NORTEL-SECURE-NETWORK-ACCESS-MIB

All MIBs › NORTEL-SECURE-NETWORK-ACCESS-MIB

Organization: Nortel Networks

Last Updated: 2007-06-29

Category: Nortel Security

Description: Manages Nortel Secure Network Access (SNA/NAC) endpoint posture assessment, quarantine VLAN assignment, and remediation status.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is NORTEL-SECURE-NETWORK-ACCESS-MIB?

NORTEL-SECURE-NETWORK-ACCESS-MIB is a Nortel Networks proprietary MIB configuring NSNA (Nortel Secure Network Access), a NAC (Network Access Control) framework that quarantines clients until they pass a security posture check. Its objects cover a global enable flag, connection state and addressing to the NSNAS (NSNA Server), hello/inactivity/status-quo timing intervals, MAC-authentication enable, and fail-open behavior (including which VLAN to fail open into). As a configuration/security-status MIB it lets an administrator confirm NSNA is enabled with correct server connectivity and understand what happens to clients if the NSNA server becomes unreachable (fail-open VLAN). It is deployed on Nortel switches (Ethernet Routing Switch/BayStack family) implementing NSNA. Engineers can download the NORTEL-SECURE-NETWORK-ACCESS-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in NORTEL-SECURE-NETWORK-ACCESS-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Nortel switches (Ethernet Routing Switch/BayStack family, NSNA)

Monitoring Examples

An administrator checks nsnaFailOpenEnabled and nsnaFailOpenVlan to confirm what happens to client traffic if the NSNA server becomes unreachable, before relying on NSNA for network-wide access control.

What Can Be Monitored

NSNA server connection state
fail-open behavior configuration

Imported Objects

From IF-MIB

InterfaceIndex

From INET-ADDRESS-MIB

InetAddress
InetAddressPrefixLength
InetAddressType
InetPortNumber

From Q-BRIDGE-MIB

VlanId
VlanIdOrNone

From RAPID-CITY

IdList

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-SMI

Integer32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE

From SNMPv2-TC

MacAddress
RowStatus
TEXTUAL-CONVENTION
TruthValue

From SYNOPTICS-ROOT-MIB

bayStackMibs

OBJECT-IDENTITY

How to Use in IPNetwork Monitor

Example using nsnaNsnasConnectionState OID:

