MY-AAA-MIB

MIB Reference — IPNetwork Monitor

All MIBsMY-AAA-MIB

Organization: D-Link Crop.

Last Updated: 2002-03-20

Category: RADIUS/AAA

Description:

Manages D-Link switch AAA authentication, authorization, and accounting configuration.

Imported Objects

From INET-ADDRESS-MIB

InetAddress
InetAddressType

From MY-SMI

myMgmtOBJECT-IDENTITY

From MY-TC

ConfigStatus
IfIndex

From P-BRIDGE-MIB

EnabledStatus

From Q-BRIDGE-MIB

VlanId

From RFC1155-SMI

Counter

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Integer32
IpAddress
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DisplayString
MacAddress
RowStatus
TruthValue

What Is MY-AAA-MIB?

MY-AAA-MIB is a D-Link proprietary MIB that manages Authentication, Authorization, and Accounting settings on D-Link switches, with particular focus on IEEE 802.1x port-based network access control. It exposes configuration and status data for the 802.1x authenticator process, including per-port authentication status, timer parameters (quiet period, transmit period, supplicant timeout, server timeout), retry limits, and re-authentication settings, along with related AAA server objects. This is primarily a security/configuration-status MIB rather than a raw hardware-health MIB: administrators use it to confirm which switch ports have successfully authenticated clients and to verify that authentication timers and server communication are correctly tuned, which reflects the health of the authentication subsystem. It depends on the IEEE 802.1x standard and typically works alongside standard interface indexing since 802.1x state is tracked per physical port. It is typically deployed on D-Link managed switches in enterprise networks enforcing port-based network access control (NAC). Engineers can download the MY-AAA-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in MY-AAA-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

What Can Be Monitored

  • 802.1x port authentication status
  • authentication quiet/transmit period timers
  • supplicant and server timeout values
  • max authentication request/reauth counts
  • re-authentication enable state and period
  • authenticated client FDB bindings

Supported Devices

  • D-Link managed switch

Monitoring Examples

An administrator polls myDot1xAuthStatus per port to confirm whether 802.1x authentication is enabled and functioning, and checks myDot1xAuthObjectsConfigTable/myDot1xAuthObjectsConfigFdbId entries to see which MAC/FDB bindings resulted from successful authentication. If clients repeatedly fail to authenticate, the admin reviews myDot1xAuthObjectsSuppTimeout and myDot1xAuthObjectsServerTimeout to determine whether the supplicant or RADIUS server is timing out, adjusting myDot1xAuthObjectsMaxReq/myDot1xAuthObjectsMaxReauth accordingly. Rising failures alongside repeated myDot1xAuthObjectsReAuthPeriod cycles would indicate a misconfigured or unreachable AAA server.

