NETSCREEN-UAC-MIB

All MIBs › NETSCREEN-UAC-MIB

Organization: Juniper Networks, Inc.

Last Updated: 2010-04-14

Description: MIB for Unified Access Control active user counts and UAC controller connection status on Juniper NetScreen security devices

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is NETSCREEN-UAC-MIB?

NETSCREEN-UAC-MIB is a Juniper NetScreen (ScreenOS) vendor MIB for Unified Access Control (UAC), a network access control feature integrating the firewall with Juniper's Infranet/UAC controller. It exposes the current count of active UAC-authenticated users and a table of configured UAC controllers with their identity, hostname, and connection status. Its monitoring value is software/service status: administrators track whether the firewall's connection to each UAC controller is up, and monitor active user counts to gauge access-control load and confirm the integration is functioning. It explicitly depends on the separate Juniper/Infranet UAC controller product and protocol, since this MIB only reflects the firewall-side view of that connection. It is deployed on Juniper NetScreen firewalls acting as UAC enforcement points in enterprise networks using identity-based network access control. Network engineers evaluating or troubleshooting this functionality can download the NETSCREEN-UAC-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in NETSCREEN-UAC-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Juniper NetScreen firewall (UAC enforcement point)

Monitoring Examples

An administrator would poll nsUACActiveUsers to track how many users are currently authenticated through UAC, watching for an unexpected drop to zero. Walking nsUACControlerStatusTable/nsUACControlerStatusEntry and checking nsUACConnectionStatus per nsUACControlerName would reveal a specific UAC controller that has gone unreachable, explaining why new user sessions are being rejected. The overall nsUACGlobalStatus gives a single indicator of whether UAC enforcement is active on the device.

What Can Be Monitored

active UAC user count
UAC controller connection status
controller identity/hostname
global UAC enforcement status

Imported Objects

From NETSCREEN-SMI

netscreenUAC

OBJECT-IDENTITY

From SNMPv2-SMI

Integer32
MODULE-IDENTITY
OBJECT-TYPE

From SNMPv2-TC

DisplayString

How to Use in IPNetwork Monitor

Example using nsUACActiveUsers OID:

Select a Juniper NetScreen firewall (Unified Access Control enforcement point) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type nsUACActiveUsers into the Find box to locate it in the OID tree, then select it and click OK. It reports the active users on this box, base on auth entry from UAC controler. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is an Integer32-type OID, Value bounds is the most useful condition here — trigger an alert if the value drifts significantly from its normal baseline, since an unexpected change often points to a real underlying issue. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
netscreenUACMibModule	1.3.6.1.4.1.3224.19.0			This module defines the object that are used to monitor all UAC
I32 nsUACActiveUsersEx	1.3.6.1.4.1.3224.19.1	Integer32	read-only	Active users on this box, base on auth entry from UAC controler
nsUACControlerStatusTable	1.3.6.1.4.1.3224.19.2		not-accessible	NetScreen UAC controler status table
nsUACControlerStatusEntry	1.3.6.1.4.1.3224.19.2.1		not-accessible	Each entry in the table holds a set of configuration parameters associated with an instance of secure UAC.
I32 nsUACControlerId	1.3.6.1.4.1.3224.19.2.1.1	Integer32	read-only	A unique value for UAC table. Its value ranges between 1 and 65535 and may not be contiguous. the index has no other meaning but a pure index
STR nsUACControlerName	1.3.6.1.4.1.3224.19.2.1.2	DisplayString	read-only	Secure UAC name.
STR nsUACControlerHost	1.3.6.1.4.1.3224.19.2.1.3	DisplayString	read-only	Secure UAC name.
INT nsUACConnectionStatus	1.3.6.1.4.1.3224.19.2.1.4	INTEGER	read-only	UAC controler status table
INT nsUACGlobalStatus	1.3.6.1.4.1.3224.19.3	INTEGER	read-only	To indicate whether there is at least one heathy IC-IE connection

RFC description

Juniper NetScreen UAC (User Activity Controller) monitoring for active users and controller connection status.

Start monitoring Juniper NetScreen firewall (Unified Access Control enforcement point) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download NETSCREEN-UAC-MIB