NETGEAR-DOT1X-ADVANCED-FEATURES-MIB

All MIBs › NETGEAR-DOT1X-ADVANCED-FEATURES-MIB

Organization: Netgear Inc

Last Updated: 2011-01-26

Category: Security

Description: Configures advanced IEEE 802.1X features including guest VLAN, unauthenticated VLAN, and fail-open on Netgear switches.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is NETGEAR-DOT1X-ADVANCED-FEATURES-MIB?

This is a Netgear-proprietary MIB (part of the Broadcom FastPath switch software family) that configures advanced IEEE 802.1X port-based network access control features, specifically guest VLAN assignment, unauthenticated VLAN, and fail-open behavior when the RADIUS/authentication server is unreachable. It exposes configuration data rather than runtime traffic counters, controlling how a switch port behaves for clients that fail or skip 802.1X authentication. In monitoring terms, its value is confirming the operational state/enablement of these advanced authentication-fallback features to ensure network-access policy is enforced as intended, such as verifying fail-open is correctly disabled in a secure environment. It builds on the base IEEE8021-PAE-MIB (the standard 802.1X MIB) which defines core supplicant/authenticator state, with this module layering Netgear-specific enhancements on top. Typical deployment context is a Netgear (or Broadcom FastPath-based) managed switch used at the network edge to enforce port-based access control for wired clients. Engineers can download the NETGEAR-DOT1X-ADVANCED-FEATURES-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in NETGEAR-DOT1X-ADVANCED-FEATURES-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Netgear managed switches (FastPath-based)

Monitoring Examples

An operator would check agentDot1xEnhancementConfigGroup to confirm whether guest VLAN, unauthenticated VLAN, and fail-open are enabled per port, verifying that a port intended for a guest kiosk correctly falls back to the guest VLAN rather than granting full network access. If fail-open is unexpectedly enabled on a secure port, this configuration group would reveal a policy misconfiguration that could let unauthenticated devices onto the production VLAN when the RADIUS server times out. As a configuration-focused MIB, it complements rather than replaces standard 802.1X state monitoring.

What Can Be Monitored

802.1X guest VLAN configuration
unauthenticated VLAN configuration
fail-open enable state
per-port advanced 802.1X enhancement settings