OIDs
OID symbolicOID numericTypeAccessDescription
myAAAMIB1.3.6.1.4.1.171.10.97.2.19This module defines my AAA(802.1x) mibs.
myAAAMIBObjects1.3.6.1.4.1.171.10.97.2.19.1
myDot1xAuthObjects1.3.6.1.4.1.171.10.97.2.19.1.1
ENA myDot1xAuthStatus1.3.6.1.4.1.171.10.97.2.19.1.1.1EnabledStatusread-writeThe enable(1)/disable(2) control used by the 802.1x global settings.
U32 myDot1xAuthObjectsQuietPeriod1.3.6.1.4.1.171.10.97.2.19.1.1.2Unsigned32read-writeThe value, in seconds, of the quietPeriod constant currently in use by the Authenticator PAE state machine.
U32 myDot1xAuthObjectsTxPeriod1.3.6.1.4.1.171.10.97.2.19.1.1.3Unsigned32read-writeThe value, in seconds, of the txPeriod constant currently in use by the Authenticator PAE state machine.
U32 myDot1xAuthObjectsSuppTimeout1.3.6.1.4.1.171.10.97.2.19.1.1.4Unsigned32read-writeThe value, in seconds, of the suppTimeout constant currently in use by the Backend Authentication state machine.
U32 myDot1xAuthObjectsServerTimeout1.3.6.1.4.1.171.10.97.2.19.1.1.5Unsigned32read-writeThe value, in seconds, of the serverTimeout constant currently in use by the Backend Authentication state machine.
U32 myDot1xAuthObjectsMaxReq1.3.6.1.4.1.171.10.97.2.19.1.1.6Unsigned32read-writeThe value of the maxReq constant currently in use by the Backend Authentication state machine.
U32 myDot1xAuthObjectsReAuthPeriod1.3.6.1.4.1.171.10.97.2.19.1.1.7Unsigned32read-writeThe value, in seconds, of the reAuthPeriod constant currently in use by the Reauthentication Timer state machine.
U32 myDot1xAuthObjectsMaxReauth1.3.6.1.4.1.171.10.97.2.19.1.1.8Unsigned32read-writeThe value of the reAuthMax constant currently in use by the Authenticator PAE state machine.
ENA myDot1xAuthObjectsReAuthEnable1.3.6.1.4.1.171.10.97.2.19.1.1.9EnabledStatusread-writeThe enable(1)/disable(2) control used by the Reauthentication Timer state machine.
myDot1xAuthObjectsConfigTable1.3.6.1.4.1.171.10.97.2.19.1.1.10not-accessibleA table that contains the configuration objects for the Authenticator PAE associated with each MAC address. An entry appears in this table for each MAC address that may authenticate access to itself.
myDot1xAuthObjectsConfigEntry1.3.6.1.4.1.171.10.97.2.19.1.1.10.1not-accessibleThe configuration information for an Authenticator PAE.
U32 myDot1xAuthObjectsConfigFdbId1.3.6.1.4.1.171.10.97.2.19.1.1.10.1.1Unsigned32read-onlyThe VID of vlan which the address blongs to.
MAC myDot1xAuthObjectsConfigAddr1.3.6.1.4.1.171.10.97.2.19.1.1.10.1.2MacAddressread-onlyThe MAC address associated with this configurations.
INT myDot1xAuthObjectsPaeState1.3.6.1.4.1.171.10.97.2.19.1.1.10.1.3INTEGERread-onlyThe current value of the Authenticator PAE state machine.
INT myDot1xAuthObjectsBackendAuthState1.3.6.1.4.1.171.10.97.2.19.1.1.10.1.4INTEGERread-onlyThe current state of the Backend Authentication state machine.
INT myDot1xAuthObjectsAuthControlledPortStatus1.3.6.1.4.1.171.10.97.2.19.1.1.10.1.5INTEGERread-onlyThe current value of the controlled Port status parameter for the Port.
T/F myDot1xAuthObjectsKeyTxEnabled1.3.6.1.4.1.171.10.97.2.19.1.1.10.1.6TruthValueread-onlyThe value of the keyTransmissionEnabled constant currently in use by the Authenticator PAE state machine.
IFI myDot1xAuthObjectsIfIndex1.3.6.1.4.1.171.10.97.2.19.1.1.10.1.7IfIndexread-onlyThe interface index associated with this configurations
myDot1xAuthObjectsStatsTable1.3.6.1.4.1.171.10.97.2.19.1.1.11not-accessibleA table that contains the statistics objects for the Authenticator PAE associated with each MAC address. An entry appears in this table for each MAC address that may authenticate access to itself.
myDot1xAuthStatsEntry1.3.6.1.4.1.171.10.97.2.19.1.1.11.1not-accessibleThe statistics information for an Authenticator PAE.
U32 myDot1xAuthObjectsStatsFdbId1.3.6.1.4.1.171.10.97.2.19.1.1.11.1.1Unsigned32read-onlyThe VID of vlan which the address blongs to.
MAC myDot1xAuthObjectsStatsAddr1.3.6.1.4.1.171.10.97.2.19.1.1.11.1.2MacAddressread-onlyThe MAC address associated with this states.
