ZYXEL-AAA-MIB

All MIBs › ZYXEL-AAA-MIB

Organization: Enterprise Solution ZyXEL

Last Updated: 2012-07-01

Category: ZyXEL Networking

Description: Manages ZyXEL device Authentication, Authorization, and Accounting configuration for RADIUS and TACACS+ services.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is ZYXEL-AAA-MIB?

ZYXEL-AAA-MIB is a ZyXEL proprietary module for ZyXEL managed switches and access devices that manages Authentication, Authorization, and Accounting (AAA) configuration, covering RADIUS and TACACS+ server settings used for centralized login control. It exposes configuration objects for AAA server addresses, shared secrets/ports, and method/priority ordering used when authenticating administrative or 802.1X client sessions. Its monitoring relevance is mainly around software configuration and service status: an administrator can confirm which AAA servers are configured and reachable, and detect a misconfiguration that would lock out administrative access or fail client authentication. It is layered on standard SNMPv2-SMI conventions and typically used alongside vendor-neutral RADIUS/TACACS+ concepts and other ZyXEL switch security MIBs such as ACL and 802.1X modules. It is deployed in ZyXEL managed switches and access points in enterprise networks that centralize authentication through RADIUS or TACACS+. Engineers can download the ZYXEL-AAA-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in ZYXEL-AAA-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

ZyXEL managed switches/access devices

Monitoring Examples

No object names were captured in sample_objects, but consistent with its purpose the module would expose server-configuration tables listing RADIUS/TACACS+ server IP addresses, ports, and priority, plus a reachability/status indicator per server. An administrator would poll the server status objects to confirm a configured RADIUS server is reachable, since an unreachable AAA server can cause authentication timeouts for administrators or 802.1X clients.

What Can Be Monitored

configured RADIUS/TACACS+ server addresses
AAA server reachability/status
authentication method priority
shared secret/port configuration

