Mac-Based-Authentication-MIB

All MIBs › Mac-Based-Authentication-MIB

Organization: D-Link Corp.

Last Updated: 2010-08-13

Category: RADIUS/AAA

Description: Manages MAC-based network access authentication policies on D-Link switches.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is Mac-Based-Authentication-MIB?

Mac-Based-Authentication-MIB is a D-Link proprietary MIB configuring MAC-based authentication (port security using a device's MAC address as its credential, typically via RADIUS) on D-Link managed switches. Its objects cover a global enable state, authentication method, a shared password field, VLAN name/member-port assignment for authenticated hosts, a maximum-user limit, fail-over behavior, and a RADIUS-authorization toggle, alongside a clear-all action. As a configuration/security-status MIB it lets an administrator confirm MAC-based authentication is enabled with the correct fail-over and RADIUS-authorization behavior. It is deployed on D-Link managed switches using MAC-based port authentication. Engineers can download the Mac-Based-Authentication-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in Mac-Based-Authentication-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

D-Link managed switches

Monitoring Examples

An administrator checks swMacBasedAuthFailOver to confirm how the switch behaves if the RADIUS server becomes unreachable, before relying on MAC-based authentication as the sole access-control mechanism on a given VLAN.

What Can Be Monitored

MAC-based authentication enable state and fail-over behavior

Imported Objects

From DLINK-ID-REC-MIB

dlink-common-mgmt

From Q-BRIDGE-MIB

VlanId

From SNMPv2-SMI

MODULE-IDENTITY
OBJECT-TYPE

From SNMPv2-TC

DisplayString
MacAddress
RowStatus

OIDs

OID symbolic	OID numeric	Type	Access	Description
swMBAMIB	1.3.6.1.4.1.171.12.35			.
swMBACtrl	1.3.6.1.4.1.171.12.35.1
INT swMacBasedAuthState	1.3.6.1.4.1.171.12.35.1.1	INTEGER	read-write	This object enables or disables the MAC-based Access Control status of the device.
INT swMacBasedAuthMethod	1.3.6.1.4.1.171.12.35.1.2	INTEGER	read-write	This object indicates the type of authentication method. The RADIUS method is authenticated per authentication server.
STR swMacBasedAuthPWD	1.3.6.1.4.1.171.12.35.1.3	DisplayString	read-write	This object indicates the password of the RADIUS authentication method.
STR swMacBasedAuthVlanName	1.3.6.1.4.1.171.12.35.1.4	DisplayString	read-write	This object indicates the VLAN name of the MAC-based Access Control guest VLAN.
POR swMacBasedAuthMemberPorts	1.3.6.1.4.1.171.12.35.1.5	PortList	read-write	This object indicates the member ports of the MAC-based Access Control guest VLAN.
INT swMacBasedAuthVlanNameDelState	1.3.6.1.4.1.171.12.35.1.7	INTEGER	read-write	Used to delete the guest VLAN of MAC-based Access Control.
INT swMacBasedAuthClearAllAction	1.3.6.1.4.1.171.12.35.1.8	INTEGER	read-write	Used to clear the authentication state of all the ports.
INT swMacBasedAuthMaxUser	1.3.6.1.4.1.171.12.35.1.9	INTEGER	read-write	This object indicates the maximum number of authorized client(s) on the whole device. Note: The maximum number of the authorized client(s) range is (0..N). The value N means the maximum number. This is determined by the project itself. When 0 is set, the maximum number of authorized clients is unlimited.
INT swMacBasedAuthFailOver	1.3.6.1.4.1.171.12.35.1.10	INTEGER	read-write	This object sets the RADIUS authentication failover state. When the authentication failover is disabled and the RADIUS servers are unreachable, the authentication will fail. When the authentication failover is enabled and the RADIUS servers authentication are unreachable, the local database will be used to do the authentication. By default, the state is disabled.
INT swMacBasedAuthRadiusAuthorization	1.3.6.1.4.1.171.12.35.1.11	INTEGER	read-write	This object sets the acceptance state of RADIUS authorization. When the authorization is enabled for the MAC-based Access Control's RADIUS method, the authorized attributes (for example VLAN, 802.1p default priority, and ACL) assigned by the local database will be accepted if the global authorization state is enabled.
INT swMacBasedAuthLocalAuthorization	1.3.6.1.4.1.171.12.35.1.12	INTEGER	read-write	This object sets the acceptance state of local authorization. When the authorization is enabled for the MAC-based Access Control's local method, the authorized attributes assigned by the local database will be accepted if the global authorization state is enabled.
INT swMacBasedAuthTrapState	1.3.6.1.4.1.171.12.35.1.13	INTEGER	read-write	This object is used to enable or disable the sending of MAC-based Access Control traps.
INT swMacBasedAuthLogState	1.3.6.1.4.1.171.12.35.1.14	INTEGER	read-write	This object is used to enable or disable the generating of MAC-based Access Control logs.
