RADLAN-SSL

All MIBs › RADLAN-SSL

Organization: Radlan Computer Communications Ltd.

Last Updated: 2003-09-21

Category: Security, Vendor: RADLAN/Cisco SB

Description: Configures SSL/TLS settings for secure HTTPS management access on Radlan switches.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is RADLAN-SSL?

RADLAN-SSL is a private enterprise MIB from Radlan (later part of Marvell), whose embedded switch-management software underlies many OEM managed Ethernet switches sold by other vendors. This module governs SSL/TLS certificate generation for securing the switch's HTTPS-based web management interface, exposing a certificate-generation table with fields such as country, state/province, locality, organization, organizational unit, common name, key validity period, and RSA key length. Its data is primarily configuration in nature rather than a live performance feed, but it does let an administrator confirm the software-security status of the device — specifically whether a valid, correctly-parameterized management certificate has been generated and what key strength is in force. It has no strong dependency on other MIBs beyond standard SNMPv2 table conventions. It is typically deployed on Radlan-derived managed switches (branded by vendors such as Netgear or D-Link) where secure web-based management access needs to be configured and audited, typically by opening the RADLAN-SSL MIB Browser view to inspect certificate objects directly.

IPNetwork Monitor allows you to monitor SNMP objects defined in RADLAN-SSL. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Radlan-based managed Ethernet switch (OEM-branded, e.g. Netgear/D-Link switch families)

Monitoring Examples

An administrator would poll the rlSslCertificateGenerationTable/rlSslCertificateGenerationEntry, keyed by rlSslCertificateGenerationIndex or rlSslCertificateGenerationId, to check fields like rlSslCertificateGenerationCommonName, rlSslCertificateGenerationValidDays, and rlSslCertificateGenerationRsaKeyLength. An anomaly this would reveal is a certificate nearing its validity expiration (low remaining rlSslCertificateGenerationValidDays) or a weak rlSslCertificateGenerationRsaKeyLength that fails a security policy, prompting regeneration of the cert before HTTPS management access breaks or is flagged non-compliant.

What Can Be Monitored

SSL certificate generation status
certificate common name/organization fields
certificate validity period (days remaining)
RSA key length

