ipv6AddressIfIdentifier
Ipv6AddressPrefix

From JUNIPER-MIMSTP-MIB

EnabledStatus

From JUNIPER-SMI

jnxUserAAAMibRoot

OBJECT-IDENTITY

From SNMPv2-SMI

Counter32
Counter64
Integer32
IpAddress
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DisplayString
RowStatus
TEXTUAL-CONVENTION
TruthValue

OIDs

OID symbolic	OID numeric	Type	Access	Description
NTF jnxAccessAuthAddressPoolAbateThreshold	1.3.6.1.4.1.2636.3.51.1.0.6			An access authentication trap signifies that the address pool has reached its abate threshold
NTF jnxAccessAuthAddressPoolHighThreshold	1.3.6.1.4.1.2636.3.51.1.0.5			An access authentication trap signifies that the address pool has reached its high threshold.
NTF jnxAccessAuthAddressPoolOutOfAddresses	1.3.6.1.4.1.2636.3.51.1.0.7			An access authentication trap signifies that an Out Of Addresses event occured on the pool.
NTF jnxAccessAuthAddressPoolOutOfMemory	1.3.6.1.4.1.2636.3.51.1.0.8			An access authentication trap signifies that an Out Of Memory event occured on the pool.
NTF jnxAccessAuthServerDisabled	1.3.6.1.4.1.2636.3.51.1.0.3			An access authentication trap signifies that the External authentication server is not responding.
NTF jnxAccessAuthServerEnabled	1.3.6.1.4.1.2636.3.51.1.0.4			An access authentication trap signifies that the AAA client has changed the status of the External authentication server to UP.
NTF jnxAccessAuthServiceDown	1.3.6.1.4.1.2636.3.51.1.0.2			An access authentication trap signifies that the specified service has been stopped.
NTF jnxAccessAuthServiceUp	1.3.6.1.4.1.2636.3.51.1.0.1			An access authentication trap signifies that the specified service has started.
C64 jnxTotalAuthenticationRequests	1.3.6.1.4.1.2636.3.51.1.1.1.1	Counter64	read-only	Total authentication requests received.
C64 jnxTotalAuthenticationResponses	1.3.6.1.4.1.2636.3.51.1.1.1.2	Counter64	read-only	Total authentication responses.
jnxUserAAAAccessAuthStats	1.3.6.1.4.1.2636.3.51.1.1.2
jnxUserAAAAccessPool	1.3.6.1.4.1.2636.3.51.1.1.4
C64 jnxUserAAAAccessPoolAddressesInUse	1.3.6.1.4.1.2636.3.51.1.1.4.1.1.1.11	Counter64	read-only	The total number of Addresses or prefixes given out from this pool.
C64 jnxUserAAAAccessPoolAddressTotal	1.3.6.1.4.1.2636.3.51.1.1.4.1.1.1.10	Counter64	read-only	The total number of Addresses or prefixes in this pool.
INT jnxUserAAAAccessPoolAddressUsage	1.3.6.1.4.1.2636.3.51.1.1.4.1.1.1.12	INTEGER	read-only	The percentage of addresses used in this pool or linked pool. If this pool is the head of a linked chain of pools, this number reflects the Usage for the whole chain. Conversely, if this pool it part of a linked chain of pools but not the head of the chain, the value will not be used.
INT jnxUserAAAAccessPoolAddressUsageAbate	1.3.6.1.4.1.2636.3.51.1.1.4.1.1.1.14	INTEGER	read-only	The configured abate percentage threshold of addresses used in this pool or linked pool. An SNMP trap clear is generated when address use falls below this threshold percentage. This trap will only be generated for unlinked pools or pools that are the head of a linked chain of pools Conversely, if this pool it part of a linked chain of pools but not the head of the chain, then no traps will be generated.
INT jnxUserAAAAccessPoolAddressUsageHigh	1.3.6.1.4.1.2636.3.51.1.1.4.1.1.1.13	INTEGER	read-only	The configured high percentage threshold of addresses used in this pool or linked pool. An SNMP trap is generated when this threshold is exceeded. This trap will only be generated for unlinked pools or pools that are the head of a linked chain of pools Conversely, if this pool it part of a linked chain of pools but not the head of the chain, then no traps will be generated.
jnxUserAAAAccessPoolEntry	1.3.6.1.4.1.2636.3.51.1.1.4.1.1.1		not-accessible	A read-only description of the local address pools.