INT swMacBasedAuthPwdType	1.3.6.1.4.1.171.12.35.1.15	INTEGER	read-write	This object is used to configure the type of RADIUS authentication password for MAC-based Access Control. manual-string: Use the same string as password for all clients do RADIUS authentication, the string can be configured by swMacBasedAuthPWD. client-mac-address: Use the clients MAC address as the password for RADIUS authentication.
swMBAInfo	1.3.6.1.4.1.171.12.35.2
swMacBasedAuthPortInfoTable	1.3.6.1.4.1.171.12.35.2.1		not-accessible	A table that displays the authentication state of every port.
swMacBasedAuthPortInfoEntry	1.3.6.1.4.1.171.12.35.2.1.1		not-accessible	A table that displays the authentication state for each port.
INT swMacBasedAuthInfoPortIndex	1.3.6.1.4.1.171.12.35.2.1.1.1	INTEGER	read-only	This object indicates the authenticated port number.
MAC swMacBasedAuthInfoMacIndex	1.3.6.1.4.1.171.12.35.2.1.1.2	MacAddress	read-only	This object indicates the authenticated MAC address.
INT swMacBasedAuthInfoStatus	1.3.6.1.4.1.171.12.35.2.1.1.3	INTEGER	read-only	This object indicates the authenticated status.
STR swMacBasedAuthInfoAssignVLANName	1.3.6.1.4.1.171.12.35.2.1.1.4	DisplayString	read-only	This object indicates the VLAN name that the port is assigned with once MAC authentication was successful.
INT swMacBasedAuthClearMacAction	1.3.6.1.4.1.171.12.35.2.1.1.5	INTEGER	read-write	When set to start (2), the user will return to an un-authenticated state. All the timers associated with the user will be reset. When the administrator performs a get operation, it always returns the other (1).
INT swMacBasedAuthInfoPriority	1.3.6.1.4.1.171.12.35.2.1.1.6	INTEGER	read-only	This object indicates the priority that the port or MAC address is assigned to after it passes authentication. -1 will be displayed when the port or MAC address has not been assigned any priority
INT swMacBasedAuthInfoAgingTime	1.3.6.1.4.1.171.12.35.2.1.1.7	INTEGER	read-only	This object indicates the remaining time until the authenticated client returns to an unauthenticated state. -1 will be displayed before the port or MAC address passes authentication. 0 will be displayed when the aging time is set to infinite on the port. -2 indicates the host aging timeout, but MAC-based Access Control will hold this entry as expired (for stacking performance) and after the time has expired, the switch will delete it.
INT swMacBasedAuthInfoBlockTime	1.3.6.1.4.1.171.12.35.2.1.1.8	INTEGER	read-only	This object indicates the remaining time until the authentication failure client is allowed to start a new authentication. -1 will be displayed after the port or MAC address passes authentication. -2 indicates the host block timeout, but MAC-based Access Control will hold this entry as expired (for stacking performance) and after the time has expired, the switch will delete it.
INT swMacBasedAuthInfoAssignVID	1.3.6.1.4.1.171.12.35.2.1.1.9	INTEGER	read-only	This object indicates the VID that the port is assigned to once the MAC authentication was successful.
swMacBasedAuthStateTable	1.3.6.1.4.1.171.12.35.2.2		not-accessible	This table contains the MAC-based Access Control clients' authentication information.
swMacBasedAuthStateEntry	1.3.6.1.4.1.171.12.35.2.2.1		not-accessible	This list contains the MAC-based Access Control host's authentication information.
INT swMacBasedAuthStatePort	1.3.6.1.4.1.171.12.35.2.2.1.1	INTEGER	not-accessible	Specifies the MAC-based Access Control host's port number.
VLA swMacBasedAuthStateOriginalVID	1.3.6.1.4.1.171.12.35.2.2.1.2	VlanId	not-accessible	Specifies the MAC-based Access Control host's original received VLAN ID.
MAC swMacBasedAuthStateMacAddr	1.3.6.1.4.1.171.12.35.2.2.1.3	MacAddress	not-accessible	Specifies the MAC-based Access Control host's MAC address.
INT swMacBasedAuthStateAuthStatus	1.3.6.1.4.1.171.12.35.2.2.1.4	INTEGER	read-only	Specifies the MAC-based Access Control host's authentication state.
VLA swMacBasedAuthStateAssignVID	1.3.6.1.4.1.171.12.35.2.2.1.5	VlanId	read-only	Specifies the MAC-based Access Control host's assign VLAN ID.
INT swMacBasedAuthStateAssignPriority	1.3.6.1.4.1.171.12.35.2.2.1.6	INTEGER	read-only	Specifies the MAC-based Access Control host's priority assigned when it passes authentication. -1 indicates the host has no priority assigned.
INT swMacBasedAuthStateRemainTime	1.3.6.1.4.1.171.12.35.2.2.1.7	INTEGER	read-only	Specifies the remaining MAC-based Access Control host's aging or block time. When host's authentication state is 'authenticated' in swMacBasedAuthStateAuthStatus, this object indicates the host's aging time, the units are in minutes. When host's authentication state is 'blocked' in swMacBasedAuthStateAuthStatus, this object indicates the host's block time, the units are in seconds. 0 indicates that the authenticated host on the port will never age out. -2 indicates the host aging or block timeout, but MAC-based Access Control will hold this entry as expired (for stacking performance) and after the time expired, the switch will delete it.