C32 myDot1xAuthObjectsEapolFramesRx1.3.6.1.4.1.171.10.97.2.19.1.1.11.1.3Counter32read-onlyThe number of valid EAPOL frames of any type that have been received by this Authenticator.
C32 myDot1xAuthObjectsEapolFramesTx1.3.6.1.4.1.171.10.97.2.19.1.1.11.1.4Counter32read-onlyThe number of EAPOL frames of any type that have been transmitted by this Authenticator.
C32 myDot1xAuthObjectsEapolMyFramesRx1.3.6.1.4.1.171.10.97.2.19.1.1.11.1.5Counter32read-onlyThe number of EAPOL My frames that have been received by this Authenticator.
C32 myDot1xAuthObjectsEapolLogoffFramesRx1.3.6.1.4.1.171.10.97.2.19.1.1.11.1.6Counter32read-onlyThe number of EAPOL Logoff frames that have been received by this Authenticator.
C32 myDot1xAuthObjectsEapolRespIdFramesRx1.3.6.1.4.1.171.10.97.2.19.1.1.11.1.7Counter32read-onlyThe number of EAP Resp/Id frames that have been received by this Authenticator.
C32 myDot1xAuthObjectsEapolRespFramesRx1.3.6.1.4.1.171.10.97.2.19.1.1.11.1.8Counter32read-onlyThe number of valid EAP Response frames (other than Resp/Id frames) that have been received by this Authenticator.
C32 myDot1xAuthObjectsEapolReqIdFramesTx1.3.6.1.4.1.171.10.97.2.19.1.1.11.1.9Counter32read-onlyThe number of EAP Req/Id frames that have been transmitted by this Authenticator.
C32 myDot1xAuthObjectsEapolReqFramesTx1.3.6.1.4.1.171.10.97.2.19.1.1.11.1.10Counter32read-onlyThe number of EAP Request frames (other than Rq/Id frames) that have been transmitted by this Authenticator.
C32 myDot1xAuthObjectsInvalidEapolFramesRx1.3.6.1.4.1.171.10.97.2.19.1.1.11.1.11Counter32read-onlyThe number of EAPOL frames that have been received by this Authenticator in which the frame type is not recognized.
C32 myDot1xAuthObjectsEapLengthErrorFramesRx1.3.6.1.4.1.171.10.97.2.19.1.1.11.1.12Counter32read-onlyThe number of EAPOL frames that have been received by this Authenticator in which the Packet Body Length field is invalid.
U32 myDot1xAuthObjectsLastEapolFrameVersion1.3.6.1.4.1.171.10.97.2.19.1.1.11.1.13Unsigned32read-onlyThe protocol version number carried in the most recently received EAPOL frame.
MAC myDot1xAuthObjectsLastEapolFrameSource1.3.6.1.4.1.171.10.97.2.19.1.1.11.1.14MacAddressread-onlyThe source MAC address carried in the most recently received EAPOL frame.
CTR myDot1xCurrentUserNumber1.3.6.1.4.1.171.10.97.2.19.1.1.12Counterread-onlyNumbers of users who attached to the system ,regardless of their state.
CTR myDot1xCurrentAuthenticatedUserNumber1.3.6.1.4.1.171.10.97.2.19.1.1.13Counterread-onlyNumbers of user who attached to the system and their current state is authorized
ENA myDot1xAccountStatus1.3.6.1.4.1.171.10.97.2.19.1.1.14EnabledStatusread-writeThe enable(1)/disable(2) control used by the accounting function.
myAuthIfTable1.3.6.1.4.1.171.10.97.2.19.1.1.15not-accessibleThe table of the authenticated status of interface.
myAuthIfEntry1.3.6.1.4.1.171.10.97.2.19.1.1.15.1not-accessibleThe entry of MAC address which can be authenticated.
IFI myAuthIf1.3.6.1.4.1.171.10.97.2.19.1.1.15.1.1IfIndexread-onlyThe port number of the port/trunk to which frames received from a specific port/trunk and destined for a specific MAC address.
ENA myAuthIfStatus1.3.6.1.4.1.171.10.97.2.19.1.1.15.1.2EnabledStatusread-writeThe authentication status of a port, can be opened by setting its value to Enabled(1), or closed by setting its value to Disabled(2).
INT myAuthenticationMode1.3.6.1.4.1.171.10.97.2.19.1.1.16INTEGERread-writeMode used for authentication
ENA myDot1xAccountUpdateStatus1.3.6.1.4.1.171.10.97.2.19.1.1.17EnabledStatusread-writeAccount Update Status
U32 myDot1xAcctInterimInterval1.3.6.1.4.1.171.10.97.2.19.1.1.18Unsigned32read-writeAccount Interim Interval
ENA myDot1xEapolTagEnabled1.3.6.1.4.1.171.10.97.2.19.1.1.19EnabledStatusread-writeEapol Tag Enabled
myDot1xIfUserMaxTable1.3.6.1.4.1.171.10.97.2.19.1.1.20not-accessibleThe table of the max dot1x user number on authenticated interface.
