RADIUS-DYNAUTH-SERVER-MIB

All MIBs › RADIUS-DYNAUTH-SERVER-MIB

Organization: IETF RADEXT Working Group

Last Updated: 2006-08-29

Category: RADIUS and AAA

Description: Defines managed objects for monitoring RADIUS Dynamic Authorization Servers, tracking Disconnect and CoA request processing statistics.

IPNetwork Monitor uses several OIDs from this MIB in network discovery and polling the applicable devices. Start monitoring RADIUS-DYNAUTH-SERVER-MIB with a free 30-day trial of IPNetwork Monitor.

What Is RADIUS-DYNAUTH-SERVER-MIB?

RADIUS-DYNAUTH-SERVER-MIB is an IETF standards-based MIB (RFC 4673) for monitoring the server side of RADIUS Dynamic Authorization Extensions, tracking how a RADIUS/AAA policy server issues Disconnect-Request and Change-of-Authorization (CoA) messages to network access clients. It belongs to the network access/AAA protocol area and exposes per-client and aggregate statistics on Disconnect and CoA request processing, acknowledgments, and duplicate/error conditions. Its monitoring relevance is protocol/software health: counters for invalid client addresses, duplicate Disconnect requests, and Disconnect acknowledgments reveal whether dynamic session-control commands issued by the AAA server are being correctly delivered to and acted upon by network access clients such as switches or wireless controllers. It is explicitly an extension to the base RADIUS dynamic-authorization framework standardized alongside RFC 3576/5176. It is typically deployed on centralized RADIUS/AAA policy servers that issue forced disconnects or authorization changes to network access devices, consistent with the RADIUS-DYNAUTH-SERVER-MIB RFC (RFC 4673) it implements.

IPNetwork Monitor allows you to monitor SNMP objects defined in RADIUS-DYNAUTH-SERVER-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

RADIUS/AAA policy server
vendor-neutral IETF standards-based MIB, not tied to a specific manufacturer

Monitoring Examples

An administrator would poll radiusDynAuthServerDisconInvalidClientAddresses and radiusDynAuthServerCoAInvalidClientAddresses to detect Disconnect/CoA responses referencing unrecognized client devices, radiusDynAuthClientTable/radiusDynAuthClientEntry (keyed by radiusDynAuthClientIndex with radiusDynAuthClientAddressType/radiusDynAuthClientAddress) to confirm which NAS clients are registered, and radiusDynAuthServerIdentifier to identify the issuing server instance. Rising radiusDynAuthServDupDisconRequests alongside a low radiusDynAuthServDisconAcks count relative to radiusDynAuthServDisconRequests would indicate a client device is not acknowledging disconnect commands, meaning forced session terminations are silently failing.

What Can Be Monitored

invalid client address counts (Disconnect/CoA)
registered NAS client address table
Disconnect request and acknowledgment counts
duplicate Disconnect request count
server identifier

Imported Objects

From INET-ADDRESS-MIB

InetAddress
InetAddressType

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Integer32
MODULE-IDENTITY
OBJECT-TYPE
TimeTicks
mib-2

How to Use in IPNetwork Monitor

Example using radiusDynAuthServerDisconInvalidClientAddresses OID:

Select an RADIUS/AAA policy server (dynamic authorization server, RFC 4673) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type radiusDynAuthServerDisconInvalidClientAddresses into the Find box to locate it in the OID tree, then select it and click OK. The number of Disconnect-Request packets received from unknown addresses. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline, since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
radiusAuthServerMIBCompliance	1.3.6.1.2.1.146.2.1.1			The compliance statement for entities implementing the RADIUS Dynamic Authorization Server. Implementation of this module is for entities that support IPv4 and/or IPv6.
IP radiusDynAuthClientAddress	1.3.6.1.2.1.146.1.2.1.3	InetAddress	read-only	The IP address value of the RADIUS Dynamic Authorization Client referred to in this table entry, using the version neutral IP address format. The type of this address is determined by the value of the radiusDynAuthClientAddressType object.
IPt radiusDynAuthClientAddressType	1.3.6.1.2.1.146.1.2.1.2	InetAddressType	read-only	The type of IP address of the RADIUS Dynamic Authorization Client referred to in this table entry.
radiusDynAuthClientEntry	1.3.6.1.2.1.146.1.2.1		not-accessible	An entry (conceptual row) representing one Dynamic Authorization Client with which the server shares a secret.
I32 radiusDynAuthClientIndex	1.3.6.1.2.1.146.1.2.1.1	Integer32	not-accessible	A number uniquely identifying each RADIUS Dynamic Authorization Client with which this Dynamic Authorization Server communicates. This number is allocated by the agent implementing this MIB module and is unique in this context.
radiusDynAuthClientTable	1.3.6.1.2.1.146.1.2		not-accessible	The (conceptual) table listing the RADIUS Dynamic Authorization Clients with which the server shares a secret.
C32 radiusDynAuthServCoAAcks	1.3.6.1.2.1.146.1.2.1.18	Counter32	read-only	The number of RADIUS CoA-ACK packets sent to this Dynamic Authorization Client. This counter may experience a discontinuity when the DAS module (re)starts, as indicated by the value of radiusDynAuthServerCounterDiscontinuity.
C32 radiusDynAuthServCoAAuthOnlyRequests	1.3.6.1.2.1.146.1.2.1.16	Counter32	read-only	The number of RADIUS CoA-requests that include a Service-Type attribute with value 'Authorize Only' received from this Dynamic Authorization Client. This counter may experience a discontinuity when the DAS module (re)starts, as indicated by the value of radiusDynAuthServerCounterDiscontinuity.
C32 radiusDynAuthServCoABadAuthenticators	1.3.6.1.2.1.146.1.2.1.24	Counter32	read-only	The number of RADIUS CoA-Request packets that contained an invalid Authenticator field received from this Dynamic Authorization Client. This counter may experience a discontinuity when the DAS module (re)starts, as indicated by the value of radiusDynAuthServerCounterDiscontinuity.
C32 radiusDynAuthServCoANakAuthOnlyRequests	1.3.6.1.2.1.146.1.2.1.20	Counter32	read-only	The number of RADIUS CoA-NAK packets that include a Service-Type attribute with value 'Authorize Only' sent to this Dynamic Authorization Client. This counter may experience a discontinuity when the DAS module (re)starts, as indicated by the value of radiusDynAuthServerCounterDiscontinuity.
C32 radiusDynAuthServCoANaks	1.3.6.1.2.1.146.1.2.1.19	Counter32	read-only	The number of RADIUS CoA-NAK packets sent to this Dynamic Authorization Client. This includes the RADIUS CoA-NAK packets sent with a Service-Type attribute with value 'Authorize Only' and the RADIUS CoA-NAK packets sent because no session context was found. This counter may experience a discontinuity when the DAS module (re)starts, as indicated by the value of radiusDynAuthServerCounterDiscontinuity.
C32 radiusDynAuthServCoANakSessNoContext	1.3.6.1.2.1.146.1.2.1.21	Counter32	read-only	The number of RADIUS CoA-NAK packets sent to this Dynamic Authorization Client because no session context was found. This counter may experience a discontinuity when the DAS module (re)starts, as indicated by the value of radiusDynAuthServerCounterDiscontinuity.
C32 radiusDynAuthServCoAPacketsDropped	1.3.6.1.2.1.146.1.2.1.25	Counter32	read-only	The number of incoming CoA packets from this Dynamic Authorization Client silently discarded by the server application for some reason other than malformed, bad authenticators, or unknown types. This counter may experience a discontinuity when the DAS module (re)starts, as indicated by the value of radiusDynAuthServerCounterDiscontinuity.