INT swMacBasedAuthStateDelAction	1.3.6.1.4.1.171.12.35.2.2.1.25	INTEGER	read-write	Used to delete the specified authentication entry. Setting start (2) will delete this MAC-based Access Control host entry.
swMBAPortMgmt	1.3.6.1.4.1.171.12.35.3
swMacBasedAuthPortTable	1.3.6.1.4.1.171.12.35.3.1		not-accessible	A table that contains the method and state for every port.
swMacBasedAuthPortEntry	1.3.6.1.4.1.171.12.35.3.1.1		not-accessible	A list of method types and states for each port.
INT swMacBasedAuthPortIndex	1.3.6.1.4.1.171.12.35.3.1.1.1	INTEGER	read-only	This object indicates the module's port number.
INT swMacBasedAuthPortState	1.3.6.1.4.1.171.12.35.3.1.1.2	INTEGER	read-write	This object enables or disables the authentication state of this port.
INT swMacBasedAuthPortMode	1.3.6.1.4.1.171.12.35.3.1.1.3	INTEGER	read-write	This object specifies the mode of this entry. port-based: All users connected to a port share the first authentication result. host-based: Each user can have its own authentication result.
INT swMacBasedAuthPortAgingTime	1.3.6.1.4.1.171.12.35.3.1.1.4	INTEGER	read-write	Specifies the time period that an authenticated host will be kept in an authenticated state. When the aging time has timed out, the host will be moved back to an unauthenticated state. Note: When 0 is set on the specified port, it means that the aging has been disabled, meaning that the aging time is set to infinite.
INT swMacBasedAuthPortBlockTime	1.3.6.1.4.1.171.12.35.3.1.1.5	INTEGER	read-write	If a host fails to authenticate, the next authentication will not start within the block time unless the user clears the entry state manually. Note: When 0 is set on the specified port, it means that the block authentication fail MAC address block time is set to infinite.
INT swMacBasedAuthClearPortAction	1.3.6.1.4.1.171.12.35.3.1.1.6	INTEGER	read-write	When set to start (2), the specified port will return to an un-authenticated state. All the timers associated with the specified port will be reset. When the administrator performs a get operation, it always returns the other (1).
INT swMacBasedAuthPortMaxUser	1.3.6.1.4.1.171.12.35.3.1.1.7	INTEGER	read-write	This object indicates the maximum number of authorized client(s) on the specified port. Note: The maximum number of authorized client (s) range is (0..N). The value N means the maximum number is determined by the project itself. When 0 is set on the specified port, the maximum number of authorized client(s) has no limit.
swMBAMgmt	1.3.6.1.4.1.171.12.35.4
swMacBasedAuthDatabaseTable	1.3.6.1.4.1.171.12.35.4.1		not-accessible	A table that contains the MAC-based Access Control account information.
swMacBasedAuthDatabaseEntry	1.3.6.1.4.1.171.12.35.4.1.1		not-accessible	A list that contains the MAC-based Access Control account information.
MAC swMacBasedAuthDatabaseMacIndex	1.3.6.1.4.1.171.12.35.4.1.1.1	MacAddress	read-only	This object indicates the MAC address for this user account.
STR swMacBasedAuthDatabaseVlanName	1.3.6.1.4.1.171.12.35.4.1.1.2	DisplayString	read-create	This object indicates the VLAN name for this user account.
ROW swMacBasedAuthDatabaseStatus	1.3.6.1.4.1.171.12.35.4.1.1.3	RowStatus	read-create	The status of this entry.
INT swMacBasedAuthDatabaseVID	1.3.6.1.4.1.171.12.35.4.1.1.5	INTEGER	read-create	This object indicates the VID for this user account. 0 indicates to delete the configured VID in this user account.
swMBATrap	1.3.6.1.4.1.171.12.35.11
swMBANotify	1.3.6.1.4.1.171.12.35.11.1
swMBANotifyPrefix	1.3.6.1.4.1.171.12.35.11.1.0
NTF swMacBasedAccessControlLoggedSuccess	1.3.6.1.4.1.171.12.35.11.1.0.1			The trap is sent when a MAC-based Access Control host has successfully logged in.
NTF swMacBasedAccessControlLoggedFail	1.3.6.1.4.1.171.12.35.11.1.0.2			The trap is sent when a MAC-based Access Control host's login fails.
NTF swMacBasedAccessControlAgesOut	1.3.6.1.4.1.171.12.35.11.1.0.3			The trap is sent when a MAC-based Access Control host ages out.
swMBANotifyBidings	1.3.6.1.4.1.171.12.35.11.1.1
INT swMacBasedAuthVID	1.3.6.1.4.1.171.12.35.11.1.1.1	INTEGER	accessible-for-notify	The VLAN ID for the host already exists.

RFC description

MAC-based access control MIB for port authentication, RADIUS authorization, and user session management.

Start monitoring D-Link managed switch (MAC-based port authentication) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download Mac-Based-Authentication-MIB

What Is Mac-Based-Authentication-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description