myDot1xIfUserMaxEntry1.3.6.1.4.1.171.10.97.2.19.1.1.20.1not-accessibleThe entry of max dot1x user number on authenticated interface.
IFI myDot1xIfUserMaxIndex1.3.6.1.4.1.171.10.97.2.19.1.1.20.1.1IfIndexread-onlyThe interface index which dot1x authentication is enabled.
U32 myDot1xIfUserMaxNum1.3.6.1.4.1.171.10.97.2.19.1.1.20.1.2Unsigned32read-writeThe max dot1x user num on the interface, this is valid only when dot1x authentication is enable on that interface. Number 0 indicates no user number limits enabled on the interface.
myAAAServerObjects1.3.6.1.4.1.171.10.97.2.19.1.2
INT myAAAServerAuthPort1.3.6.1.4.1.171.10.97.2.19.1.2.2INTEGERread-writeUDP port used for authentication in the global configuration. For RADIUS only, default value is 1812.
INT myAAAServerAcctPort1.3.6.1.4.1.171.10.97.2.19.1.2.3INTEGERread-writeUDP port used for accounting service in the global configuration. For RADIUS only, default value is 1813.
STR myAAAServerRadiusKeyStr1.3.6.1.4.1.171.10.97.2.19.1.2.4DisplayStringread-writeThe server key to be used with all RADIUS server. Retrieving the value of this object via SNMP will return an empty string for security reasons.
STR myAAAServerTacplusKeyStr1.3.6.1.4.1.171.10.97.2.19.1.2.8DisplayStringread-writeThe server key to be used with all TACACS+ server. Retrieving the value of this object via SNMP will return an empty string for security reasons.
myAAAServerConfigTable1.3.6.1.4.1.171.10.97.2.19.1.2.9not-accessibleThis table shows current configurations for each AAA server, allows existing servers to be removed and new ones to be created.
myAAAServerConfigEntry1.3.6.1.4.1.171.10.97.2.19.1.2.9.1not-accessibleThe table of AAA server configuration identified by its protocol and its index.
INT myAAAServerConfigProtocol1.3.6.1.4.1.171.10.97.2.19.1.2.9.1.1INTEGERnot-accessibleThe variable denotes the protocol used by the managed device with the AAA server corresponding to this entry in the table.
U32 myAAAServerConfigIndex1.3.6.1.4.1.171.10.97.2.19.1.2.9.1.2Unsigned32not-accessibleA number uniquely identifying each server. If the myAAAServerConfigIndex value for row creation is already in use by an existing entry, snmp set to the myAAAServerConfigIndex value will fail. Upon reload, casIndex values may be changed.
IPt myAAAServerConfigAddressType1.3.6.1.4.1.171.10.97.2.19.1.2.9.1.3InetAddressTyperead-createThe type of address format used for the myAAAServerConfigAddress object.
IP myAAAServerConfigAddress1.3.6.1.4.1.171.10.97.2.19.1.2.9.1.4InetAddressread-createThe IP address of the server.
INT myAAAServerConfigAuthPort1.3.6.1.4.1.171.10.97.2.19.1.2.9.1.5INTEGERread-createUDP/TCP port used for authentication in the server. For RADIUS, default value is 1812. For TACACS+, default value is 49.
INT myAAAServerConfigAcctPort1.3.6.1.4.1.171.10.97.2.19.1.2.9.1.6INTEGERread-createUDP/TCP port used for accounting service in the server. For RADIUS, default value is 1813. For TACACS+, the value of myAAAServerConfigAcctPort is ignored, myAAAServerConfigAuthPort will be used instead.
STR myAAAServerConfigKeyStr1.3.6.1.4.1.171.10.97.2.19.1.2.9.1.7DisplayStringread-createThe server key to be used with this server. Retrieving the value of this object via SNMP will return an empty string for security reasons.
ROW myAAAServerConfigRowStatus1.3.6.1.4.1.171.10.97.2.19.1.2.9.1.8RowStatusread-createThe status of this table entry. Once the entry status is set to active, the associated entry cannot be modified except destroyed by setting this object to destroy(6).
myAuthUserObjects1.3.6.1.4.1.171.10.97.2.19.1.3
myAuthAddrTable1.3.6.1.4.1.171.10.97.2.19.1.3.1not-accessibleThe table of MAC address which can be authenticated.
myAuthAddrEntry1.3.6.1.4.1.171.10.97.2.19.1.3.1.1not-accessibleThe entry of MAC address which can be authenticated.
IFI myAuthPort1.3.6.1.4.1.171.10.97.2.19.1.3.1.1.1IfIndexread-onlyThe port number of the port/trunk to which frames received from a specific port/trunk and destined for a specific MAC address.
