RADIUS-AUTH-SERVER-MIB

All MIBs › RADIUS-AUTH-SERVER-MIB

Organization: IETF RADIUS Extensions Working Group.

Last Updated: 2006-08-21

Category: RADIUS and AAA

Description: Monitors RADIUS authentication server operations, tracking Access-Request, Access-Accept, Access-Reject, and Access-Challenge statistics.

IPNetwork Monitor uses several OIDs from this MIB in network discovery and polling the applicable devices. Start monitoring RADIUS-AUTH-SERVER-MIB with a free 30-day trial of IPNetwork Monitor.

What Is RADIUS-AUTH-SERVER-MIB?

RADIUS-AUTH-SERVER-MIB is an IETF standards-track MIB, published as RFC 4669, for devices implementing the server side of the RADIUS authentication protocol. It exposes server identification and uptime objects alongside detailed protocol statistics counting Access-Request, Access-Accept, Access-Reject, Access-Challenge, duplicate, invalid, malformed, and bad-authenticator messages. Its role in monitoring is primarily software/service health: radiusAuthServUpTime and radiusAuthServResetTime indicate how long the RADIUS service has been running and when it was last reset, while the request/accept/reject counters reveal whether authentication traffic is being processed correctly or is experiencing errors such as malformed requests or authentication mismatches. It is a companion to the RADIUS authentication protocol standard itself and is commonly paired with the corresponding RADIUS accounting/client-side MIBs in a full deployment. It is typically deployed on dedicated RADIUS authentication servers or network devices with embedded RADIUS server functionality used for centralized network access authentication, consistent with the RADIUS-AUTH-SERVER-MIB RFC that defines it.

IPNetwork Monitor allows you to monitor SNMP objects defined in RADIUS-AUTH-SERVER-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

vendor-neutral, standards-based MIB, not tied to a specific manufacturer; applies to any RADIUS authentication server or network device with embedded RADIUS server functionality

Monitoring Examples

An administrator would poll radiusAuthServTotalAccessRequests against radiusAuthServTotalAccessAccepts and radiusAuthServTotalAccessRejects to gauge overall authentication success rate, and watch radiusAuthServTotalMalformedAccessRequests or radiusAuthServTotalBadAuthenticators rise as a sign of a misconfigured client or a shared-secret mismatch. radiusAuthServUpTime combined with radiusAuthServResetTime would confirm whether the RADIUS service has recently restarted unexpectedly.

What Can Be Monitored

RADIUS server uptime
last reset time
total access requests
access accepts vs rejects
malformed/duplicate/invalid request counts
bad authenticator counts

Imported Objects

From INET-ADDRESS-MIB

InetAddress
InetAddressType

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Integer32
IpAddress
MODULE-IDENTITY
OBJECT-IDENTITY
OBJECT-TYPE
TimeTicks
mib-2

How to Use in IPNetwork Monitor

Example using radiusAuthServTotalAccessRequests OID:

Select a device implementing RADIUS-AUTH-SERVER-MIB as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type radiusAuthServTotalAccessRequests into the Find box to locate it in the OID tree, then select it and click OK. The number of packets received on the authentication port. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline (in packets), since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
radiusMIB	1.3.6.1.2.1.67			The OID assigned to RADIUS MIB work by the IANA.
radiusAuthentication	1.3.6.1.2.1.67.1
radiusAuthServMIB	1.3.6.1.2.1.67.1.1			The MIB module for entities implementing the server side of the Remote Authentication Dial-In User Service (RADIUS) authentication protocol. Copyright (C) The Internet Society (2006). This version of this MIB module is part of RFC 4669; see the RFC itself for full legal notices.
radiusAuthServMIBObjects	1.3.6.1.2.1.67.1.1.1
radiusAuthServ	1.3.6.1.2.1.67.1.1.1.1
STR radiusAuthServIdent	1.3.6.1.2.1.67.1.1.1.1.1	SnmpAdminString	read-only	The implementation identification string for the RADIUS authentication server software in use on the system, for example, 'FNS-2.1'.
TIK radiusAuthServUpTime	1.3.6.1.2.1.67.1.1.1.1.2	TimeTicks	read-only	If the server has a persistent state (e.g., a process), this value will be the time elapsed (in hundredths of a second) since the server process was started. For software without persistent state, this value will be zero.
TIK radiusAuthServResetTime	1.3.6.1.2.1.67.1.1.1.1.3	TimeTicks	read-only	If the server has a persistent state (e.g., a process) and supports a 'reset' operation (e.g., can be told to re-read configuration files), this value will be the time elapsed (in hundredths of a second) since the server was 'reset.' For software that does not have persistence or does not support a 'reset' operation, this value will be zero.
INT radiusAuthServConfigReset	1.3.6.1.2.1.67.1.1.1.1.4	INTEGER	read-write	Status/action object to reinitialize any persistent server state. When set to reset(2), any persistent server state (such as a process) is reinitialized as if the server had just been started. This value will never be returned by a read operation. When read, one of the following values will be returned: other(1) - server in some unknown state; initializing(3) - server (re)initializing; running(4) - server currently running.
C32 radiusAuthServTotalAccessRequestsEx	1.3.6.1.2.1.67.1.1.1.1.5	Counter32	read-only	The number of packets received on the authentication port.
C32 radiusAuthServTotalInvalidRequests	1.3.6.1.2.1.67.1.1.1.1.6	Counter32	read-only	The number of RADIUS Access-Request packets received from unknown addresses.
C32 radiusAuthServTotalDupAccessRequests	1.3.6.1.2.1.67.1.1.1.1.7	Counter32	read-only	The number of duplicate RADIUS Access-Request packets received.
C32 radiusAuthServTotalAccessAccepts	1.3.6.1.2.1.67.1.1.1.1.8	Counter32	read-only	The number of RADIUS Access-Accept packets sent.
C32 radiusAuthServTotalAccessRejects	1.3.6.1.2.1.67.1.1.1.1.9	Counter32	read-only	The number of RADIUS Access-Reject packets sent.
C32 radiusAuthServTotalAccessChallenges	1.3.6.1.2.1.67.1.1.1.1.10	Counter32	read-only	The number of RADIUS Access-Challenge packets sent.
C32 radiusAuthServTotalMalformedAccessRequests	1.3.6.1.2.1.67.1.1.1.1.11	Counter32	read-only	The number of malformed RADIUS Access-Request packets received. Bad authenticators and unknown types are not included as malformed Access-Requests.
C32 radiusAuthServTotalBadAuthenticators	1.3.6.1.2.1.67.1.1.1.1.12	Counter32	read-only	The number of RADIUS Authentication-Request packets that contained invalid Message Authenticator attributes received.
C32 radiusAuthServTotalPacketsDropped	1.3.6.1.2.1.67.1.1.1.1.13	Counter32	read-only	The number of incoming packets silently discarded for some reason other than malformed, bad authenticators or unknown types.
C32 radiusAuthServTotalUnknownTypes	1.3.6.1.2.1.67.1.1.1.1.14	Counter32	read-only	The number of RADIUS packets of unknown type that were received.
radiusAuthClientTable	1.3.6.1.2.1.67.1.1.1.1.15		not-accessible	The (conceptual) table listing the RADIUS authentication clients with which the server shares a secret.