Select a Nortel switch (Ethernet Routing Switch/BayStack family, NSNA) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type nsnaNsnasConnectionState into the Find box to locate it in the OID tree, then select it and click OK. Indicates whether the switch currently has a connection to an NSNAS, whether the switch is currently in the process of establishing a connection to an NSNAS, or whether an existing connecting to an NSNAS is in the process of being closed. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is an INTEGER-type OID, Value bounds is the most useful condition here — trigger an alert if the value is anything other than 'connected', since that indicates the condition this object reports has changed to one worth investigating. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
nortelSecureNetworkAccessMib	1.3.6.1.4.1.45.5.10			Nortel Networks NSNA MIB Copyright 2004 Nortel Networks, Inc. All rights reserved. This Nortel Networks SNMP Management Information Base Specification embodies Nortel Networks' confidential and proprietary intellectual property. Nortel Networks retains all title and ownership in the Specification, including any revisions. This Specification is supplied 'AS IS,' and Nortel Networks makes no warranty, either express or implied, as to the use, operation, condition, or performance of the Specification.
nsnaNotifications	1.3.6.1.4.1.45.5.10.0
NTF nsnaClosedConnectionToSnas	1.3.6.1.4.1.45.5.10.0.1			This notification is generated whenever the device closes the connection to the NSNAS. The reason why the connection is closed is indicated in nsnaClosedConnectionReason.
NTF nsnaStatusQuoIntervalExpired	1.3.6.1.4.1.45.5.10.0.2			This notification is generated whenever the status-quo interval expires after the connection to the NSNAS has closed. Note that if the configured status-quo interval is 0 (indicating no status quo interval), this notification will be generated at the same time as the corresponding nsnaClosedConnectionToSnas notification.
NTF nsnaInvalidMessageFromSnas	1.3.6.1.4.1.45.5.10.0.3			This notification is generated whenever the device receives an invalid message from the NSNAS. This generally means that the received message is corrupted. As much of the message header as is available will be included in nsnaInvalidMessageHeader.
NTF nsnaSnasConnected	1.3.6.1.4.1.45.5.10.0.4			This notification is generated whenever an NSNAS successfully connects to the switch.
nsnaObjects	1.3.6.1.4.1.45.5.10.1
nsnaScalars	1.3.6.1.4.1.45.5.10.1.1
T/F nsnaEnabled	1.3.6.1.4.1.45.5.10.1.1.1	TruthValue	read-write	Indicates whether NSNA is globally enabled for the system.
INT nsnaNsnasConnectionStateEx	1.3.6.1.4.1.45.5.10.1.1.3	INTEGER	read-only	Indicates whether the switch currently has a connection to an NSNAS, whether the switch is currently in the process of establishing a connection to an NSNAS, or whether an existing connecting to an NSNAS is in the process of being closed.
IPt nsnaNsnasInetAddressType	1.3.6.1.4.1.45.5.10.1.1.4	InetAddressType	read-only	If a NSNAS is currently connected to the switch, this indicates the type of the internet address from which the NSNAS connected. The contents of nsnaSnasInetAddress will be of this type. If there is not currently a NSNAS connected, the value will be unknown(0).
IP nsnaNsnasInetAddress	1.3.6.1.4.1.45.5.10.1.1.5	InetAddress	read-only	If a NSNAS is currently connected to the switch, this indicates the internet address from which the NSNAS connected. If there is not currently a NSNAS connected, this will be an empty string.
I32 nsnaNsnasSendHelloInterval	1.3.6.1.4.1.45.5.10.1.1.6	Integer32	read-only	The interval for sending SSCP Hello messages for the current SSCP connection. If this period of time passes without any SSCP messages being sent, a Hello message will be generated. If there is not curently an NSNAS connected, this value will be zero, otherwise it will be non-zero.
I32 nsnaNsnasInactivityInterval	1.3.6.1.4.1.45.5.10.1.1.7	Integer32	read-only	The inactivity interval for the current SSCP connection. If this period of time passes without any SSCP messages being received, the SSCP connection will be closed. If there is not curently an NSNAS connected, this value will be zero, otherwise it will be non-zero.
I32 nsnaNsnasStatusQuoInterval	1.3.6.1.4.1.45.5.10.1.1.8	Integer32	read-only	The status-quo interval for the current or last SSCP connection. If the NSNAS is disconnected from the switch for any reason, the switch will wait this period of time before moving all NSNA enabled ports to the red VLAN. The maximum value, 65535, indicates an infinite status quo interval, i.e., SSA enabled ports will not be moved to the red VLAN. A value of 0 means no status quo interval is used, and ports are immediately moved the the red VLAN if the NSNAS is disconnected. If the NSNAS has disconnected and the status-quo interval timer is running, this value will reflect the remaining time until the status-quo timer will expire.
