VIPTELA-DOT1X

All MIBs › VIPTELA-DOT1X

Organization: Viptela, Inc.

Last Updated: 2020-07-01

Category: Viptela SD-WAN

Description: Manages Viptela SD-WAN 802.1X port authentication and supplicant configuration on edge devices.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is VIPTELA-DOT1X?

VIPTELA-DOT1X is a vendor MIB from Viptela (Cisco SD-WAN) that models IEEE 802.1X network access control configuration and operational state on SD-WAN edge device interfaces. It exposes per-interface 802.1X operational state, host mode, control direction, MAC Authentication Bypass (MAB) settings, Wake-on-LAN, timers, and guest VLAN assignment. Its monitoring relevance is chiefly configuration/software-status oriented — tracking dot1xInterfacesOperState to confirm whether 802.1X enforcement is active on a port and verifying reauthentication/inactivity timeout settings, which is more of an access-control status check than a hardware health check. It models the IEEE 802.1X standard as its underlying reference framework. It is typically deployed on Viptela/Cisco SD-WAN edge routers/switches providing port-based network access control at branch sites. Network engineers evaluating or troubleshooting this functionality can download the VIPTELA-DOT1X file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in VIPTELA-DOT1X. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Viptela/Cisco SD-WAN edge routers/switches

Monitoring Examples

An admin polls dot1xInterfacesTable/dot1xInterfacesEntry keyed by dot1xInterfacesIfName to check dot1xInterfacesOperState and dot1xInterfacesHostMode on a branch access port. If dot1xInterfacesOperState shows disabled when it should be enforcing 802.1X, or dot1xInterfacesGuestVlan is unexpectedly active, that flags a misconfigured port allowing unauthenticated access.

What Can Be Monitored

802.1X operational state per interface
host mode and control direction
MAB server/local settings
reauthentication/inactivity timeouts
guest VLAN assignment

Imported Objects

From SNMPv2-SMI

Counter32
Counter64
Gauge32
Integer32
IpAddress
MODULE-IDENTITY
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DateAndTime
RowStatus
TEXTUAL-CONVENTION
TruthValue

From VIPTELA-GLOBAL

viptela

OBJECT-IDENTITY

How to Use in IPNetwork Monitor

Example using dot1xInterfacesOperState OID:

Select a Viptela/Cisco SD-WAN edge routers/switch (802.1X port-authentication operational state status) as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type dot1xInterfacesOperState into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. It reports the operational state. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is an INTEGER-type OID, Value bounds is the most useful condition here — trigger an alert if the value is anything other than 'up', since that indicates the condition this object reports has changed to one worth investigating. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
dot1x	1.3.6.1.4.1.41916.19.1
DOT dot1xClientsAuthMethod	1.3.6.1.4.1.41916.19.1.2.1.4	Dot1xAuthMethod	read-only	802.1x authentication method of the client
DOT dot1xClientsAuthState	1.3.6.1.4.1.41916.19.1.2.1.3	Dot1xAuthState	read-only	802.1x authentication state of the client
U32 dot1xClientsConnectedTime	1.3.6.1.4.1.41916.19.1.2.1.10	Unsigned32	read-only	Connected time, in seconds
STR dot1xClientsEapMethod	1.3.6.1.4.1.41916.19.1.2.1.7	String	read-only	Authenticated EAP method
U32 dot1xClientsEapolFramesRx	1.3.6.1.4.1.41916.19.1.2.1.13	Unsigned32	read-only	EAPoL frames received
U32 dot1xClientsEapolFramesTx	1.3.6.1.4.1.41916.19.1.2.1.14	Unsigned32	read-only	EAPoL frames sent
U32 dot1xClientsEapolLogoffFramesRx	1.3.6.1.4.1.41916.19.1.2.1.16	Unsigned32	read-only	EAPoL logoff frames received
U32 dot1xClientsEapolRequestFramesTx	1.3.6.1.4.1.41916.19.1.2.1.19	Unsigned32	read-only	EAPoL request frames sent
U32 dot1xClientsEapolRequestIdFramesTx	1.3.6.1.4.1.41916.19.1.2.1.17	Unsigned32	read-only	EAPoL identity request frames sent
U32 dot1xClientsEapolResponseFramesRx	1.3.6.1.4.1.41916.19.1.2.1.20	Unsigned32	read-only	EAPoL response frames received
U32 dot1xClientsEapolResponseIdFramesRx	1.3.6.1.4.1.41916.19.1.2.1.18	Unsigned32	read-only	EAPoL identity response frames received
U32 dot1xClientsEapolStartFramesRx	1.3.6.1.4.1.41916.19.1.2.1.15	Unsigned32	read-only	EAPoL start frames received
dot1xClientsEntry	1.3.6.1.4.1.41916.19.1.2.1		not-accessible
STR dot1xClientsIfName	1.3.6.1.4.1.41916.19.1.2.1.1	String	not-accessible	802.1x interface name
U32 dot1xClientsInactiveTime	1.3.6.1.4.1.41916.19.1.2.1.11	Unsigned32	read-only	Time client has been inactive, in seconds
STR dot1xClientsMacAddress	1.3.6.1.4.1.41916.19.1.2.1.2	String	not-accessible	MAC address of the client
STR dot1xClientsSessionId	1.3.6.1.4.1.41916.19.1.2.1.12	String	read-only	Client Session ID
U32 dot1xClientsSessionTime	1.3.6.1.4.1.41916.19.1.2.1.9	Unsigned32	read-only	Session time, in seconds
dot1xClientsTable	1.3.6.1.4.1.41916.19.1.2		not-accessible	Display 802.1x client information
STR dot1xClientsUsername	1.3.6.1.4.1.41916.19.1.2.1.8	String	read-only	Username for client session
I32 dot1xClientsVlan	1.3.6.1.4.1.41916.19.1.2.1.5	Integer32	read-only	Operational VLAN of the client
I32 dot1xClientsVpn	1.3.6.1.4.1.41916.19.1.2.1.6	Integer32	read-only	Operational VPN of the client
UNS dot1xInterfacesAccountingInterval	1.3.6.1.4.1.41916.19.1.1.1.16	UnsignedShort	read-only	Interim accounting interval, in minutes
I32 dot1xInterfacesAuthFailVlan	1.3.6.1.4.1.41916.19.1.1.1.11	Integer32	read-only	VLAN to drop 802.1x enabled clients into if authentication server is unreachable
I32 dot1xInterfacesAuthRejectVlan	1.3.6.1.4.1.41916.19.1.1.1.12	Integer32	read-only	VLAN to drop 802.1x enabled clients into if authentication is rejected
INT dot1xInterfacesCtrlDir	1.3.6.1.4.1.41916.19.1.1.1.4	INTEGER	read-only	802.1x port access control direction
I32 dot1xInterfacesDefaultVlan	1.3.6.1.4.1.41916.19.1.1.1.13	Integer32	read-only	VLAN to drop clients into when VLAN not specified by RADIUS
dot1xInterfacesEntry	1.3.6.1.4.1.41916.19.1.1.1		not-accessible
I32 dot1xInterfacesGuestVlan	1.3.6.1.4.1.41916.19.1.1.1.10	Integer32	read-only	VLAN to drop non-802.1x enabled clients into if client is not in MAB list
INT dot1xInterfacesHostMode	1.3.6.1.4.1.41916.19.1.1.1.3	INTEGER	read-only	Host mode
STR dot1xInterfacesIfName	1.3.6.1.4.1.41916.19.1.1.1.1	String	not-accessible	Interface name
UNS dot1xInterfacesInactivityTimeout	1.3.6.1.4.1.41916.19.1.1.1.9	UnsignedShort	read-only	Timeout for inactivity, in minutes
T/F dot1xInterfacesMabLocal	1.3.6.1.4.1.41916.19.1.1.1.6	TruthValue	read-only	MAC authentication bypass configured locally on the interface
T/F dot1xInterfacesMabServer	1.3.6.1.4.1.41916.19.1.1.1.5	TruthValue	read-only	MAC authentication bypass configured to use RADIUS server
STR dot1xInterfacesNasIdentifier	1.3.6.1.4.1.41916.19.1.1.1.17	String	read-only	NAS Identifier sent to RADIUS server
ADR dot1xInterfacesNasIPAddr	1.3.6.1.4.1.41916.19.1.1.1.18	InetAddressIP	read-only	NAS IP address sent to RADIUS server
U32 dot1xInterfacesNumClients	1.3.6.1.4.1.41916.19.1.1.1.19	Unsigned32	read-only	Number of connected clients
INT dot1xInterfacesOperStateEx	1.3.6.1.4.1.41916.19.1.1.1.2	INTEGER	read-only	Operational state