IPt jnxUserAAAAccessPoolFamilyType	1.3.6.1.4.1.2636.3.51.1.1.4.1.1.1.5	InetAddressType	read-only	The family type of this pool.
jnxUserAAAAccessPoolGeneral	1.3.6.1.4.1.2636.3.51.1.1.4.1
U32 jnxUserAAAAccessPoolIdent	1.3.6.1.4.1.2636.3.51.1.1.4.1.1.1.1	Unsigned32	not-accessible	The address identifier key.
IP jnxUserAAAAccessPoolInetNetwork	1.3.6.1.4.1.2636.3.51.1.1.4.1.1.1.6	InetAddress	read-only	The Match criteria for this pool. Network or Prefix
ADR jnxUserAAAAccessPoolInetPrefixLength	1.3.6.1.4.1.2636.3.51.1.1.4.1.1.1.7	InetAddressPrefixLength	read-only	The Prefix Length for an IPv6 pool
STR jnxUserAAAAccessPoolLinkName	1.3.6.1.4.1.2636.3.51.1.1.4.1.1.1.4	DisplayString	read-only	The address pool link name.
STR jnxUserAAAAccessPoolName	1.3.6.1.4.1.2636.3.51.1.1.4.1.1.1.3	DisplayString	read-only	The address pool name.
C64 jnxUserAAAAccessPoolOutOfAddresses	1.3.6.1.4.1.2636.3.51.1.1.4.1.1.1.9	Counter64	read-only	The Number of times this pool has flagged an Out of Address condition.
C64 jnxUserAAAAccessPoolOutOfMemory	1.3.6.1.4.1.2636.3.51.1.1.4.1.1.1.8	Counter64	read-only	The Number of times this pool has flagged an Out of Memory condition.
STR jnxUserAAAAccessPoolRoutingInstance	1.3.6.1.4.1.2636.3.51.1.1.4.1.1.1.2	DisplayString	read-only	The routing instance of the address pool.
jnxUserAAAAccessPoolTable	1.3.6.1.4.1.2636.3.51.1.1.4.1.1		not-accessible	The entries in this table specify the address pools.
jnxUserAAAAccessProfile	1.3.6.1.4.1.2636.3.51.1.1.6
OCT jnxUserAAAAccessProfileAccountingOrder	1.3.6.1.4.1.2636.3.51.1.1.6.1.1.1.3	OCTET STRING	read-only	The set of accounting mechanisms configured on this system. Each octet in this object contains one of the values defined in the JnxAccountingType TEXTUAL-CONVENTION. The system will sequence through each octet of this object starting at octet 1 and attempt to use the corresponding accounting protocol defined by JnxAccountingType. If an accounting protocol is configured and attempts to reach the accounting server fail, the system will move to the next octet in this object and retry the accounting in the form dictated by the corresponding accounting protocoltype. The process of sequencing thru each octet will stop if the accounting server is successfully contacted, or there are no more configured octets in this object.
T/F jnxUserAAAAccessProfileAccStopOnDeny	1.3.6.1.4.1.2636.3.51.1.1.6.1.1.1.7	TruthValue	read-only	Enables/disables the Acct-Stop message if AAA-server denies access.
T/F jnxUserAAAAccessProfileAccStopOnFailure	1.3.6.1.4.1.2636.3.51.1.1.6.1.1.1.6	TruthValue	read-only	Enables/disables the Acct-Stop message if a user fails authentication, but AAA-server grants access.
OCT jnxUserAAAAccessProfileAuthenticationOrder	1.3.6.1.4.1.2636.3.51.1.1.6.1.1.1.2	OCTET STRING	read-only	The set of authentication mechanisms configured on this system. Each octet in this object contains one of the values defined in the JnxAuthenticateType TEXTUAL-CONVENTION. The system will sequence through each octet of this object starting at octet 1 and attempt to use the corresponding authentication protocol defined by JnxAuthenticateType. If an authentication protocol is configured and attempts to reach the authentication server fail, the system will move to the next octet in this object and retry the authentication in the form dictated by the corresponding authentication protocoltype. The process of sequencing thru each octet will stop if the authentication server is successfully contacted, or there are no more configured octets in this object.