Imported Objects

From IEEE8021-PAE-MIB

dot1xPaePortNumber

OBJECT-TYPE

From QUANTA-LB6M-REF-MIB

lb6m	OBJECT-IDENTITY

From RFC1213-MIB

DisplayString

From SNMPv2-SMI

MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
TimeTicks
Unsigned32

From SNMPv2-TC

DateAndTime
MacAddress
RowStatus
TEXTUAL-CONVENTION

OIDs

OID symbolic	OID numeric	Type	Access	Description
fastPathdot1xAdvanced	1.3.6.1.4.1.4526.10.36			The Netgear Private MIB for FastPath Dot1x Advanced Features
agentDot1xEnhancementConfigGroup	1.3.6.1.4.1.4526.10.36.1
INT agentDot1xRadiusVlanAssignment	1.3.6.1.4.1.4526.10.36.1.1	INTEGER	read-write	Enable/Disable dot1x Vlan Assignment Support on the switch.
INT agentDot1xDynamicVlanCreationMode	1.3.6.1.4.1.4526.10.36.1.2	INTEGER	read-write	Enable/Disable dot1x dynamic vlan creation Support on the switch.
INT agentDot1xEapolFloodMode	1.3.6.1.4.1.4526.10.36.1.3	INTEGER	read-write	Enable/Disable dot1x eapol flooding mode on the switch.
agentDot1xPortConfigGroup	1.3.6.1.4.1.4526.10.36.2
agentDot1xPortConfigTable	1.3.6.1.4.1.4526.10.36.2.1		not-accessible	A table for dot1x enhanced Port details and associated functionality.
agentDot1xPortConfigEntry	1.3.6.1.4.1.4526.10.36.2.1.1		not-accessible	Represents entry for port config table.
DOT agentDot1xPortControlMode	1.3.6.1.4.1.4526.10.36.2.1.1.1	Dot1xPortControlMode	read-write	Dot1x port control mode of this port.The Port control mode . The port control mode for this interface can take the following values , force-unauthorized - the port is in unauthorized mode, auto-Port based mode. If a client authenticates suscessfully, then the interface is authorized . Otherwise, the port is in unauthorized mode. If more than one clients are attached to the port , then only one client needs to authenticate to allow other clients access. force-authorized - The port is placed in authorized mode macBased - If more than one client is attached to the port, then each client needs to authenticate separately. This object depcreates dot1xAuthAuthControlledPortControl object in IEEE8021-PAE-MIB
U32 agentDot1xGuestVlanId	1.3.6.1.4.1.4526.10.36.2.1.1.2	Unsigned32	read-write	Specifies the Guest Vlan of the port. A port will be moved to its Guest Vlan if no client sucessfully authenticates on that port for the Guest Vlan Period. A value of zero indicates no Guest Vlan is configured for the interface.
U32 agentDot1xGuestVlanPeriod	1.3.6.1.4.1.4526.10.36.2.1.1.3	Unsigned32	read-write	The value, in seconds, of the guestVlanPeriod constant currently in use for Guest Vlan Assignment for the port .
U32 agentDot1xUnauthenticatedVlan	1.3.6.1.4.1.4526.10.36.2.1.1.4	Unsigned32	read-write	Specifies the Unauthenticated Vlan of the port. A port will be moved to its unauthenticated Vlan if the client authenticates unsucessfully on that port . A value of zero indicates no Unauthenticated Vlan is configured for the port.
U32 agentDot1xMaxUsers	1.3.6.1.4.1.4526.10.36.2.1.1.5	Unsigned32	read-write	Specifies the maximum users or clients that can authenticate on this port when the port control mode is macBased.
U32 agentDot1xPortVlanAssigned	1.3.6.1.4.1.4526.10.36.2.1.1.6	Unsigned32	read-only	Specifies the vlan the port is assigned to by Dot1x . Only relevant if the port control mode of the port is auto.
INT agentDot1xPortVlanAssignedReason	1.3.6.1.4.1.4526.10.36.2.1.1.7	INTEGER	read-only	Reason the port is assigned to the vlan specified by agentDot1xPortVlanAssigned . Only relevant if the port control mode of the port is auto.
U32 agentDot1xPortSessionTimeout	1.3.6.1.4.1.4526.10.36.2.1.1.8	Unsigned32	read-only	Specifies the session timeout value assigned by the Radius server for this port . Only relevant if the port control mode of the port is auto.
DOT agentDot1xPortTerminationAction	1.3.6.1.4.1.4526.10.36.2.1.1.9	Dot1xSessionTerminationAction	read-only	Specifies the session termination action assigned by the Radius Server .This is the action taken when the session times out . Only relevant if the port control mode of the port is auto.