radiusAuthClientEntry	1.3.6.1.2.1.67.1.1.1.1.15.1		not-accessible	An entry (conceptual row) representing a RADIUS authentication client with which the server shares a secret.
I32 radiusAuthClientIndex	1.3.6.1.2.1.67.1.1.1.1.15.1.1	Integer32	not-accessible	A number uniquely identifying each RADIUS authentication client with which this server communicates.
IP radiusAuthClientAddress	1.3.6.1.2.1.67.1.1.1.1.15.1.2	IpAddress	read-only	The NAS-IP-Address of the RADIUS authentication client referred to in this table entry.
STR radiusAuthClientID	1.3.6.1.2.1.67.1.1.1.1.15.1.3	SnmpAdminString	read-only	The NAS-Identifier of the RADIUS authentication client referred to in this table entry. This is not necessarily the same as sysName in MIB II.
C32 radiusAuthServAccessRequests	1.3.6.1.2.1.67.1.1.1.1.15.1.4	Counter32	read-only	The number of packets received on the authentication port from this client.
C32 radiusAuthServDupAccessRequests	1.3.6.1.2.1.67.1.1.1.1.15.1.5	Counter32	read-only	The number of duplicate RADIUS Access-Request packets received from this client.
C32 radiusAuthServAccessAccepts	1.3.6.1.2.1.67.1.1.1.1.15.1.6	Counter32	read-only	The number of RADIUS Access-Accept packets sent to this client.
C32 radiusAuthServAccessRejects	1.3.6.1.2.1.67.1.1.1.1.15.1.7	Counter32	read-only	The number of RADIUS Access-Reject packets sent to this client.
C32 radiusAuthServAccessChallenges	1.3.6.1.2.1.67.1.1.1.1.15.1.8	Counter32	read-only	The number of RADIUS Access-Challenge packets sent to this client.
C32 radiusAuthServMalformedAccessRequests	1.3.6.1.2.1.67.1.1.1.1.15.1.9	Counter32	read-only	The number of malformed RADIUS Access-Request packets received from this client. Bad authenticators and unknown types are not included as malformed Access-Requests.
C32 radiusAuthServBadAuthenticators	1.3.6.1.2.1.67.1.1.1.1.15.1.10	Counter32	read-only	The number of RADIUS Authentication-Request packets that contained invalid Message Authenticator attributes received from this client.
C32 radiusAuthServPacketsDropped	1.3.6.1.2.1.67.1.1.1.1.15.1.11	Counter32	read-only	The number of incoming packets from this client silently discarded for some reason other than malformed, bad authenticators or unknown types.
C32 radiusAuthServUnknownTypes	1.3.6.1.2.1.67.1.1.1.1.15.1.12	Counter32	read-only	The number of RADIUS packets of unknown type that were received from this client.
radiusAuthClientExtTable	1.3.6.1.2.1.67.1.1.1.1.16		not-accessible	The (conceptual) table listing the RADIUS authentication clients with which the server shares a secret.
radiusAuthClientExtEntry	1.3.6.1.2.1.67.1.1.1.1.16.1		not-accessible	An entry (conceptual row) representing a RADIUS authentication client with which the server shares a secret.
I32 radiusAuthClientExtIndex	1.3.6.1.2.1.67.1.1.1.1.16.1.1	Integer32	not-accessible	A number uniquely identifying each RADIUS authentication client with which this server communicates.
IPt radiusAuthClientInetAddressType	1.3.6.1.2.1.67.1.1.1.1.16.1.2	InetAddressType	read-only	The type of address format used for the radiusAuthClientInetAddress object.
IP radiusAuthClientInetAddress	1.3.6.1.2.1.67.1.1.1.1.16.1.3	InetAddress	read-only	The IP address of the RADIUS authentication client referred to in this table entry, using the version-neutral IP address format.
STR radiusAuthClientExtID	1.3.6.1.2.1.67.1.1.1.1.16.1.4	SnmpAdminString	read-only	The NAS-Identifier of the RADIUS authentication client referred to in this table entry. This is not necessarily the same as sysName in MIB II.
C32 radiusAuthServExtAccessRequests	1.3.6.1.2.1.67.1.1.1.1.16.1.5	Counter32	read-only	The number of packets received on the authentication port from this client. This counter may experience a discontinuity when the RADIUS Server module within the managed entity is reinitialized, as indicated by the current value of radiusAuthServCounterDiscontinuity.
C32 radiusAuthServExtDupAccessRequests	1.3.6.1.2.1.67.1.1.1.1.16.1.6	Counter32	read-only	The number of duplicate RADIUS Access-Request packets received from this client. This counter may experience a discontinuity when the RADIUS Server module within the managed entity is reinitialized, as indicated by the current value of radiusAuthServCounterDiscontinuity.
