RADIUS-AUTH-CLIENT-MIB

All MIBs › RADIUS-AUTH-CLIENT-MIB

Organization: IETF RADIUS Extensions Working Group.

Last Updated: 2006-08-21

Category: RADIUS and AAA

Description: Monitors RADIUS authentication client (NAS) operations, tracking outgoing Access-Requests and incoming responses per configured server.

IPNetwork Monitor uses several OIDs from this MIB in network discovery and polling the applicable devices. Start monitoring RADIUS-AUTH-CLIENT-MIB with a free 30-day trial of IPNetwork Monitor.

What Is RADIUS-AUTH-CLIENT-MIB?

RADIUS-AUTH-CLIENT-MIB, standardized in RFC 4668, is a vendor-neutral MIB for entities implementing the client side (NAS) of the RADIUS authentication protocol, tracking outgoing Access-Request messages and incoming responses per configured RADIUS server. It exposes a per-server table of round-trip time, retransmission counts, accept/reject counts, and invalid-server-address tracking, giving a detailed operational view of authentication traffic health. Its monitoring value is centered on software/protocol-level status—detecting slow or unresponsive RADIUS servers via radiusAuthClientRoundTripTime, spotting authentication failures via rising radiusAuthClientAccessRejects, and identifying network/config issues via radiusAuthClientAccessRetransmissions or radiusAuthClientInvalidServerAddresses—rather than physical hardware sensors. It is part of the IETF RADIUS MIB family and commonly deployed alongside RADIUS-AUTH-SERVER-MIB and RADIUS accounting MIBs on the same NAS device. It is deployed on any vendor-neutral, standards-based network access server (NAS), VPN gateway, or wireless controller performing RADIUS authentication. The RADIUS-AUTH-CLIENT-MIB RFC (4668) itself obsoleted the earlier RFC 2618 definition, so implementations should be checked against the newer specification for correct object naming and semantics.

IPNetwork Monitor allows you to monitor SNMP objects defined in RADIUS-AUTH-CLIENT-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

vendor-neutral, standards-based MIB, not tied to a specific manufacturer
network access server (NAS), VPN gateway, or wireless controller

Monitoring Examples

An admin would poll radiusAuthServerTable's radiusAuthClientRoundTripTime for each radiusAuthServerIndex/radiusAuthServerAddress to detect a RADIUS server responding slowly or not at all, and watch radiusAuthClientAccessRetransmissions rising as a sign of packet loss or an unresponsive server. A spike in radiusAuthClientAccessRejects relative to radiusAuthClientAccessAccepts would indicate a wave of authentication failures, while radiusAuthClientInvalidServerAddresses climbing would reveal spoofed or misconfigured response packets arriving from unexpected sources.

What Can Be Monitored

RADIUS server round-trip time
access-request retransmissions
access-accept count
access-reject count
invalid server address count
configured RADIUS server port

Imported Objects

From INET-ADDRESS-MIB

InetAddress
InetAddressType
InetPortNumber

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Gauge32
Integer32
IpAddress
MODULE-IDENTITY
OBJECT-IDENTITY
OBJECT-TYPE
TimeTicks
mib-2

How to Use in IPNetwork Monitor

Example using radiusAuthClientCounterDiscontinuity OID:

Select a device implementing RADIUS-AUTH-CLIENT-MIB as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type radiusAuthClientCounterDiscontinuity into the Find box to locate it in the OID tree, then select it and click OK. It reports how long, in centiseconds, since the RADIUS Client's counters last had a discontinuity (typically caused by a reinitialization). On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a TimeTicks-type OID, Value bounds is the most useful condition here — trigger an alert if the value is unexpectedly low, since that indicates the RADIUS authentication counters were recently reset — often the result of an unplanned restart. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
radiusAuthClient	1.3.6.1.2.1.67.1.2.1.1
C32 radiusAuthClientAccessAccepts	1.3.6.1.2.1.67.1.2.1.1.3.1.7	Counter32	read-only	The number of RADIUS Access-Accept packets (valid or invalid) received from this server.
C32 radiusAuthClientAccessChallenges	1.3.6.1.2.1.67.1.2.1.1.3.1.9	Counter32	read-only	The number of RADIUS Access-Challenge packets (valid or invalid) received from this server.
C32 radiusAuthClientAccessRejects	1.3.6.1.2.1.67.1.2.1.1.3.1.8	Counter32	read-only	The number of RADIUS Access-Reject packets (valid or invalid) received from this server.
C32 radiusAuthClientAccessRequests	1.3.6.1.2.1.67.1.2.1.1.3.1.5	Counter32	read-only	The number of RADIUS Access-Request packets sent to this server. This does not include retransmissions.
C32 radiusAuthClientAccessRetransmissions	1.3.6.1.2.1.67.1.2.1.1.3.1.6	Counter32	read-only	The number of RADIUS Access-Request packets retransmitted to this RADIUS authentication server.
C32 radiusAuthClientBadAuthenticators	1.3.6.1.2.1.67.1.2.1.1.3.1.11	Counter32	read-only	The number of RADIUS Access-Response packets containing invalid authenticators or Message Authenticator attributes received from this server.
TIK radiusAuthClientCounterDiscontinuityEx	1.3.6.1.2.1.67.1.2.1.1.4.1.17	TimeTicks	read-only	The number of centiseconds since the last discontinuity in the RADIUS Client counters. A discontinuity may be the result of a reinitialization of the RADIUS Client module within the managed entity.
C32 radiusAuthClientExtAccessAccepts	1.3.6.1.2.1.67.1.2.1.1.4.1.8	Counter32	read-only	The number of RADIUS Access-Accept packets (valid or invalid) received from this server. This counter may experience a discontinuity when the RADIUS Client module within the managed entity is reinitialized, as indicated by the current value of radiusAuthClientCounterDiscontinuity.
C32 radiusAuthClientExtAccessChallenges	1.3.6.1.2.1.67.1.2.1.1.4.1.10	Counter32	read-only	The number of RADIUS Access-Challenge packets (valid or invalid) received from this server. This counter may experience a discontinuity when the RADIUS Client module within the managed entity is reinitialized, as indicated by the current value of radiusAuthClientCounterDiscontinuity.
C32 radiusAuthClientExtAccessRejects	1.3.6.1.2.1.67.1.2.1.1.4.1.9	Counter32	read-only	The number of RADIUS Access-Reject packets (valid or invalid) received from this server. This counter may experience a discontinuity when the RADIUS Client module within the managed entity is reinitialized, as indicated by the current value of radiusAuthClientCounterDiscontinuity.
C32 radiusAuthClientExtAccessRequests	1.3.6.1.2.1.67.1.2.1.1.4.1.6	Counter32	read-only	The number of RADIUS Access-Request packets sent to this server. This does not include retransmissions. This counter may experience a discontinuity when the RADIUS Client module within the managed entity is reinitialized, as indicated by the current value of radiusAuthClientCounterDiscontinuity.
C32 radiusAuthClientExtAccessRetransmissions	1.3.6.1.2.1.67.1.2.1.1.4.1.7	Counter32	read-only	The number of RADIUS Access-Request packets retransmitted to this RADIUS authentication server. This counter may experience a discontinuity when the RADIUS Client module within the managed entity is reinitialized, as indicated by the current value of radiusAuthClientCounterDiscontinuity.
C32 radiusAuthClientExtBadAuthenticators	1.3.6.1.2.1.67.1.2.1.1.4.1.12	Counter32	read-only	The number of RADIUS Access-Response packets containing invalid authenticators or Message Authenticator attributes received from this server. This counter may experience a discontinuity when the RADIUS Client module within the managed entity is reinitialized, as indicated by the current value of radiusAuthClientCounterDiscontinuity.