ADR dot1xInterfacesPrimaryRadiusServer	1.3.6.1.4.1.41916.19.1.1.1.14	InetAddressIP	read-only	Primary RADIUS server IP address
UNS dot1xInterfacesReauthTimeout	1.3.6.1.4.1.41916.19.1.1.1.8	UnsignedShort	read-only	Timeout for reauthentication, in minutes
ADR dot1xInterfacesSecondaryRadiusServer	1.3.6.1.4.1.41916.19.1.1.1.15	InetAddressIP	read-only	Secondary RADIUS server IP address
dot1xInterfacesTable	1.3.6.1.4.1.41916.19.1.1		not-accessible	Display 802.1x interface information
T/F dot1xInterfacesWakeOnLan	1.3.6.1.4.1.41916.19.1.1.1.7	TruthValue	read-only	Allow wake-on-lan packets to egress the port
U32 dot1xRadiusAcctBadAuthenticators	1.3.6.1.4.1.41916.19.1.3.1.26	Unsigned32	read-only	Number of accounting requests with bad authentication
T/F dot1xRadiusAcctIsCurrent	1.3.6.1.4.1.41916.19.1.3.1.20	TruthValue	read-only	RADIUS server is the currently active one for accounting
U32 dot1xRadiusAcctMalformedResponses	1.3.6.1.4.1.41916.19.1.3.1.25	Unsigned32	read-only	Number of malformed accounting responses received
U32 dot1xRadiusAcctPacketsDropped	1.3.6.1.4.1.41916.19.1.3.1.30	Unsigned32	read-only	Number of dropped accounting packets
U32 dot1xRadiusAcctPendingRequests	1.3.6.1.4.1.41916.19.1.3.1.27	Unsigned32	read-only	Number of un-acknowledged accounting requests
U32 dot1xRadiusAcctPort	1.3.6.1.4.1.41916.19.1.3.1.19	Unsigned32	read-only	RADIUS server accounting port number
U32 dot1xRadiusAcctRequests	1.3.6.1.4.1.41916.19.1.3.1.22	Unsigned32	read-only	Number of accounting requests sent
U32 dot1xRadiusAcctResponses	1.3.6.1.4.1.41916.19.1.3.1.24	Unsigned32	read-only	Number of accounting responses received
U32 dot1xRadiusAcctRetransmissions	1.3.6.1.4.1.41916.19.1.3.1.23	Unsigned32	read-only	Number of accounting request restransmissions
U32 dot1xRadiusAcctRoundTripTime	1.3.6.1.4.1.41916.19.1.3.1.21	Unsigned32	read-only	Accounting server round trip time for last message, in seconds
U32 dot1xRadiusAcctTimeouts	1.3.6.1.4.1.41916.19.1.3.1.28	Unsigned32	read-only	Number of accounting request timeouts
U32 dot1xRadiusAcctUnknownTypes	1.3.6.1.4.1.41916.19.1.3.1.29	Unsigned32	read-only	Number of accounting responses of unknown type
U32 dot1xRadiusAuthAccessAccepts	1.3.6.1.4.1.41916.19.1.3.1.10	Unsigned32	read-only	Number of access accepts received
U32 dot1xRadiusAuthAccessChallenges	1.3.6.1.4.1.41916.19.1.3.1.12	Unsigned32	read-only	Number of access challenges received
U32 dot1xRadiusAuthAccessRejects	1.3.6.1.4.1.41916.19.1.3.1.11	Unsigned32	read-only	Number of access rejects received
U32 dot1xRadiusAuthAccessRequests	1.3.6.1.4.1.41916.19.1.3.1.8	Unsigned32	read-only	Number of access requests sent
U32 dot1xRadiusAuthAccessRetransmissions	1.3.6.1.4.1.41916.19.1.3.1.9	Unsigned32	read-only	Number of access request retransmissions
U32 dot1xRadiusAuthBadAuthenticators	1.3.6.1.4.1.41916.19.1.3.1.14	Unsigned32	read-only	Number of authentication requests with bad authentication
T/F dot1xRadiusAuthIsCurrent	1.3.6.1.4.1.41916.19.1.3.1.6	TruthValue	read-only	RADIUS server is the currently active one for authentication
U32 dot1xRadiusAuthMalformedAccessResponses	1.3.6.1.4.1.41916.19.1.3.1.13	Unsigned32	read-only	Number of malformed access responses received
U32 dot1xRadiusAuthPacketsDropped	1.3.6.1.4.1.41916.19.1.3.1.18	Unsigned32	read-only	Number of dropped authentication packets
U32 dot1xRadiusAuthPendingRequests	1.3.6.1.4.1.41916.19.1.3.1.15	Unsigned32	read-only	Number of un-acknowledged access requests
U32 dot1xRadiusAuthPort	1.3.6.1.4.1.41916.19.1.3.1.5	Unsigned32	read-only	RADIUS server authentication port number
U32 dot1xRadiusAuthRoundTripTime	1.3.6.1.4.1.41916.19.1.3.1.7	Unsigned32	read-only	Authentication server round trip time for last message, in seconds
U32 dot1xRadiusAuthTimeouts	1.3.6.1.4.1.41916.19.1.3.1.16	Unsigned32	read-only	Number of authentication request timeouts
U32 dot1xRadiusAuthUnknownTypes	1.3.6.1.4.1.41916.19.1.3.1.17	Unsigned32	read-only	Number of authentication messages of unknown type
dot1xRadiusEntry	1.3.6.1.4.1.41916.19.1.3.1		not-accessible
STR dot1xRadiusIfName	1.3.6.1.4.1.41916.19.1.3.1.1	String	not-accessible	802.1x interface name
ADR dot1xRadiusIpAddress	1.3.6.1.4.1.41916.19.1.3.1.2	InetAddressIP	not-accessible	RADIUS server IP address
T/F dot1xRadiusIsPrimary	1.3.6.1.4.1.41916.19.1.3.1.4	TruthValue	read-only	RADIUS server is configured to be the primary one
dot1xRadiusTable	1.3.6.1.4.1.41916.19.1.3		not-accessible	Display 802.1x radius server information
U32 dot1xRadiusVpn	1.3.6.1.4.1.41916.19.1.3.1.3	Unsigned32	read-only	RADIUS server VPN
viptela_dot1x	1.3.6.1.4.1.41916.19			This module defines the data model for 802.1x Network Access Control

RFC description

Defines data model for 802.1x Network Access Control on Viptela SD-WAN devices.

Start monitoring Viptela/Cisco SD-WAN edge routers/switches (802.1X port-authentication operational state status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download VIPTELA-DOT1X