OCT jnxUserAAAAccessProfileAuthorizationOrder	1.3.6.1.4.1.2636.3.51.1.1.6.1.1.1.4	OCTET STRING	read-only	The set of accounting mechanisms configured on this system. Each octet in this object contains one of the values defined in the JnxAuthorizationType TEXTUAL-CONVENTION. The system will sequence through each octet of this object starting at octet 1 and attempt to use the corresponding accounting protocol defined by JnxAuthorizationType. If an accounting protocol is configured and attempts to reach the accounting server fail, the system will move to the next octet in this object and retry the accounting in the form dictated by the corresponding accounting protocoltype. The process of sequencing thru each octet will stop if the accounting server is successfully contacted, or there are no more configured octets in this object.
T/F jnxUserAAAAccessProfileCoaImmediateUpdate	1.3.6.1.4.1.2636.3.51.1.1.6.1.1.1.9	TruthValue	read-only	Enables/disables the Acct-Update message on completion of processing a change of authorization.
jnxUserAAAAccessProfileEntry	1.3.6.1.4.1.2636.3.51.1.1.6.1.1.1		not-accessible	A specification of the authentication methods for a particular subscriber type.
jnxUserAAAAccessProfileGeneral	1.3.6.1.4.1.2636.3.51.1.1.6.1
T/F jnxUserAAAAccessProfileImmediateUpdate	1.3.6.1.4.1.2636.3.51.1.1.6.1.1.1.8	TruthValue	read-only	Enables/disables the Acct-Update message on receipt of a Acct-response for the Acct-Start message.
I32 jnxUserAAAAccessProfileInterval	1.3.6.1.4.1.2636.3.51.1.1.6.1.1.1.10	Integer32	read-only	The interval in minutes between accounting updates(Interim-stats off, if not specified).
STR jnxUserAAAAccessProfileName	1.3.6.1.4.1.2636.3.51.1.1.6.1.1.1.1	DisplayString	not-accessible	The access profile name.
OCT jnxUserAAAAccessProfileProvisioningOrder	1.3.6.1.4.1.2636.3.51.1.1.6.1.1.1.5	OCTET STRING	read-only	The set of provisioning mechanisms configured on this system. Each octet in this object contains one of the values defined in the JnxProvisioningType TEXTUAL-CONVENTION. The system will sequence through each octet of this object starting at octet 1 and attempt to use the corresponding accounting protocol defined by JnxProvisioningType. If an accounting protocol is configured and attempts to reach the accounting server fail, the system will move to the next octet in this object and retry the accounting in the form dictated by the corresponding accounting protocoltype. The process of sequencing thru each octet will stop if the accounting server is successfully contacted, or there are no more configured octets in this object.
INT jnxUserAAAAccessProfileStatType	1.3.6.1.4.1.2636.3.51.1.1.6.1.1.1.11	INTEGER	read-only	The type of statistics are collected. These are the configured types: time - the option to report only uptime volume-time - the option to report both volume and uptime
jnxUserAAAAccessProfileTable	1.3.6.1.4.1.2636.3.51.1.1.6.1.1		not-accessible	The entries in this table specify the assignment of authentication methods for a particular subscriber type.
STR jnxUserAAAAddressPoolName	1.3.6.1.4.1.2636.3.51.1.1.3.2	DisplayString	accessible-for-notify	The address pool name which identifies the local address pool.
jnxUserAAAAssignment	1.3.6.1.4.1.2636.3.51.1.1.5
jnxUserAAADomain	1.3.6.1.4.1.2636.3.51.1.1.5.2
STR jnxUserAAADomainAddrPoolName	1.3.6.1.4.1.2636.3.51.1.1.5.2.1.1.5	DisplayString	read-only	The configured the address-pool-name for the domain name.
STR jnxUserAAADomainDelimiters	1.3.6.1.4.1.2636.3.51.1.1.5.1.1	DisplayString	read-only	The list of delimiters used to separate the user's name from the user's domain in the username field. The default is '@'.
STR jnxUserAAADomainDynamicPorfile	1.3.6.1.4.1.2636.3.51.1.1.5.2.1.1.6	DisplayString	read-only	The configured dynamic-profile which will be used for this session upon succeeding validation.
STR jnxUserAAADomainDynamicProfile	1.3.6.1.4.1.2636.3.51.1.1.5.2.1.1.10	DisplayString	read-only	The configured dynamic-profile to be used for this session.