C32 radiusAuthClientExtMalformedAccessResponses	1.3.6.1.2.1.67.1.2.1.1.4.1.11	Counter32	read-only	The number of malformed RADIUS Access-Response packets received from this server. Malformed packets include packets with an invalid length. Bad authenticators or Message Authenticator attributes or unknown types are not included as malformed access responses. This counter may experience a discontinuity when the RADIUS Client module within the managed entity is reinitialized, as indicated by the current value of radiusAuthClientCounterDiscontinuity.
radiusAuthClientExtMIBCompliance	1.3.6.1.2.1.67.1.2.2.1.2			The compliance statement for authentication clients implementing the RADIUS Authentication Client IPv6 Extensions MIB. Implementation of this module is for entities that support IPv6, or support IPv4 and IPv6.
radiusAuthClientExtMIBGroup	1.3.6.1.2.1.67.1.2.2.2.2			The collection of extended objects providing management of RADIUS Authentication Clients using version-neutral IP address format.
C32 radiusAuthClientExtPacketsDropped	1.3.6.1.2.1.67.1.2.1.1.4.1.16	Counter32	read-only	The number of RADIUS packets that were received from this server on the authentication port and dropped for some other reason. This counter may experience a discontinuity when the RADIUS Client module within the managed entity is reinitialized, as indicated by the current value of radiusAuthClientCounterDiscontinuity.
G32 radiusAuthClientExtPendingRequests	1.3.6.1.2.1.67.1.2.1.1.4.1.13	Gauge32	read-only	The number of RADIUS Access-Request packets destined for this server that have not yet timed out or received a response. This variable is incremented when an Access-Request is sent and decremented due to receipt of an Access-Accept, Access-Reject, Access-Challenge, timeout, or retransmission.
TIK radiusAuthClientExtRoundTripTime	1.3.6.1.2.1.67.1.2.1.1.4.1.5	TimeTicks	read-only	The time interval (in hundredths of a second) between the most recent Access-Reply/Access-Challenge and the Access-Request that matched it from this RADIUS authentication server.
C32 radiusAuthClientExtTimeouts	1.3.6.1.2.1.67.1.2.1.1.4.1.14	Counter32	read-only	The number of authentication timeouts to this server. After a timeout, the client may retry to the same server, send to a different server, or give up. A retry to the same server is counted as a retransmit as well as a timeout. A send to a different server is counted as a Request as well as a timeout. This counter may experience a discontinuity when the RADIUS Client module within the managed entity is reinitialized, as indicated by the current value of radiusAuthClientCounterDiscontinuity.
C32 radiusAuthClientExtUnknownTypes	1.3.6.1.2.1.67.1.2.1.1.4.1.15	Counter32	read-only	The number of RADIUS packets of unknown type that were received from this server on the authentication port. This counter may experience a discontinuity when the RADIUS Client module within the managed entity is reinitialized, as indicated by the current value of radiusAuthClientCounterDiscontinuity.
STR radiusAuthClientIdentifier	1.3.6.1.2.1.67.1.2.1.1.2	SnmpAdminString	read-only	The NAS-Identifier of the RADIUS authentication client. This is not necessarily the same as sysName in MIB II.
C32 radiusAuthClientInvalidServerAddresses	1.3.6.1.2.1.67.1.2.1.1.1	Counter32	read-only	The number of RADIUS Access-Response packets received from unknown addresses.
C32 radiusAuthClientMalformedAccessResponses	1.3.6.1.2.1.67.1.2.1.1.3.1.10	Counter32	read-only	The number of malformed RADIUS Access-Response packets received from this server. Malformed packets include packets with an invalid length. Bad authenticators or Message Authenticator attributes or unknown types are not included as malformed access responses.
radiusAuthClientMIB	1.3.6.1.2.1.67.1.2			The MIB module for entities implementing the client side of the Remote Authentication Dial-In User Service (RADIUS) authentication protocol. Copyright (C) The Internet Society (2006). This version of this MIB module is part of RFC 4668; see the RFC itself for full legal notices.
radiusAuthClientMIBCompliance	1.3.6.1.2.1.67.1.2.2.1.1			The compliance statement for authentication clients implementing the RADIUS Authentication Client MIB. Implementation of this module is for IPv4-only entities, or for backwards compatibility use with entities that support both IPv4 and IPv6.