Imported Objects

From RADLAN-MIB

rnd	OBJECT-IDENTITY

From RADLAN-SNMPv2

RowStatus
TruthValue

From SNMPv2-SMI

IpAddress
MODULE-IDENTITY
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

TEXTUAL-CONVENTION

From SNMPv2-TC-v1

DisplayString

OIDs

OID symbolic	OID numeric	Type	Access	Description
rlSsl	1.3.6.1.4.1.89.100			The private MIB module definition for SSL.
rlSslCertificateGenerationTable	1.3.6.1.4.1.89.100.1		not-accessible	This table is used for : 1. generating keys and self signed certificate - saved in flash and RAM (not in configuration file) 2. generating certificate requests - saved in RAM, can be read by rlSslCertificateExportTable 3. generating self signed certificate - saved in flash and RAM (not in configuraion file) By setting rlSslCertificateGenerationAction to the appropriate value this action takes place. The other fields of this table are used for each of this actions
rlSslCertificateGenerationEntry	1.3.6.1.4.1.89.100.1.1		not-accessible	The row definition for this table.
INT rlSslCertificateGenerationIndex	1.3.6.1.4.1.89.100.1.1.1	INTEGER	read-write	This index is always set to 1 no matter for which certificate or certificate request the action refers to.
INT rlSslCertificateGenerationId	1.3.6.1.4.1.89.100.1.1.2	INTEGER	read-write	The device can hold a number of keys/certificates/certificate requests. These certificates are always numbered from 1 to N (maximum number of certificates in device). This field decides to which keys/certificates/certificate requests the action refers.
STR rlSslCertificateGenerationCountryName	1.3.6.1.4.1.89.100.1.1.3	DisplayString	read-write	Value of country name field that will appear when a new certificate request or self signed certificate is generated.
STR rlSslCertificateGenerationStateOrProvinceName	1.3.6.1.4.1.89.100.1.1.4	DisplayString	read-write	Value of state or province name field that will appear when a new certificate or self signed certificate is generated.
STR rlSslCertificateGenerationLocalityName	1.3.6.1.4.1.89.100.1.1.5	DisplayString	read-write	Value of locality field that will appear when a new certificate or self signed certificate is generated.
STR rlSslCertificateGenerationOrganizationName	1.3.6.1.4.1.89.100.1.1.6	DisplayString	read-write	Value of organization field that will appear when a new certificate or self signed certificate is generated.
STR rlSslCertificateGenerationOrganizationUnitName	1.3.6.1.4.1.89.100.1.1.7	DisplayString	read-write	Value of organization field that will appear when a new certificate or self signed certificate is generated.
STR rlSslCertificateGenerationCommonName	1.3.6.1.4.1.89.100.1.1.8	DisplayString	read-write	Value of common name field that will appear when a new certificate or self signed certificate is generated.
INT rlSslCertificateGenerationValidDays	1.3.6.1.4.1.89.100.1.1.9	INTEGER	read-write	When generating self signed certificate this field sets the valid fields. 'Valid from' is current GMT and 'valid to' current GMT + the value of this field.
INT rlSslCertificateGenerationRsaKeyLength	1.3.6.1.4.1.89.100.1.1.10	INTEGER	read-write	Setting the RSA key size that will be created when a new key is generated - generateRsaKeyAndSelfSignedCertificate
STR rlSslCertificateGenerationPassphrase	1.3.6.1.4.1.89.100.1.1.11	DisplayString	read-write	When a RSA key is generated (generateRsaKeyAndSelfSignedCertificate) this passphrase is saved in flash and when the time comes and the certificate and the key are exported in PKCS12 format this passphrase is used to encrypt it. If the passphrase is empty the key and certificate can not be exported. There is no method of obtaining this passphrase once a key was generated.
INT rlSslCertificateGenerationAction	1.3.6.1.4.1.89.100.1.1.12	INTEGER	read-write	Setting to a regenerateCertificate causes a new certificate to be generated and to be used for all new sessions.
rlSslCertificateExportTable	1.3.6.1.4.1.89.100.2		not-accessible	This table is used for viewing saved data from RAM and flash.
rlSslCertificateExportEntry	1.3.6.1.4.1.89.100.2.1		not-accessible	The row definition for this table.
INT rlSslCertificateExportId	1.3.6.1.4.1.89.100.2.1.1	INTEGER	read-only	Identifies the index of this certficate / certificate request the table holds.
INT rlSslCertificateExportType	1.3.6.1.4.1.89.100.2.1.2	INTEGER	read-only	Identifies the type of data the current entry shows.
INT rlSslCertificateExportFragmentId	1.3.6.1.4.1.89.100.2.1.3	INTEGER	read-only	Identifies the index of this fragment in the certificate request.
OCT rlSslCertificateExportFragmentText	1.3.6.1.4.1.89.100.2.1.4	OCTET STRING	read-only	A part of the readable text entry for the certificate request.
INT rlSslCertificateSave	1.3.6.1.4.1.89.100.3	INTEGER	read-write	Saves data from rlSslCertificateImportTable to RAM and flash. When an external certificate should be copied to the device first we copy it to rlSslCertificateImportTable and then this scalar is set to the certificate id that we want to save - 1. All entries in rlSslCertificateImportTable that have this id and their format is equal to the current value of rlSslCertificateSaveFormat are concatenated. 2. If the imported certificate format is .. - section 1 result is validated against the key with the same index. If validation fails for any reason - the certificate is not saved and the setting this scalar fails. 3. If the imported certificate format is PKCS12 - section1 result is decrypted using rlSslImportedPKCS12CertificatePassphrase current value. If decryption fails for any reason the PKCS12 certificate and key are not saved to FLASH and setting this scalar fails.
INT rlSslCertificateSaveFormat	1.3.6.1.4.1.89.100.4	INTEGER	read-write	.
STR rlSslImportedPKCS12CertificatePassphrase	1.3.6.1.4.1.89.100.5	DisplayString	read-write	.
rlSslCertificateImportTable	1.3.6.1.4.1.89.100.6		not-accessible	This table is used for copying an external certificate to the device - see rlSslCertificateSave
rlSslCertificateImportEntry	1.3.6.1.4.1.89.100.6.1		not-accessible	The row definition for this table.
INT rlSslCertificateImportId	1.3.6.1.4.1.89.100.6.1.1	INTEGER	read-write	The certificate ID.
INT rlSslCertificateImportFormat	1.3.6.1.4.1.89.100.6.1.2	INTEGER	read-write	.
INT rlSslCertificateImportFragmentId	1.3.6.1.4.1.89.100.6.1.3	INTEGER	read-write	Identifies the index of this fragment in the certificate.
OCT rlSslCertificateImportFragmentText	1.3.6.1.4.1.89.100.6.1.4	OCTET STRING	read-write	A part of the readable text entry for the certificate.
ROW rlSslCertificateImportFragmentStatus	1.3.6.1.4.1.89.100.6.1.5	RowStatus	read-write

RFC description

Radlan Computer Communications SSL (Secure Sockets Layer) MIB for managing SSL/TLS security features and configurations on Radlan networking devices.

Start monitoring Radlan-based managed Ethernet switch, OEM-branded e.g. Netgear/D-Link (HTTPS management certificate) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download RADLAN-SSL

What Is RADLAN-SSL?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description