T/F nsnaMacAuthenticationEnabled	1.3.6.1.4.1.45.5.10.1.1.9	TruthValue	read-only	This object indicates whether MAC Authentication is currently enabled on the switch.
T/F nsnaFailOpenEnabled	1.3.6.1.4.1.45.5.10.1.1.10	TruthValue	read-write	This object indicates whether the Fail-Open feature is currently enabled on the switch.
VLA nsnaFailOpenVlan	1.3.6.1.4.1.45.5.10.1.1.11	VlanIdOrNone	read-write	This object indicates the current Fail-Open Vlan ID. A value of 0 indicates the value either has not been set, or that the previous value is no longer valid.
VLA nsnaFailOpenFilterVlan	1.3.6.1.4.1.45.5.10.1.1.12	VlanIdOrNone	read-write	This object indicates the current Vlan ID whose associated filters are to be used as the Fail-Open filters. A value of 0 indicates the value either has not been set, or that the previous value is no longer valid.
I32 nsnaNsnasConnectionVersion	1.3.6.1.4.1.45.5.10.1.1.14	Integer32	read-only	This object indicates the SSCP version being used in the current NSNAS connection. If there is no current connection, the value will be 0.
T/F nsnaNsnasRadiusServerEnabled	1.3.6.1.4.1.45.5.10.1.1.15	TruthValue	read-only	This object indicates whether the NSNAS currently connected to the switch is acting as a RADIUS server.
INE nsnaNsnasRadiusServerPort	1.3.6.1.4.1.45.5.10.1.1.16	InetPortNumber	read-only	If there is an NSNAS currently connected to the switch that is acting as a RADIUS server, this object returns the port on which that server listens for RADIUS requests.
nsnaNsnasTable	1.3.6.1.4.1.45.5.10.1.2		not-accessible	The table of subnets from which NSNASs will connect.
nsnaNsnasEntry	1.3.6.1.4.1.45.5.10.1.2.1		not-accessible	A set of objects that specify a subnet from which NSNASs will connect, along with related configuration parameters.
IPt nsnaNsnasAddressType	1.3.6.1.4.1.45.5.10.1.2.1.1	InetAddressType	not-accessible	The type of internet address contained in nsnaNsnasAddress.
IP nsnaNsnasAddress	1.3.6.1.4.1.45.5.10.1.2.1.2	InetAddress	not-accessible	The internet address portion of the NSNAS subnet. This combined with the value of nsnaNsnasAddressMask specifies the subnet of the NSNAS.
ADR nsnaNsnasAddressMask	1.3.6.1.4.1.45.5.10.1.2.1.3	InetAddressPrefixLength	not-accessible	The address mask portion of the NSNAS subnet. This combined with the value of nsnaNsnasAddress specifies the subnet of the NSNAS.
INE nsnaNsnasPort	1.3.6.1.4.1.45.5.10.1.2.1.4	InetPortNumber	read-create	The port on which NSNASs connecting from this subnet will connect.
ROW nsnaNsnasRowStatus	1.3.6.1.4.1.45.5.10.1.2.1.5	RowStatus	read-create	This object is used for row create/deletion.
nsnaPortTable	1.3.6.1.4.1.45.5.10.1.3		not-accessible	The table of per-port NSNA configuration parameters. There must be an entry in this table for each NSNA-capable port.
nsnaPortEntry	1.3.6.1.4.1.45.5.10.1.3.1		not-accessible	NSNA configuration parameters for a port.
NUM nsnaPortIfIndex	1.3.6.1.4.1.45.5.10.1.3.1.1	InterfaceIndex	not-accessible	The ifIndex corresponding to the port.
INT nsnaPortMode	1.3.6.1.4.1.45.5.10.1.3.1.2	INTEGER	read-write	The NSNA mode of the port.
NSN nsnaPortGreenVlanId	1.3.6.1.4.1.45.5.10.1.3.1.3	NsnaVlanIdOrNone	read-write	The green VLAN ID of the port. This value is only used when the corresponding value of nsnaPortMode is static(2). Otherwise, the value will be 0.
IDL nsnaPortVoipVlans	1.3.6.1.4.1.45.5.10.1.3.1.4	IdList	read-write	The set of VOIP VLANs to which this port belongs. This value is only used when the corresponding value of nsnaPortMode is static(2), dynamic(3), or secure(5).
IDL nsnaPortUplinkVlans	1.3.6.1.4.1.45.5.10.1.3.1.5	IdList	read-write	The set of uplink VLANs to which this port belongs. This value is only used when the corresponding value of nsnaPortMode is uplink(4).
INT nsnaPortState	1.3.6.1.4.1.45.5.10.1.3.1.6	INTEGER	read-only	The current NSNA color of the port.
INT nsnaPortDhcpState	1.3.6.1.4.1.45.5.10.1.3.1.7	INTEGER	read-only	The DHCP state of the port.
T/F nsnaPortHubModeEnabled	1.3.6.1.4.1.45.5.10.1.3.1.8	TruthValue	read-write	Indicates whether Hub Mode is enabled on a port.
I32 nsnaPortHubModeMaxClients	1.3.6.1.4.1.45.5.10.1.3.1.9	Integer32	read-write	The maximum number of clients allowed on a port when Hub Mode is enabled. The value is ignored if Hub Mode is disabled.
nsnaVlanTable	1.3.6.1.4.1.45.5.10.1.4		not-accessible	The table of per-Vlan NSNA configuration parameters. There must be an entry in this table for every Vlan.
nsnaVlanEntry	1.3.6.1.4.1.45.5.10.1.4.1		not-accessible	NSNA configuration parameters for a Vlan.
VLA nsnaVlanId	1.3.6.1.4.1.45.5.10.1.4.1.1	VlanId	not-accessible	The ID of the Vlan.
INT nsnaVlanColor	1.3.6.1.4.1.45.5.10.1.4.1.2	INTEGER	read-write	The NSNA color of the Vlan.
STR nsnaVlanFilterSetName	1.3.6.1.4.1.45.5.10.1.4.1.3	SnmpAdminString	read-write	The name of the filter set associated with the VLAN. An empty value means that no filter set is associated with the VLAN.
