PANA-MIB

All MIBs › PANA-MIB

Organization: IETF PANA Working Group

Last Updated: 2004-02-05

Description: MIB for PANA authentication protocol objects extending the IPsec SPD MIB, managing PAA-to-EP policy bindings for network access authentication

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is PANA-MIB?

This is a vendor-neutral IETF draft MIB module defining objects specific to the PANA (Protocol for Carrying Authentication for Network Access) protocol, extending the IPsec Security Policy Database (SPD) MIB with PANA-specific bindings. It exposes data modeling the relationship between a PANA Authentication Agent (PAA) and Enforcement Point (EP), essentially policy bindings that link authenticated clients to network access enforcement rules. Its monitoring value is primarily around software/protocol status, whether authentication policy bindings are correctly established between the PAA and EP, rather than physical hardware health, since PANA is a network-access-authentication signaling protocol. It has an explicit, stated dependency on the IPsec SPD MIB, whose objects it augments with PANA-specific bindings, making it inherently tied to that companion standard. It is typically deployed in network access control contexts, such as ISP or enterprise edge routers/access points, implementing PANA-based authentication for network admission control. Engineers implementing or auditing this functionality typically reference the PANA-MIB RFC/standard documentation for the authoritative specification.

IPNetwork Monitor allows you to monitor SNMP objects defined in PANA-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

vendor-neutral, standards-based MIB, not tied to a specific manufacturer
network access routers/enforcement points implementing PANA authentication

Monitoring Examples

An administrator would poll PANA-to-EP policy binding objects to confirm that an authenticated client (PAA session) has a corresponding enforcement policy correctly installed at the EP. A missing or stale binding would reveal that a client was authenticated but its access enforcement rule failed to apply, potentially allowing or blocking traffic incorrectly. Since no concrete sample objects were provided, exact table names would need to be checked against the compiled draft MIB, but they extend the IPsec SPD MIB's binding tables, making this MIB chiefly useful for auditing that authentication and enforcement stay in sync.

What Can Be Monitored

PAA-to-EP policy bindings
PANA authentication session status
IPsec SPD binding association
enforcement policy application status

Imported Objects

From IPSEC-SPD-MIB

spdActionExecuted	OBJECT-TYPE
spdIPDestinationAddress	OBJECT-TYPE
spdIPDestinationType	OBJECT-TYPE
spdIPInterfaceAddress
spdIPInterfaceType
spdIPSourceAddress	OBJECT-TYPE
spdIPSourceType	OBJECT-TYPE
spdMIB	MODULE-IDENTITY
spdPacketDirection	OBJECT-TYPE