MAC myAuthMacAddress1.3.6.1.4.1.171.10.97.2.19.1.3.1.1.2MacAddressread-onlyThe MAC address which can be authenticated.
INT myAuthAddrStatus1.3.6.1.4.1.171.10.97.2.19.1.3.1.1.3INTEGERread-writevalid(1) - this entry is currently in use . invalid(2) - writing this value to the object removes the corresponding entry.
myAuthUserTable1.3.6.1.4.1.171.10.97.2.19.1.3.2not-accessibleThe table of authentication User Info.
myAuthUserEntry1.3.6.1.4.1.171.10.97.2.19.1.3.2.1not-accessibleThe entry of authentication User Info table.
U32 myAuthUserFdbId1.3.6.1.4.1.171.10.97.2.19.1.3.2.1.1Unsigned32read-onlyThe VID of vlan which the address blongs to.
MAC myAuthUserMacAddress1.3.6.1.4.1.171.10.97.2.19.1.3.2.1.2MacAddressread-onlyThe MAC Address of authentication User .
STR myAuthUserName1.3.6.1.4.1.171.10.97.2.19.1.3.2.1.3DisplayStringread-onlyThe Name of authentication User.
STR myAuthUserSessionId1.3.6.1.4.1.171.10.97.2.19.1.3.2.1.4DisplayStringread-onlyThe Session Id of authentication User .
IP myAuthUserIpAddr1.3.6.1.4.1.171.10.97.2.19.1.3.2.1.5IpAddressread-onlyThe IP Address of authentication User .
INT myAuthUserPort1.3.6.1.4.1.171.10.97.2.19.1.3.2.1.6INTEGERread-onlyThe interface of authentication User .
CON myAuthUserStatus1.3.6.1.4.1.171.10.97.2.19.1.3.2.1.7ConfigStatusread-writeSetting this object to 'invalid' will close a authenticated user, set its value to valid will cause no action of agent, when query always return value valid.
STR myAuthUserForVPNDel1.3.6.1.4.1.171.10.97.2.19.1.3.3DisplayStringread-writeVPN user's name. Setting this object will delete a authenticated user and this user is unauthenticated. The set string is the username. Reading this object always return null string.
myAuthModeObjects1.3.6.1.4.1.171.10.97.2.19.1.4
INT myIpAuthorizationMode1.3.6.1.4.1.171.10.97.2.19.1.4.1INTEGERread-writedisable(1) - don't limit ip address of user dhcpServer(2) - limit ip address of user, only ip address assigned by the dhcp server is legit. radiusServer(3) - limit ip address of user, only ip address assigned by the radius server is legit. supplicant(4) - mac+ip+port indicates different users (get the IP adress through supplicant)
myClientProbeObjects1.3.6.1.4.1.171.10.97.2.19.1.5
ENA myClientProbeEnabledStatus1.3.6.1.4.1.171.10.97.2.19.1.5.1EnabledStatusread-writeThe status of client probe function.
U32 myClientProbeHelloInterval1.3.6.1.4.1.171.10.97.2.19.1.5.2Unsigned32read-writeThe interval that client send hello packets.
U32 myClientProbeAliveInteval1.3.6.1.4.1.171.10.97.2.19.1.5.3Unsigned32read-writeWhen switch does not receive any legal hello packets from client in this interval,it will send RADIUS-Account-Stop to RADIUS server to stop this connection.The value of the objects must be more than myClientProbeHelloInterval
myAAAMIBConformance1.3.6.1.4.1.171.10.97.2.19.2
myAAAMIBCompliances1.3.6.1.4.1.171.10.97.2.19.2.1
myAAAMIBCompliance1.3.6.1.4.1.171.10.97.2.19.2.1.1The compliance statement for entities which implement the My AAA MIB
myAAAMIBGroups1.3.6.1.4.1.171.10.97.2.19.2.2
myDot1xAuthMIBGroup1.3.6.1.4.1.171.10.97.2.19.2.2.1A collection of objects providing dot1x authentication managment.
myAAAServerMIBGroup1.3.6.1.4.1.171.10.97.2.19.2.2.2A collection of objects providing AAA server managment.
myAuthAddrMIBGroup1.3.6.1.4.1.171.10.97.2.19.2.2.3A collection of objects providing address permitted authentication managment.
myAuthModeMIBGroup1.3.6.1.4.1.171.10.97.2.19.2.2.4A collection of objects providing authentication mode managment.
myClientProbeGroup1.3.6.1.4.1.171.10.97.2.19.2.2.5A collection of objects providing client probe management.

RFC description

Manages AAA (Authentication, Authorization, Accounting) and 802.1x authentication settings on D-Link devices.

Start monitoring D-Link managed switch (802.1x port-based access control) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download MY-AAA-MIB