Juniper-TACACS-Plus-Client-MIB

All MIBs › Juniper-TACACS-Plus-Client-MIB

Organization: Juniper Networks, Inc.

Last Updated: 2004-03-02

Category: Protocol: TACACS, RADIUS and AAA, Vendor: Juniper

Description: Juniper Networks MIB for managing TACACS+ client configuration and authentication server access on Juniper E-series routers.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is Juniper-TACACS-Plus-Client-MIB?

Juniper-TACACS-Plus-Client-MIB is a Juniper Networks enterprise MIB for configuring the TACACS+ client used for centralized authentication and authorization of administrative access to JUNOSe E-series routers. It exposes global client settings (timeout, shared key, source IP, directed-request behavior) and a table of configured TACACS+ server hosts with per-host address, port, primary/backup designation, single-connection mode, timeout, and key. Its monitoring value is verifying the software/service configuration of the admin-AAA path: confirming which host is primary versus backup and whether shared keys and timeouts are correctly set helps diagnose administrative login failures, a software-availability issue rather than a hardware one. It relates conceptually to the standard TACACS+ protocol (RFC 8907) client behavior, paralleling how RADIUS client MIBs are structured, though it is a proprietary Juniper module. It is typically deployed on routers and switches using TACACS+ for admin AAA in enterprise or service-provider networks, where Juniper-TACACS-Plus-Client-MIB SNMP monitoring helps confirm the authentication path stays correctly configured.

IPNetwork Monitor allows you to monitor SNMP objects defined in Juniper-TACACS-Plus-Client-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Juniper E-series router (JUNOSe)

Monitoring Examples

Troubleshooting failed device logins, an admin can check juniTacacsPlusClientHostConfigTable entries (juniTacacsPlusClientHostAddr, juniTacacsPlusClientHostPort, juniTacacsPlusClientHostPrimary) to verify the primary TACACS+ server is correctly configured, and compare juniTacacsPlusClientTimeout against juniTacacsPlusClientHostTimeout to see if timeouts are too aggressive for a slow link. A mismatched juniTacacsPlusClientKey or juniTacacsPlusClientHostKey between router and server would explain authentication rejections despite the host being reachable.

What Can Be Monitored

configured TACACS+ host addresses/ports
primary vs. backup server designation
client and per-host timeout settings
shared secret key configuration
single-connection mode setting

Imported Objects

From Juniper-MIBs

juniMibs

MODULE-IDENTITY

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Counter32
IpAddress
MODULE-IDENTITY
OBJECT-TYPE

From SNMPv2-TC

RowStatus
TEXTUAL-CONVENTION
TimeStamp
TruthValue

How to Use in IPNetwork Monitor

Example using juniTacacsPlusClientHostAuthRequests OID:

Select a Juniper E-series router, JUNOSe (TACACS+ client for admin AAA) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type juniTacacsPlusClientHostAuthRequests into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. It reports the number of authentication requests sent to the host. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
juniTacacsPlusClientMIB	1.3.6.1.4.1.4874.2.2.60			The Terminal Access Controller Access Control System Plus (TACACS+) Client MIB for the Juniper Networks enterprise.
juniTacacsPlusClientObjects	1.3.6.1.4.1.4874.2.2.60.1
juniTacacsPlusClientCommonConfig	1.3.6.1.4.1.4874.2.2.60.1.1
INT juniTacacsPlusClientDirectedRequest	1.3.6.1.4.1.4874.2.2.60.1.1.1	INTEGER	read-write	This object represents directed-request option setting. In any of the enabled enabled states user name entered as `user@host' will be sent to specified host fot authentication. If `restricted' is in effect and the specified host is not available client would not try to use other hosts, if `truncated' is in effect, then `@host' part will be stripped before submission for authentication.
INT juniTacacsPlusClientTimeout	1.3.6.1.4.1.4874.2.2.60.1.1.2	INTEGER	read-write	TACACS+ host response timeout in seconds. Value 0 means 'not configured, it this case built-in internal timeout value will be used.
STR juniTacacsPlusClientKey	1.3.6.1.4.1.4874.2.2.60.1.1.3	JuniKeyString	read-write	If the size is non-zero, packets passed between host and client will be encrypted.
IP juniTacacsPlusClientSourceIp	1.3.6.1.4.1.4874.2.2.60.1.1.4	IpAddress	read-write	If the value is is not 0.0.0.0 client will use this address as a source IP address for communication with servers. Changing this value would not affect existing connections.
juniTacacsPlusClientHostConfig	1.3.6.1.4.1.4874.2.2.60.1.2
juniTacacsPlusClientHostConfigTable	1.3.6.1.4.1.4874.2.2.60.1.2.1		not-accessible	This table contains per host configuration parameters.
juniTacacsPlusClientHostConfigEntry	1.3.6.1.4.1.4874.2.2.60.1.2.1.1		not-accessible	A TACACS+ host statistics table entry.
IP juniTacacsPlusClientHostAddr	1.3.6.1.4.1.4874.2.2.60.1.2.1.1.1	IpAddress	not-accessible	The IP address of the host.
INT juniTacacsPlusClientHostPort	1.3.6.1.4.1.4874.2.2.60.1.2.1.1.2	INTEGER	read-create	The TCP port of the host.
T/F juniTacacsPlusClientHostPrimary	1.3.6.1.4.1.4874.2.2.60.1.2.1.1.3	TruthValue	read-create	Non-directed requests are submitted to the primary host first. There is only one primary host in the table. So, setting this object to true, will also change the value of this object in the current primary host. If primary host is deleted or reset, system will assing new primary host. When the first entry is created it becomes primary regardless of the value of this object.
T/F juniTacacsPlusClientHostSingleConnection	1.3.6.1.4.1.4874.2.2.60.1.2.1.1.4	TruthValue	read-create	Traditionally TACACS+ client creates a new TCP connection for every session. If this value is true then TACACS+ client will try to use single connection if supported both by client implementation and by the host.
INT juniTacacsPlusClientHostTimeout	1.3.6.1.4.1.4874.2.2.60.1.2.1.1.5	INTEGER	read-create	TACACS+ host response timeout in seconds. If the value is 0 then the value of juniTacacsPlusClientTimeout will be used instead.
STR juniTacacsPlusClientHostKey	1.3.6.1.4.1.4874.2.2.60.1.2.1.1.6	JuniKeyString	read-create	If size is non-zero, packets passed between host and client will be encrypted with the key, otherwise the value of juniTacacsPlusClientKey will be used for the purpose.
ROW juniTacacsPlusClientHostStatus	1.3.6.1.4.1.4874.2.2.60.1.2.1.1.7	RowStatus	read-create	Status object, only `createAndGo' and 'destroy' are supported.