C32 radiusAuthServExtAccessAccepts	1.3.6.1.2.1.67.1.1.1.1.16.1.7	Counter32	read-only	The number of RADIUS Access-Accept packets sent to this client. This counter may experience a discontinuity when the RADIUS Server module within the managed entity is reinitialized, as indicated by the current value of radiusAuthServCounterDiscontinuity.
C32 radiusAuthServExtAccessRejects	1.3.6.1.2.1.67.1.1.1.1.16.1.8	Counter32	read-only	The number of RADIUS Access-Reject packets sent to this client. This counter may experience a discontinuity when the RADIUS Server module within the managed entity is reinitialized, as indicated by the current value of radiusAuthServCounterDiscontinuity.
C32 radiusAuthServExtAccessChallenges	1.3.6.1.2.1.67.1.1.1.1.16.1.9	Counter32	read-only	The number of RADIUS Access-Challenge packets sent to this client. This counter may experience a discontinuity when the RADIUS Server module within the managed entity is reinitialized, as indicated by the current value of radiusAuthServCounterDiscontinuity.
C32 radiusAuthServExtMalformedAccessRequests	1.3.6.1.2.1.67.1.1.1.1.16.1.10	Counter32	read-only	The number of malformed RADIUS Access-Request packets received from this client. Bad authenticators and unknown types are not included as malformed Access-Requests. This counter may experience a discontinuity when the RADIUS Server module within the managed entity is reinitialized, as indicated by the current value of radiusAuthServCounterDiscontinuity.
C32 radiusAuthServExtBadAuthenticators	1.3.6.1.2.1.67.1.1.1.1.16.1.11	Counter32	read-only	The number of RADIUS Authentication-Request packets that contained invalid Message Authenticator attributes received from this client. This counter may experience a discontinuity when the RADIUS Server module within the managed entity is reinitialized, as indicated by the current value of radiusAuthServCounterDiscontinuity.
C32 radiusAuthServExtPacketsDropped	1.3.6.1.2.1.67.1.1.1.1.16.1.12	Counter32	read-only	The number of incoming packets from this client silently discarded for some reason other than malformed, bad authenticators or unknown types. This counter may experience a discontinuity when the RADIUS Server module within the managed entity is reinitialized, as indicated by the current value of radiusAuthServCounterDiscontinuity.
C32 radiusAuthServExtUnknownTypes	1.3.6.1.2.1.67.1.1.1.1.16.1.13	Counter32	read-only	The number of RADIUS packets of unknown type that were received from this client. This counter may experience a discontinuity when the RADIUS Server module within the managed entity is reinitialized, as indicated by the current value of radiusAuthServCounterDiscontinuity.
TIK radiusAuthServCounterDiscontinuity	1.3.6.1.2.1.67.1.1.1.1.16.1.14	TimeTicks	read-only	The number of centiseconds since the last discontinuity in the RADIUS Server counters. A discontinuity may be the result of a reinitialization of the RADIUS Server module within the managed entity.
radiusAuthServMIBConformance	1.3.6.1.2.1.67.1.1.2
radiusAuthServMIBCompliances	1.3.6.1.2.1.67.1.1.2.1
radiusAuthServMIBCompliance	1.3.6.1.2.1.67.1.1.2.1.1			The compliance statement for authentication servers implementing the RADIUS Authentication Server MIB. Implementation of this module is for IPv4-only entities, or for backwards compatibility use with entities that support both IPv4 and IPv6.
radiusAuthServMIBExtCompliance	1.3.6.1.2.1.67.1.1.2.1.2			The compliance statement for authentication servers implementing the RADIUS Authentication Server IPv6 Extensions MIB. Implementation of this module is for entities that support IPv6, or support IPv4 and IPv6.
radiusAuthServMIBGroups	1.3.6.1.2.1.67.1.1.2.2
radiusAuthServMIBGroup	1.3.6.1.2.1.67.1.1.2.2.1			The collection of objects providing management of a RADIUS Authentication Server.
radiusAuthServExtMIBGroup	1.3.6.1.2.1.67.1.1.2.2.2			The collection of objects providing management of a RADIUS Authentication Server.

RFC description

Server-side RADIUS authentication protocol MIB for remote dial-in user service.

Start monitoring vendor-neutral, standards-based MIB, RADIUS authentication server or embedded RADIUS server device (RFC 4669) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download RADIUS-AUTH-SERVER-MIB