INT agentDot1xPortMABenabled	1.3.6.1.4.1.4526.10.36.2.1.1.10	INTEGER	read-write	Specifies if Mac-based bypass authentication is configured for the port.
INT agentDot1xPortMABenabledOperational	1.3.6.1.4.1.4526.10.36.2.1.1.11	INTEGER	read-only	Displays the operational value of the Mac-based authentication bypass mode (MAB) on the port.
agentDot1xClientConfigGroup	1.3.6.1.4.1.4526.10.36.3
agentDot1xClientConfigTable	1.3.6.1.4.1.4526.10.36.3.1		not-accessible	A table for dot1x Client details and associated functionality.
agentDot1xClientConfigEntry	1.3.6.1.4.1.4526.10.36.3.1.1		not-accessible	Represents entry for port config table.
MAC agentDot1xClientMacAddress	1.3.6.1.4.1.4526.10.36.3.1.1.1	MacAddress	read-only	Specifies the client MAC address of the client.
U32 agentDot1xLogicalPort	1.3.6.1.4.1.4526.10.36.3.1.1.2	Unsigned32	read-only	Specifies the client MAC address of the client .
U32 agentDot1xInterface	1.3.6.1.4.1.4526.10.36.3.1.1.3	Unsigned32	read-only	Specifies the physical interface to which the client is attached .
INT agentDot1xClientAuthPAEstate	1.3.6.1.4.1.4526.10.36.3.1.1.4	INTEGER	read-only	The current value of the Authenticator PAE state machine for the client.
INT agentDot1xClientBackendState	1.3.6.1.4.1.4526.10.36.3.1.1.5	INTEGER	read-only	The current state of the Backend Authentication state machine.
STR agentDot1xClientUserName	1.3.6.1.4.1.4526.10.36.3.1.1.6	DisplayString	read-only	Specifies the username with which the client is authenticated to the Radius server . This value is only valid when the client is in authenticated state.
U32 agentDot1xClientSessionTime	1.3.6.1.4.1.4526.10.36.3.1.1.7	Unsigned32	read-only	Specifies the time elapsed in seconds since the client was authenticated in this session. This value is only valid when the client is in authenticated state.
STR agentDot1xClientFilterID	1.3.6.1.4.1.4526.10.36.3.1.1.8	DisplayString	read-only	Specifies the Filter ID or Diffserv Policy name to be applied to the session . This vlaue is populated only if it has been assigned by the RADIUS server. This value is only valid when the client is in authenticated state.
U32 agentDot1xClientVlanAssigned	1.3.6.1.4.1.4526.10.36.3.1.1.9	Unsigned32	read-only	Specifies the vlan the client is associated with by Dot1x . This value is only valid when the client is in authenticated state.
INT agentDot1xClientVlanAssignedReason	1.3.6.1.4.1.4526.10.36.3.1.1.10	INTEGER	read-only	Reason the client is associated to the vlan specified by agentDot1xClientVlanAssigned . This value is only valid when the client is in authenticated state.
U32 agentDot1xClientSessionTimeout	1.3.6.1.4.1.4526.10.36.3.1.1.11	Unsigned32	read-only	Specifies the session time remaining for the client if assigned by the Radius server . A value of 0 indicates that no session timeout was assigned by the RADIUS server. This value is only valid when the client is in authenticated state.
DOT agentDot1xClientTerminationAction	1.3.6.1.4.1.4526.10.36.3.1.1.12	Dot1xSessionTerminationAction	read-only	Specifies the session termination action assigned by the Radius Server . This is the action taken when the session times out . This value is only valid when the client is in authenticated state.
agentDot1xMonitorModeConfigGroup	1.3.6.1.4.1.4526.10.36.4
INT agentDot1xMonitorModeEnabled	1.3.6.1.4.1.4526.10.36.4.1	INTEGER	read-write	Enable/Disable Dot1x Monitor mode Support on the switch.
U32 agentDot1xMonitorModeClients	1.3.6.1.4.1.4526.10.36.4.2	Unsigned32	read-only	Retrieves the number of clients that got authenticated by Monitor mode globally.
U32 agentDot1xNonMonitorModeClients	1.3.6.1.4.1.4526.10.36.4.3	Unsigned32	read-only	Retrieves the number of clients that are granted access by Dot1x with no monitor mode enabled.
agentDot1xAuthHistoryResultsGroup	1.3.6.1.4.1.4526.10.36.5
agentDot1xPortAuthHistoryResultTable	1.3.6.1.4.1.4526.10.36.5.1		not-accessible	A table to display the dot1x monitor mode results.
agentDot1xPortAuthHistoryResultEntry	1.3.6.1.4.1.4526.10.36.5.1.1		not-accessible	Represents Dot1x Authentication results for a Dot1x Authentication History table.