C32 radiusDynAuthServCoARequests	1.3.6.1.2.1.146.1.2.1.15	Counter32	read-only	The number of RADIUS CoA-requests received from this Dynamic Authorization Client. This also includes the CoA requests that have a Service-Type attribute with value 'Authorize Only'. This counter may experience a discontinuity when the DAS module (re)starts, as indicated by the value of radiusDynAuthServerCounterDiscontinuity.
C32 radiusDynAuthServCoAUserSessChanged	1.3.6.1.2.1.146.1.2.1.22	Counter32	read-only	The number of user sessions authorization changed for the CoA-Requests received from this Dynamic Authorization Client. Depending on site- specific policies, a single CoA request can change multiple user sessions' authorization. In cases where this Dynamic Authorization Server has no knowledge of the number of user sessions that are affected by a single request, each such CoA-Request will count as a single affected user session only. This counter may experience a discontinuity when the DAS module (re)starts, as indicated by the value of radiusDynAuthServerCounterDiscontinuity.
C32 radiusDynAuthServDisconAcks	1.3.6.1.2.1.146.1.2.1.7	Counter32	read-only	The number of RADIUS Disconnect-ACK packets sent to this Dynamic Authorization Client. This counter may experience a discontinuity when the DAS module (re)starts, as indicated by the value of radiusDynAuthServerCounterDiscontinuity.
C32 radiusDynAuthServDisconAuthOnlyRequests	1.3.6.1.2.1.146.1.2.1.5	Counter32	read-only	The number of RADIUS Disconnect-Requests that include a Service-Type attribute with value 'Authorize Only' received from this Dynamic Authorization Client. This counter may experience a discontinuity when the DAS module (re)starts, as indicated by the value of radiusDynAuthServerCounterDiscontinuity.
C32 radiusDynAuthServDisconBadAuthenticators	1.3.6.1.2.1.146.1.2.1.13	Counter32	read-only	The number of RADIUS Disconnect-Request packets that contained an invalid Authenticator field received from this Dynamic Authorization Client. This counter may experience a discontinuity when the DAS module (re)starts, as indicated by the value of radiusDynAuthServerCounterDiscontinuity.
C32 radiusDynAuthServDisconNakAuthOnlyRequests	1.3.6.1.2.1.146.1.2.1.9	Counter32	read-only	The number of RADIUS Disconnect-NAK packets that include a Service-Type attribute with value 'Authorize Only' sent to this Dynamic Authorization Client. This counter may experience a discontinuity when the DAS module (re)starts, as indicated by the value of radiusDynAuthServerCounterDiscontinuity.
C32 radiusDynAuthServDisconNaks	1.3.6.1.2.1.146.1.2.1.8	Counter32	read-only	The number of RADIUS Disconnect-NAK packets sent to this Dynamic Authorization Client. This includes the RADIUS Disconnect-NAK packets sent with a Service-Type attribute with value 'Authorize Only' and the RADIUS Disconnect-NAK packets sent because no session context was found. This counter may experience a discontinuity when the DAS module (re)starts, as indicated by the value of radiusDynAuthServerCounterDiscontinuity.
C32 radiusDynAuthServDisconNakSessNoContext	1.3.6.1.2.1.146.1.2.1.10	Counter32	read-only	The number of RADIUS Disconnect-NAK packets sent to this Dynamic Authorization Client because no session context was found. This counter may experience a discontinuity when the DAS module (re)starts, as indicated by the value of radiusDynAuthServerCounterDiscontinuity.
C32 radiusDynAuthServDisconPacketsDropped	1.3.6.1.2.1.146.1.2.1.14	Counter32	read-only	The number of incoming Disconnect-Requests from this Dynamic Authorization Client silently discarded by the server application for some reason other than malformed, bad authenticators, or unknown types. This counter may experience a discontinuity when the DAS module (re)starts, as indicated by the value of radiusDynAuthServerCounterDiscontinuity.
C32 radiusDynAuthServDisconRequests	1.3.6.1.2.1.146.1.2.1.4	Counter32	read-only	The number of RADIUS Disconnect-Requests received from this Dynamic Authorization Client. This also includes the RADIUS Disconnect-Requests that have a Service-Type attribute with value 'Authorize Only'. This counter may experience a discontinuity when the DAS module (re)starts as indicated by the value of radiusDynAuthServerCounterDiscontinuity.
C32 radiusDynAuthServDisconUserSessRemoved	1.3.6.1.2.1.146.1.2.1.11	Counter32	read-only	The number of user sessions removed for the Disconnect-Requests received from this Dynamic Authorization Client. Depending on site- specific policies, a single Disconnect request can remove multiple user sessions. In cases where this Dynamic Authorization Server has no knowledge of the number of user sessions that are affected by a single request, each such Disconnect-Request will count as a single affected user session only. This counter may experience a discontinuity when the DAS module (re)starts, as indicated by the value of radiusDynAuthServerCounterDiscontinuity.