jnxUserAAADomainEntry	1.3.6.1.4.1.2636.3.51.1.1.5.2.1.1		not-accessible	A specification of the logical system to which users on a specified domain should be assigned.
STR jnxUserAAADomainLogicalSystem	1.3.6.1.4.1.2636.3.51.1.1.5.2.1.1.3	DisplayString	read-only	The name of the logical system, which will be used by the AAA subsystem for this session. If not specified, will be mapped to default.
STR jnxUserAAADomainName	1.3.6.1.4.1.2636.3.51.1.1.5.2.1.1.1	DisplayString	not-accessible	The domain name uniquely identifying this entry.
T/F jnxUserAAADomainOverridePassword	1.3.6.1.4.1.2636.3.51.1.1.5.2.1.1.12	TruthValue	read-only	Displays the override-password configuration.
I32 jnxUserAAADomainPadnDistance	1.3.6.1.4.1.2636.3.51.1.1.5.2.3.1.3	Integer32	read-only	The administrative distance metric of this entry.
jnxUserAAADomainPadnEntry	1.3.6.1.4.1.2636.3.51.1.1.5.2.3.1		not-accessible	A specification of the PPPoE active discovery network parameters associated with a domain.
IP jnxUserAAADomainPadnIpAddress	1.3.6.1.4.1.2636.3.51.1.1.5.2.3.1.1	IpAddress	not-accessible	The IP address of this entry.
IP jnxUserAAADomainPadnIpMask	1.3.6.1.4.1.2636.3.51.1.1.5.2.3.1.2	IpAddress	not-accessible	The IP mask of this entry.
jnxUserAAADomainPadnTable	1.3.6.1.4.1.2636.3.51.1.1.5.2.3		not-accessible	The entries in this table specify the PPPoE active discovery network (PADN) parameters associated with a domain.
INT jnxUserAAADomainParseDirection	1.3.6.1.4.1.2636.3.51.1.1.5.1.2	INTEGER	read-only	The direction in which the user's name is parsed: either search for domain delimiter from left to right or right to left; first delimiter marks boundry. The default is right to left.
STR jnxUserAAADomainRoutingInstance	1.3.6.1.4.1.2636.3.51.1.1.5.2.1.1.4	DisplayString	read-only	The name of the routing instance, which will be used by the AAA subsystem for this session. If not specified, will be mapped to default.
T/F jnxUserAAADomainStripDomain	1.3.6.1.4.1.2636.3.51.1.1.5.2.1.1.2	TruthValue	read-only	Enables/disables the domain name stripping feature, which causes the system to strip the domain name before sending the access-request to RADIUS for authentication.
INT jnxUserAAADomainStripUsername	1.3.6.1.4.1.2636.3.51.1.1.5.2.1.1.11	INTEGER	read-only	Displays the strip-username configuration.
jnxUserAAADomainTable	1.3.6.1.4.1.2636.3.51.1.1.5.2.1		not-accessible	The entries in this table specify the assignment of a remote access user to a logical system, based on the user's domain.
STR jnxUserAAADomainTargetLogicalSystem	1.3.6.1.4.1.2636.3.51.1.1.5.2.1.1.7	DisplayString	read-only	The configured target logical-system that this session will need to be mapped to. If not specified, will be mapped to default.
STR jnxUserAAADomainTargetRoutingInstance	1.3.6.1.4.1.2636.3.51.1.1.5.2.1.1.8	DisplayString	read-only	The configured routing-instance that this session will need to be mapped to.
I32 jnxUserAAADomainTunnelDefId	1.3.6.1.4.1.2636.3.51.1.1.5.2.2.1.2	Integer32	not-accessible	The tunnel definition id value associated with this entry.
jnxUserAAADomainTunnelEntry	1.3.6.1.4.1.2636.3.51.1.1.5.2.2.1		not-accessible	A specification of the tunnels associated with a domain.
STR jnxUserAAADomainTunnelId	1.3.6.1.4.1.2636.3.51.1.1.5.2.2.1.13	DisplayString	read-only	The tunnel identifier associated with this entry.
STR jnxUserAAADomainTunnelLogicalSystems	1.3.6.1.4.1.2636.3.51.1.1.5.2.2.1.9	DisplayString	read-only	The logical systems associated with this entty.
U32 jnxUserAAADomainTunnelMaxSessions	1.3.6.1.4.1.2636.3.51.1.1.5.2.2.1.14	Unsigned32	read-only	The maximum number of tunnel sessions allowed in this tunnel entry.