radiusAuthClientMIBCompliances	1.3.6.1.2.1.67.1.2.2.1
radiusAuthClientMIBConformance	1.3.6.1.2.1.67.1.2.2
radiusAuthClientMIBGroup	1.3.6.1.2.1.67.1.2.2.2.1			The basic collection of objects providing management of RADIUS Authentication Clients.
radiusAuthClientMIBGroups	1.3.6.1.2.1.67.1.2.2.2
radiusAuthClientMIBObjects	1.3.6.1.2.1.67.1.2.1
C32 radiusAuthClientPacketsDropped	1.3.6.1.2.1.67.1.2.1.1.3.1.15	Counter32	read-only	The number of RADIUS packets that were received from this server on the authentication port and dropped for some other reason.
G32 radiusAuthClientPendingRequests	1.3.6.1.2.1.67.1.2.1.1.3.1.12	Gauge32	read-only	The number of RADIUS Access-Request packets destined for this server that have not yet timed out or received a response. This variable is incremented when an Access-Request is sent and decremented due to receipt of an Access-Accept, Access-Reject, Access-Challenge, timeout, or retransmission.
TIK radiusAuthClientRoundTripTime	1.3.6.1.2.1.67.1.2.1.1.3.1.4	TimeTicks	read-only	The time interval (in hundredths of a second) between the most recent Access-Reply/Access-Challenge and the Access-Request that matched it from this RADIUS authentication server.
INE radiusAuthClientServerInetPortNumber	1.3.6.1.2.1.67.1.2.1.1.4.1.4	InetPortNumber	read-only	The UDP port the client is using to send requests to this server. The value of zero (0) is invalid.
I32 radiusAuthClientServerPortNumber	1.3.6.1.2.1.67.1.2.1.1.3.1.3	Integer32	read-only	The UDP port the client is using to send requests to this server.
C32 radiusAuthClientTimeouts	1.3.6.1.2.1.67.1.2.1.1.3.1.13	Counter32	read-only	The number of authentication timeouts to this server. After a timeout, the client may retry to the same server, send to a different server, or give up. A retry to the same server is counted as a retransmit as well as a timeout. A send to a different server is counted as a Request as well as a timeout.
C32 radiusAuthClientUnknownTypes	1.3.6.1.2.1.67.1.2.1.1.3.1.14	Counter32	read-only	The number of RADIUS packets of unknown type that were received from this server on the authentication port.
radiusAuthentication	1.3.6.1.2.1.67.1
IP radiusAuthServerAddress	1.3.6.1.2.1.67.1.2.1.1.3.1.2	IpAddress	read-only	The IP address of the RADIUS authentication server referred to in this table entry.
radiusAuthServerEntry	1.3.6.1.2.1.67.1.2.1.1.3.1		not-accessible	An entry (conceptual row) representing a RADIUS authentication server with which the client shares a secret.
radiusAuthServerExtEntry	1.3.6.1.2.1.67.1.2.1.1.4.1		not-accessible	An entry (conceptual row) representing a RADIUS authentication server with which the client shares a secret.
I32 radiusAuthServerExtIndex	1.3.6.1.2.1.67.1.2.1.1.4.1.1	Integer32	not-accessible	A number uniquely identifying each RADIUS Authentication server with which this client communicates.
radiusAuthServerExtTable	1.3.6.1.2.1.67.1.2.1.1.4		not-accessible	The (conceptual) table listing the RADIUS authentication servers with which the client shares a secret.
I32 radiusAuthServerIndex	1.3.6.1.2.1.67.1.2.1.1.3.1.1	Integer32	not-accessible	A number uniquely identifying each RADIUS Authentication server with which this client communicates.
IP radiusAuthServerInetAddress	1.3.6.1.2.1.67.1.2.1.1.4.1.3	InetAddress	read-only	The IP address of the RADIUS authentication server referred to in this table entry, using the version-neutral IP address format.
IPt radiusAuthServerInetAddressType	1.3.6.1.2.1.67.1.2.1.1.4.1.2	InetAddressType	read-only	The type of address format used for the radiusAuthServerInetAddress object.
radiusAuthServerTable	1.3.6.1.2.1.67.1.2.1.1.3		not-accessible	The (conceptual) table listing the RADIUS authentication servers with which the client shares a secret.
radiusMIB	1.3.6.1.2.1.67			The OID assigned to RADIUS MIB work by the IANA.

RFC description

Manages RADIUS authentication clients per RFC 2618, providing monitoring of RADIUS server statistics and authentication client operations.

Start monitoring vendor-neutral, standards-based MIB, network access server/VPN gateway/wireless controller (RADIUS auth client, RFC 4668) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download RADIUS-AUTH-CLIENT-MIB