U32 agentDot1xAuthHistoryResultIfaceIndex	1.3.6.1.4.1.4526.10.36.5.1.1.1	Unsigned32	read-only	This object represents the physical Bridge Port on which dot1x Auth event might be received.
U32 agentDot1xAuthHistoryResultIndex	1.3.6.1.4.1.4526.10.36.5.1.1.2	Unsigned32	read-only	Reference to the Dot1x Authentication history table maintained.
DAT agentDot1xAuthHistoryResultTimeStamp	1.3.6.1.4.1.4526.10.36.5.1.1.3	DateAndTime	read-only	Specifies the exact time of Dot1x Authentication event information occurred maintained in the history table.
TIK agentDot1xAuthHistoryResultAge	1.3.6.1.4.1.4526.10.36.5.1.1.4	TimeTicks	read-only	Time since the authentication entry was added to the history table. It is displayed in days, hours, minutes, and seconds.
MAC agentDot1xAuthHistoryResultMacAddress	1.3.6.1.4.1.4526.10.36.5.1.1.5	MacAddress	read-only	Specifies the client MAC Address maintained in the Dot1x Authentication history table.
U32 agentDot1xAuthHistoryResultVlanId	1.3.6.1.4.1.4526.10.36.5.1.1.6	Unsigned32	read-only	Specifies the VLANID maintained in the history table. It is the VLANID which is failed to associate to the port during authentication process. The VLANID is identified distinctly by the Reason code for the respective entry. Valid only when the reason code is set to 13 (VLAN assignment failure). In all the other cases, VLANID is set to 0.
INT agentDot1xAuthHistoryResultAuthStatus	1.3.6.1.4.1.4526.10.36.5.1.1.7	INTEGER	read-only	Specifies the Dot1x Authentication status (Success or Failure) for the Dot1x Authentication event takes place.
INT agentDot1xAuthHistoryResultAccessStatus	1.3.6.1.4.1.4526.10.36.5.1.1.8	INTEGER	read-only	Authentication access status indicates the exact status of the dot1x client. Granted means the client is allowed access to the network using dot1x or monitor mode. Denied means the client is not allowed access to the network.
STR agentDot1xAuthHistoryResultFilterID	1.3.6.1.4.1.4526.10.36.5.1.1.9	DisplayString	read-only	Specifies the Filter ID or Diffserv Policy name assigned by the RADIUS server. This value is only valid when the client is in authenticated state.
U32 agentDot1xAuthHistoryResultVlanAssigned	1.3.6.1.4.1.4526.10.36.5.1.1.10	Unsigned32	read-only	Specifies the VLANID maintained in the history table (It is the VLANID Assigned to a Port or Client authenticate).
INT agentDot1xAuthHistoryResultVlanAssignedType	1.3.6.1.4.1.4526.10.36.5.1.1.11	INTEGER	read-only	Specifies the VLAN Assigned Reason maintained in the history table.
INT agentDot1xAuthHistoryResultReasonCode	1.3.6.1.4.1.4526.10.36.5.1.1.12	INTEGER	read-only	Specifies the Dot1x authentication reason refered by the result index on a port.
INT agentDot1xAuthHistoryResultsClear	1.3.6.1.4.1.4526.10.36.5.2	INTEGER	read-write	When set to enable(1), all Dot1x Authentication History information will be reset.
agentDot1xPortAuthHistoryResultClearTable	1.3.6.1.4.1.4526.10.36.5.3		not-accessible	A table to clear the dot1x monitor mode results per interface.
agentDot1xPortAuthHistoryResultClearEntry	1.3.6.1.4.1.4526.10.36.5.3.1		not-accessible	Represents to clear the Dot1x Authentication results for a Dot1x Authentication History table.
U32 agentDot1xAuthHistoryResultIfIndex	1.3.6.1.4.1.4526.10.36.5.3.1.1	Unsigned32	read-only	This object represents the physical Bridge Port on which dot1x Auth event might be received.
INT agentDot1xPortAuthHistoryResultsClear	1.3.6.1.4.1.4526.10.36.5.3.1.2	INTEGER	read-write	When set to enable(1), all Dot1x Authentication History information for the given port will be reset. The value is write-only. Attempt to read will return disable(2).

RFC description

NETGEAR private MIB defining advanced IEEE 802.1X port-based authentication configuration and monitoring objects for NETGEAR managed switches.

Start monitoring Netgear managed switch (FastPath-based, 802.1X advanced features) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download NETGEAR-DOT1X-ADVANCED-FEATURES-MIB

What Is NETGEAR-DOT1X-ADVANCED-FEATURES-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description