I32 nsnaVlanFilterSetId	1.3.6.1.4.1.45.5.10.1.4.1.4	Integer32	read-write	The ID of the filter set associated with the VLAN. A value of 0 means that no filter set is associated with the VLAN.
IPt nsnaVlanYellowSubnetType	1.3.6.1.4.1.45.5.10.1.4.1.5	InetAddressType	read-write	The type of internet address contained in the corresponding instance of nsnaVlanYellowSubnet.
IP nsnaVlanYellowSubnet	1.3.6.1.4.1.45.5.10.1.4.1.6	InetAddress	read-write	The yellow subnet address of the VLAN. This value is only used when the corresponding value of nsnaVlanColor is yellow(4).
ADR nsnaVlanYellowSubnetMask	1.3.6.1.4.1.45.5.10.1.4.1.7	InetAddressPrefixLength	read-write	The number of bits in the network mask of the yellow subnet address of the VLAN. This value is only used when the corresponding value of nsnaVlanColor is yellow(4).
nsnaClientTable	1.3.6.1.4.1.45.5.10.1.5		not-accessible	The table of per-client NSNA state information. There must be an entry in this table for every NSNA client.
nsnaClientEntry	1.3.6.1.4.1.45.5.10.1.5.1		not-accessible	State information for an NSNA client.
NUM nsnaClientIfIndex	1.3.6.1.4.1.45.5.10.1.5.1.1	InterfaceIndex	not-accessible	The ifIndex of the port on which the client is attached.
MAC nsnaClientMacAddress	1.3.6.1.4.1.45.5.10.1.5.1.2	MacAddress	not-accessible	The MAC address of the client.
INT nsnaClientDeviceType	1.3.6.1.4.1.45.5.10.1.5.1.3	INTEGER	read-only	The type of device of the client.
VLA nsnaClientVlanId	1.3.6.1.4.1.45.5.10.1.5.1.4	VlanId	read-only	The Vlan ID of the client.
IPt nsnaClientAddressType	1.3.6.1.4.1.45.5.10.1.5.1.5	InetAddressType	read-only	The type of address contained in the corresponding instance of nsnaClientAddress.
IP nsnaClientAddress	1.3.6.1.4.1.45.5.10.1.5.1.6	InetAddress	read-only	The IP address of the client.
T/F nsnaClientExpired	1.3.6.1.4.1.45.5.10.1.5.1.7	TruthValue	read-only	Indicates whether this client has been aged-out.
VLA nsnaClientFilterVlanId	1.3.6.1.4.1.45.5.10.1.5.1.8	VlanId	read-only	The Vlan ID whose associated filter set is installed on this port for this client. This is used when MAC Authentication is enabled. If MAC Authentication is no enabled, this object will return the same value as nsnaClientVlanId.
INT nsnaClientStatus	1.3.6.1.4.1.45.5.10.1.5.1.9	INTEGER	read-only	The status of this client.
nsnaStaticClientTable	1.3.6.1.4.1.45.5.10.1.6		not-accessible	The table of static NSNA client configuration. This is used for authenticating clients on static NSNA ports.
nsnaStaticClientEntry	1.3.6.1.4.1.45.5.10.1.6.1		not-accessible	Static NSNA client configuration.
VLA nsnaStaticClientVlanId	1.3.6.1.4.1.45.5.10.1.6.1.1	VlanId	not-accessible	The VLAN ID in which a client is allowed.
MAC nsnaStaticClientMacAddress	1.3.6.1.4.1.45.5.10.1.6.1.2	MacAddress	not-accessible	The MAC address of an allowed client.
INT nsnaStaticClientDeviceType	1.3.6.1.4.1.45.5.10.1.6.1.3	INTEGER	read-create	The type of device of the allowed client.
IPt nsnaStaticClientAddressType	1.3.6.1.4.1.45.5.10.1.6.1.4	InetAddressType	read-create	The type of address contained in the corresponding instance of nsnaStaticClientAddress.
IP nsnaStaticClientAddress	1.3.6.1.4.1.45.5.10.1.6.1.5	InetAddress	read-create	The IP address to be used for the allowed client.
ROW nsnaStaticClientRowStatus	1.3.6.1.4.1.45.5.10.1.6.1.6	RowStatus	read-create	Used for row creation/deletion. When creating a row, the corresponding instances of nsnaStaticClientDeviceType, nsnaStaticClientAddressType, and nsnaStaticClientAddress must be set before this object can be made active(1).
nsnaIpPhoneSignatureTable	1.3.6.1.4.1.45.5.10.1.7		not-accessible	The table of IP phone signature string configuration. This is used for recognizing IP phones.
nsnaIpPhoneSignatureEntry	1.3.6.1.4.1.45.5.10.1.7.1		not-accessible	IP phone signature string configuration.
OCT nsnaIpPhoneSignatureString	1.3.6.1.4.1.45.5.10.1.7.1.1	OCTET STRING	not-accessible	The signature string of an IP phone.
ROW nsnaIpPhoneSignatureRowStatus	1.3.6.1.4.1.45.5.10.1.7.1.2	RowStatus	read-create	Used for row creation/deletion.
nsnaNotificationObjects	1.3.6.1.4.1.45.5.10.1.8
INT nsnaClosedConnectionReason	1.3.6.1.4.1.45.5.10.1.8.1	INTEGER	accessible-for-notify	Indicates the reason why the connection to the NSNAS was closed.
OCT nsnaInvalidMessageHeader	1.3.6.1.4.1.45.5.10.1.8.2	OCTET STRING	accessible-for-notify	The header of an invalid message from the NSNAS. Note that if an entire header is not available, only the portion that is available will be provided in this object.

RFC description

Controls Nortel secure network access (802.1X, NAC) policies and RADIUS authentication on network switches.

Start monitoring Nortel switch (Ethernet Routing Switch/BayStack family, NSNA) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download NORTEL-SECURE-NETWORK-ACCESS-MIB