INT juniTacacsPlusClientHostOrder	1.3.6.1.4.1.4874.2.2.60.1.2.1.1.8	INTEGER	read-only	The search order of this TACACS+ host within all configured TACACS+ hosts. This MIB object indicates the order in which a TACACS+ request will be sent to the TACACS+ hosts until a response is received. The primary host is always the first host to be contacted. The remaining hosts will be contacted in the order that they were created. Should the primary host be deleted, the next host in the search order will become the primary host.
juniTacacsPlusClientHostStats	1.3.6.1.4.1.4874.2.2.60.1.3
juniTacacsPlusClientHostStatsTable	1.3.6.1.4.1.4874.2.2.60.1.3.1		not-accessible	This table contains per host statistics.
juniTacacsPlusClientHostStatsEntry	1.3.6.1.4.1.4874.2.2.60.1.3.1.1		not-accessible	A TACACS+ host statistics table entry.
C32 juniTacacsPlusClientHostAuthRequestsEx	1.3.6.1.4.1.4874.2.2.60.1.3.1.1.1	Counter32	read-only	Number of authentication requests sent to the host.
C32 juniTacacsPlusClientHostAuthReplies	1.3.6.1.4.1.4874.2.2.60.1.3.1.1.2	Counter32	read-only	Number of authentication replies received from the host.
C32 juniTacacsPlusClientHostAuthPending	1.3.6.1.4.1.4874.2.2.60.1.3.1.1.3	Counter32	read-only	Number of expected but not received authentication replies from the host.
C32 juniTacacsPlusClientHostAuthTimeouts	1.3.6.1.4.1.4874.2.2.60.1.3.1.1.4	Counter32	read-only	Number of authentication timeouts for the host.
C32 juniTacacsPlusClientHostAuthorRequests	1.3.6.1.4.1.4874.2.2.60.1.3.1.1.5	Counter32	read-only	Number of authorization requests sent to the host.
C32 juniTacacsPlusClientHostAuthorReplies	1.3.6.1.4.1.4874.2.2.60.1.3.1.1.6	Counter32	read-only	Number of authorization replies received from the host.
C32 juniTacacsPlusClientHostAuthorPending	1.3.6.1.4.1.4874.2.2.60.1.3.1.1.7	Counter32	read-only	Number of expected but not received authorization replies from the host.
C32 juniTacacsPlusClientHostAuthorTimeouts	1.3.6.1.4.1.4874.2.2.60.1.3.1.1.8	Counter32	read-only	Number of authorization timeouts for the host.
C32 juniTacacsPlusClientHostAcctRequests	1.3.6.1.4.1.4874.2.2.60.1.3.1.1.9	Counter32	read-only	Number of accounting requests sent to the host.
C32 juniTacacsPlusClientHostAcctReplies	1.3.6.1.4.1.4874.2.2.60.1.3.1.1.10	Counter32	read-only	Number of accounting replies received from the host.
C32 juniTacacsPlusClientHostAcctPending	1.3.6.1.4.1.4874.2.2.60.1.3.1.1.11	Counter32	read-only	Number of expected but not received accounting replies from the host.
C32 juniTacacsPlusClientHostAcctTimeouts	1.3.6.1.4.1.4874.2.2.60.1.3.1.1.12	Counter32	read-only	Number of accounting timeouts for the host.
TIM juniTacacsPlusClientHostDiscontinuityTime	1.3.6.1.4.1.4874.2.2.60.1.3.1.1.13	TimeStamp	read-only	The value of sysUpTime when corresponding juniTacacsPlusHostConfigEntry was created, this object containg zero if host entry was created during system initializatin.
juniTacacsPlusClientConformance	1.3.6.1.4.1.4874.2.2.60.2
juniTacacsPlusClientCompliances	1.3.6.1.4.1.4874.2.2.60.2.1
juniTacacsPlusCompliance	1.3.6.1.4.1.4874.2.2.60.2.1.1			Obsolete compliance statement for entities which implement the Juniper TACACS+ Client MIB.
juniTacacsPlusCompliance2	1.3.6.1.4.1.4874.2.2.60.2.1.2			The compliance statement for entities which implement the Juniper TACACS+ Client MIB.
juniTacacsPlusClientGroups	1.3.6.1.4.1.4874.2.2.60.2.2
juniTacacsPlusClientCommonGroup	1.3.6.1.4.1.4874.2.2.60.2.2.1			This group defines common configuration parameters for all hosts.
juniTacacsPlusClientHostConfigGroup	1.3.6.1.4.1.4874.2.2.60.2.2.2			Obsolete group for defining per host configuration parameters.
juniTacacsPlusClientHostStatsGroup	1.3.6.1.4.1.4874.2.2.60.2.2.3			This group defines statistics collected on per host basis.
juniTacacsPlusClientHostConfigGroup2	1.3.6.1.4.1.4874.2.2.60.2.2.4			This group defines per host configuration parameters.

RFC description

Manages TACACS+ client configuration and statistics for Juniper systems, including authentication server hosts and client parameters.

Start monitoring Juniper E-series router, JUNOSe (TACACS+ client for admin AAA) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download Juniper-TACACS-Plus-Client-MIB