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-CONF

MODULE-COMPLIANCE
NOTIFICATION-GROUP
OBJECT-GROUP

From SNMPv2-SMI

Integer32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE
mib-2

From SNMPv2-TC

PhysAddress
RowStatus
StorageType
TimeStamp

OIDs

OID symbolic	OID numeric	Type	Access	Description
panaMIB	1.3.6.1.2.1.186			The MIB module for defining additional PANA-specific objects to the IPSec SPD MIB. Copyright (C) The Internet Society (2003). This version of this MIB module is part of RFC XXXX, see the RFC itself for full legal notices.
panaConfigObjects	1.3.6.1.2.1.186.1
pana802FilterTable	1.3.6.1.2.1.186.1.1		not-accessible	IEEE 802-based filter definitions. A class that contains attributes of IEEE 802 (e.g., 802.3) traffic that form filters that are used to perform traffic classification.
pana802FilterEntry	1.3.6.1.2.1.186.1.1.1		not-accessible	IEEE 802-based filter definitions. An entry specifies (potentially) several distinct matching components. Each component is tested against the data in a frame individually. An overall match occurs when all of the individual components match the data they are compared against in the frame being processed. A failure of any one test causes the overall match to fail. Wildcards may be specified for those fields that are not relevant.
STR pana802FilterName	1.3.6.1.2.1.186.1.1.1.1	SnmpAdminString	not-accessible	The administrative name for this filter.
BIT pana802FilterType	1.3.6.1.2.1.186.1.1.1.2	Bits	read-create	This defines the various tests that are used when evaluating a given filter. The results of each test are ANDed together to produce the result of the entire filter. When processing this filter, it is recommended for efficiency reasons that the filter halt processing the instant any of the specified tests fail. Once a row is 'active', this object's value may not be changed unless all the appropriate columns needed by the new value to be imposed on this object have been appropriately configured. .
PHY pana802FilterDstAddr	1.3.6.1.2.1.186.1.1.1.3	PhysAddress	read-create	The 802 address against which the 802 DA of incoming traffic streams will be compared. Frames whose 802 DA matches the physical address specified by this object, taking into account address wildcarding as specified by the pana802FilterDstAddrMask object, are potentially subject to the processing guidelines that are associated with this entry through the related action class.
PHY pana802FilterSrcAddr	1.3.6.1.2.1.186.1.1.1.4	PhysAddress	read-create	The 802 MAC address against which the 802 MAC SA of incoming traffic streams will be compared. Frames whose 802 MAC SA matches the physical address specified by this object, taking into account address wildcarding as specified by the pana802FilterSrcAddrMask object, are potentially subject to the processing guidelines that are associated with this entry through the related action class.
I32 pana802FilterVlanId	1.3.6.1.2.1.186.1.1.1.5	Integer32	read-create	The VLAN ID (VID) that uniquely identifies a VLAN within the device. This VLAN may be known or unknown (i.e., traffic associated with this VID has not yet been seen by the device) at the time this entry is instantiated. Setting the pana802FilterVlanId object to -1 indicates that VLAN data should not be considered during traffic classification.
INT pana802FilterVlanTagRequired	1.3.6.1.2.1.186.1.1.1.6	INTEGER	read-create	This object indicates whether the presence of an IEEE 802.1Q VLAN tag in data link layer frames must be considered when determining if a given frame matches this 802 filter entry. A value of 'taggedOnly(1)' means that only frames containing a VLAN tag with a non-Null VID (i.e., a VID in the range 1..4094) will be considered a match. A value of 'priorityTaggedPlus(2)' means that only frames containing a VLAN tag, regardless of the value of the VID, will be considered a match. A value of 'untaggedOnly(3)' indicates that only untagged frames will match this filter component. The presence of a VLAN tag is not taken into consideration in terms of a match if the value is 'ignoreTag(4)'.
I32 pana802FilterEtherType	1.3.6.1.2.1.186.1.1.1.7	Integer32	read-create	This object specifies the value that will be compared against the value contained in the EtherType field of an IEEE 802 frame. Example settings would include 'IP' (0x0800), 'ARP' (0x0806) and 'IPX' (0x8137). Setting the pana802FilterEtherTypeMin object to -1 indicates that EtherType data should not be considered during traffic classification. Note that the position of the EtherType field depends on the underlying frame format. For Ethernet-II encapsulation, the EtherType field follows the 802 MAC source address. For 802.2 LLC/SNAP encapsulation, the EtherType value follows the Organization Code field in the 802.2 SNAP header. The value that is tested with regard to this filter component therefore depends on the data link layer frame format being used. If this 802 filter component is active when there is no EtherType field in a frame (e.g., 802.2 LLC), a match is implied.
BIT pana802FilterUserPriority	1.3.6.1.2.1.186.1.1.1.8	Bits	read-create	The set of values, representing the potential range of user priority values, against which the value contained in the user priority field of a tagged 802.1 frame is compared. A test for equality is performed when determining if a match exists between the data in a data link layer frame and the value of this 802 filter component. Multiple values may be set at one time such that potentially several different user priority values may match this 802 filter component. Setting all of the bits that are associated with this object causes all user priority values to match this attribute. This essentially makes any comparisons with regard to user priority values unnecessary. Untagged frames are treated as an implicit match.
TIM pana802FiltLastChanged	1.3.6.1.2.1.186.1.1.1.9	TimeStamp	read-only	The value of sysUpTime when this row was last modified or created either through SNMP SETs or by some other external means.
STO pana802FiltStorageType	1.3.6.1.2.1.186.1.1.1.10	StorageType	read-create	The storage type for this row. Rows in this table which were created through an external process may have a storage type of readOnly or permanent.
ROW pana802FiltRowStatus	1.3.6.1.2.1.186.1.1.1.11	RowStatus	read-create	This object indicates the conceptual status of this row. This object may not be set to active if the requirements of the pana802FilterType object are not met. In other words, if the associated value columns needed by a particular test have not been set, then attempting to change this row to an active state will result in an inconsistentValue error. See the pana802FilterType object description for further details.
panaNotificationObjects	1.3.6.1.2.1.186.2
panaNotifications	1.3.6.1.2.1.186.2.0
NTF panaNewPacNotification	1.3.6.1.2.1.186.2.0.1			Notification that AP detected traffic coming from an unauthorized source. The objects sent must include the ipspActionExecuted which will indicate which action was executed within the scope of the rule. Additionally, the ipspIPSourceType, ipspIPSourceAddress, ipspIPDestinationType, and ipspIPDestinationAddress, objects must be included to indicate the packet source and destination of the packet that triggered the action. The ipspIPInterfaceType, ipspIPInterfaceAddress, and ipspPacketDirection objects are included to indicate which endpoint the packet was associated with.
panaConformanceObjects	1.3.6.1.2.1.186.3

RFC description

Defines PANA-specific IPSec security policy database objects for network authentication and encryption.

Start monitoring network access routers/enforcement points with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download PANA-MIB

What Is PANA-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description