C32 radiusDynAuthServDupCoARequests	1.3.6.1.2.1.146.1.2.1.17	Counter32	read-only	The number of duplicate RADIUS CoA-Request packets received from this Dynamic Authorization Client. This counter may experience a discontinuity when the DAS module (re)starts, as indicated by the value of radiusDynAuthServerCounterDiscontinuity.
C32 radiusDynAuthServDupDisconRequests	1.3.6.1.2.1.146.1.2.1.6	Counter32	read-only	The number of duplicate RADIUS Disconnect-Request packets received from this Dynamic Authorization Client. This counter may experience a discontinuity when the DAS module (re)starts, as indicated by the value of radiusDynAuthServerCounterDiscontinuity.
radiusDynAuthServerAuthOnlyGroup	1.3.6.1.2.1.146.2.2.2			The collection of objects supporting the RADIUS messages including Service-Type attribute with value 'Authorize Only'.
C32 radiusDynAuthServerCoAInvalidClientAddresses	1.3.6.1.2.1.146.1.1.2	Counter32	read-only	The number of CoA-Request packets received from unknown addresses. This counter may experience a discontinuity when the DAS module (re)starts, as indicated by the value of radiusDynAuthServerCounterDiscontinuity.
TIK radiusDynAuthServerCounterDiscontinuity	1.3.6.1.2.1.146.1.2.1.27	TimeTicks	read-only	The time (in hundredths of a second) since the last counter discontinuity. A discontinuity may be the result of a reinitialization of the DAS module within the managed entity.
C32 radiusDynAuthServerDisconInvalidClientAddressesEx	1.3.6.1.2.1.146.1.1.1	Counter32	read-only	The number of Disconnect-Request packets received from unknown addresses. This counter may experience a discontinuity when the DAS module (re)starts, as indicated by the value of radiusDynAuthServerCounterDiscontinuity.
STR radiusDynAuthServerIdentifier	1.3.6.1.2.1.146.1.1.3	SnmpAdminString	read-only	The NAS-Identifier of the RADIUS Dynamic Authorization Server. This is not necessarily the same as sysName in MIB II.
radiusDynAuthServerMIB	1.3.6.1.2.1.146			The MIB module for entities implementing the server side of the Dynamic Authorization Extensions to the Remote Authentication Dial-In User Service (RADIUS) protocol. Copyright (C) The Internet Society (2006). Initial version as published in RFC 4673; for full legal notices see the RFC itself.
radiusDynAuthServerMIBCompliances	1.3.6.1.2.1.146.2.1
radiusDynAuthServerMIBConformance	1.3.6.1.2.1.146.2
radiusDynAuthServerMIBGroup	1.3.6.1.2.1.146.2.2.1			The collection of objects providing management of a RADIUS Dynamic Authorization Server.
radiusDynAuthServerMIBGroups	1.3.6.1.2.1.146.2.2
radiusDynAuthServerMIBObjects	1.3.6.1.2.1.146.1
radiusDynAuthServerNoSessGroup	1.3.6.1.2.1.146.2.2.3			The collection of objects supporting the RADIUS messages that are referring to non-existing sessions.
radiusDynAuthServerScalars	1.3.6.1.2.1.146.1.1
C32 radiusDynAuthServMalformedCoARequests	1.3.6.1.2.1.146.1.2.1.23	Counter32	read-only	The number of malformed RADIUS CoA-Request packets received from this Dynamic Authorization Client. Bad authenticators and unknown types are not included as malformed CoA-Requests. This counter may experience a discontinuity when the DAS module (re)starts, as indicated by the value of radiusDynAuthServerCounterDiscontinuity.
C32 radiusDynAuthServMalformedDisconRequests	1.3.6.1.2.1.146.1.2.1.12	Counter32	read-only	The number of malformed RADIUS Disconnect-Request packets received from this Dynamic Authorization Client. Bad authenticators and unknown types are not included as malformed Disconnect-Requests. This counter may experience a discontinuity when the DAS module (re)starts, as indicated by the value of radiusDynAuthServerCounterDiscontinuity.
C32 radiusDynAuthServUnknownTypes	1.3.6.1.2.1.146.1.2.1.26	Counter32	read-only	The number of incoming packets of unknown types that were received on the Dynamic Authorization port. This counter may experience a discontinuity when the DAS module (re)starts, as indicated by the value of radiusDynAuthServerCounterDiscontinuity.

RFC description

Manages Dynamic Authorization Extensions to RADIUS protocol for server-side session management.

Start monitoring RADIUS/AAA policy server (dynamic authorization server, RFC 4673) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download RADIUS-DYNAUTH-SERVER-MIB