INT jnxUserAAADomainTunnelMedium	1.3.6.1.4.1.2636.3.51.1.1.5.2.2.1.11	INTEGER	read-only	The tunnel medium associated with this entry. The medium dictates the format of the tunnel address.
OCT jnxUserAAADomainTunnelName	1.3.6.1.4.1.2636.3.51.1.1.5.2.2.1.1	OCTET STRING	not-accessible	The domain name associated with this entry.
I32 jnxUserAAADomainTunnelPreference	1.3.6.1.4.1.2636.3.51.1.1.5.2.2.1.3	Integer32	read-only	The tunnel's preference value associated with this entry.
STR jnxUserAAADomainTunnelProfile	1.3.6.1.4.1.2636.3.51.1.1.5.2.1.1.9	DisplayString	read-only	The associated tunnel profile.
IP jnxUserAAADomainTunnelRemoteGwAddress	1.3.6.1.4.1.2636.3.51.1.1.5.2.2.1.5	IpAddress	read-only	IP address of LNS tunnel endpoint
STR jnxUserAAADomainTunnelRemoteGwName	1.3.6.1.4.1.2636.3.51.1.1.5.2.2.1.4	DisplayString	read-only	This name specifies the hostname expected from the peer (the LNS) when a tunnel is setup.
STR jnxUserAAADomainTunnelRoutingInstance	1.3.6.1.4.1.2636.3.51.1.1.5.2.2.1.10	DisplayString	read-only	The routing instance associated with this entty.
STR jnxUserAAADomainTunnelSecret	1.3.6.1.4.1.2636.3.51.1.1.5.2.2.1.8	DisplayString	read-only	The tunnel password associated with this entry.
IP jnxUserAAADomainTunnelSourceGwAddress	1.3.6.1.4.1.2636.3.51.1.1.5.2.2.1.7	IpAddress	read-only	The source address of the tunnel (overrides the default address for this LS/RI.)
STR jnxUserAAADomainTunnelSourceGwName	1.3.6.1.4.1.2636.3.51.1.1.5.2.2.1.6	DisplayString	read-only	This name specifies the hostname expected from the peer (the LNS) when a tunnel is setup.
jnxUserAAADomainTunnelTable	1.3.6.1.4.1.2636.3.51.1.1.5.2.2		not-accessible	The entries in this table specify the tunnels associated with a domain.
INT jnxUserAAADomainTunnelType	1.3.6.1.4.1.2636.3.51.1.1.5.2.2.1.12	INTEGER	read-only	The tunnel type associated with this entry.
jnxUserAAAGeneral	1.3.6.1.4.1.2636.3.51.1.1.5.1
jnxUserAAAGlobalStats	1.3.6.1.4.1.2636.3.51.1.1.1
jnxUserAAAMib	1.3.6.1.4.1.2636.3.51.1			This module defines the objects pertaining to User authentication, authorization and accounting
jnxUserAAANotifications	1.3.6.1.4.1.2636.3.51.1.0
jnxUserAAAObjects	1.3.6.1.4.1.2636.3.51.1.1
STR jnxUserAAAServerName	1.3.6.1.4.1.2636.3.51.1.1.3.1	DisplayString	accessible-for-notify	The server name which identifies the authentication server.
C64 jnxUserAAAStatAccessAccepted	1.3.6.1.4.1.2636.3.51.1.1.2.1.1.3	Counter64	read-only	The number of access granted. It is an aggregated statistics for this type of authenticaiton.
C64 jnxUserAAAStatAccessRejected	1.3.6.1.4.1.2636.3.51.1.1.2.1.1.4	Counter64	read-only	This number of access request rejected. It is an aggregated statistics for this type of authentication.
JNX jnxUserAAAStatAuthType	1.3.6.1.4.1.2636.3.51.1.1.2.1.1.1	JnxAuthenticateType	not-accessible	The entry indicates the authentication type. It uniquely identifies the statistics counters related to its authentication.
jnxUserAAAStatEntry	1.3.6.1.4.1.2636.3.51.1.1.2.1.1		not-accessible	Statistic entry collects for authentication.
C64 jnxUserAAAStatRequestReceived	1.3.6.1.4.1.2636.3.51.1.1.2.1.1.2	Counter64	read-only	The number of request received.
jnxUserAAAStatTable	1.3.6.1.4.1.2636.3.51.1.1.2.1		not-accessible	This table exposes the user authentication statistics.
jnxUserAAATrapVars	1.3.6.1.4.1.2636.3.51.1.1.3

RFC description

Manages user authentication, authorization, and accounting (AAA) configuration on Juniper Networks devices with domain and tunnel support.

Start monitoring Juniper Networks router/switch/security appliance (user AAA session monitoring) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download JUNIPER-USER-AAA-MIB

What Is JUNIPER-USER-AAA-MIB?

Supported Devices

Monitoring Examples

This MIB depends on

Related MIBs

RFC description