Imported Objects

From P-BRIDGE-MIB

EnabledStatus

From SNMPv2-SMI

Integer32
MODULE-IDENTITY
NOTIFICATION-TYPE
OBJECT-TYPE

From SNMPv2-TC

DisplayString

From ZYXEL-ES-SMI

esMgmt

OBJECT-IDENTITY

OIDs

OID symbolic	OID numeric	Type	Access	Description
zyxelAaa	1.3.6.1.4.1.890.1.15.3.94			The subtree for authentication, authorization and accounting (AAA)
zyxelAaaSetup	1.3.6.1.4.1.890.1.15.3.94.1
zyxelAaaAuthenticationSetup	1.3.6.1.4.1.890.1.15.3.94.1.1
zyxelAaaAuthenticationTypeTable	1.3.6.1.4.1.890.1.15.3.94.1.1.1		not-accessible	The table contains authentication type configuration.
zyxelAaaAuthenticationTypeEntry	1.3.6.1.4.1.890.1.15.3.94.1.1.1.1		not-accessible	An entry contains authentication type configuration.
STR zyAaaAuthenticationTypeName	1.3.6.1.4.1.890.1.15.3.94.1.1.1.1.1	DisplayString	not-accessible	'Privilege Enable' means to authenticate access privilege level for administrator accounts (users for switch management). 'Login' means to authenticate administrator accounts (users for switch management).
OCT zyAaaAuthenticationTypeMethodList	1.3.6.1.4.1.890.1.15.3.94.1.1.1.1.2	OCTET STRING	read-write	There are three methods for the switch to authenticate the two types. The switch checks the methods in the order you configure them (first Method 1, then Method 2 and finally Method 3). You must configure the settings in the Method 1 field. If you want the switch to check other sources for authentication, specified them in Method 2 and Method 3 fields.
zyxelAaaAuthorizationSetup	1.3.6.1.4.1.890.1.15.3.94.1.2
ENA zyAaaAuthorizationConsoleState	1.3.6.1.4.1.890.1.15.3.94.1.2.1	EnabledStatus	read-write	Enable/Disable authorization on console for the switch.
zyxelAaaAuthorizationTypeTable	1.3.6.1.4.1.890.1.15.3.94.1.2.2		not-accessible	The table contains authorization type configuration.
zyxelAaaAuthorizationTypeEntry	1.3.6.1.4.1.890.1.15.3.94.1.2.2.1		not-accessible	An entry contains authorization type configuration.
STR zyAaaAuthorizationTypeName	1.3.6.1.4.1.890.1.15.3.94.1.2.2.1.1	DisplayString	not-accessible	'Exec' allows an administrator which logs in the switch through Telnet or SSH to have different access privilege level assigned via the external server. 'Dot1x' allows an IEEE 802.1x client to have different bandwidth limit or VLAN ID assigned via the external server.
ENA zyAaaAuthorizationTypeState	1.3.6.1.4.1.890.1.15.3.94.1.2.2.1.2	EnabledStatus	read-write	Enable/Disable authorization for a specified event type.
INT zyAaaAuthorizationTypeMethod	1.3.6.1.4.1.890.1.15.3.94.1.2.2.1.3	INTEGER	read-write	Enter whether you want to use RADIUS or TACACS+ for authorization of specific types of events. RADIUS is the only method for IEEE 802.1x authorization.
zyxelAaaAccountingSetup	1.3.6.1.4.1.890.1.15.3.94.1.3
I32 zyAaaAccountingUpdatePeriod	1.3.6.1.4.1.890.1.15.3.94.1.3.1	Integer32	read-write	The amount of time in minutes before the switch sends an update to the accounting server.
zyxelAaaAccountingTypeTable	1.3.6.1.4.1.890.1.15.3.94.1.3.2		not-accessible	The table contains accounting type configuration.
zyxelAaaAccountingTypeEntry	1.3.6.1.4.1.890.1.15.3.94.1.3.2.1		not-accessible	An entry contains accounting type configuration.
STR zyAaaAccountingTypeName	1.3.6.1.4.1.890.1.15.3.94.1.3.2.1.1	DisplayString	not-accessible	'System' means the switch will send information when the following system events occur: system boots up, system shuts down, system accounting is enabled, and system accounting is disabled. 'Exec' means the switch will send information when an administrator logs in and logs out via the console port, telnet or SSH. 'Dot1x' means the switch will send information when an IEEE 802.1x client begins a session (authenticates via the switch), ends a session as well as interim updates of a session. 'Commands' means the switch to send information when commands of specified privilege level and higher are executed on the switch.
ENA zyAaaAccountingTypeState	1.3.6.1.4.1.890.1.15.3.94.1.3.2.1.2	EnabledStatus	read-write	Enable/Disable accounting for a specified event type.
ENA zyAaaAccountingTypeBroadcastState	1.3.6.1.4.1.890.1.15.3.94.1.3.2.1.3	EnabledStatus	read-write	Enable/Disable this to have the switch send accounting information to all configured accounting servers at the same time.
INT zyAaaAccountingTypeMode	1.3.6.1.4.1.890.1.15.3.94.1.3.2.1.4	INTEGER	read-write	The switch supports two modes of recording login events. Select 'startStop' to have the switch send information to the accounting server when a user begins a session, during a user's session (if it lasts past the Update Period), and when a user ends a session. Select 'stopOnly' to have the switch send information to the accounting server only when a user ends a session.
INT zyAaaAccountingTypeMethod	1.3.6.1.4.1.890.1.15.3.94.1.3.2.1.5	INTEGER	read-write	Enter whether you want to use RADIUS or TACACS+ for accounting of specified types of events.
INT zyAaaAccountingTypePrivilege	1.3.6.1.4.1.890.1.15.3.94.1.3.2.1.6	INTEGER	read-write	This is only configurable for commands type of event. Enter the threshold command privilege level for which the switch should send accounting information. The switch will send accounting information when commands at the level you specify and higher are executed on the switch.
zyxelAaaTrapInfoObjects	1.3.6.1.4.1.890.1.15.3.94.2
INT zyAaaTrapAuthenticationMethod	1.3.6.1.4.1.890.1.15.3.94.2.1	INTEGER	not-accessible	This trap displays which authentication method is failed.
INT zyAaaTrapAuthorizationMethod	1.3.6.1.4.1.890.1.15.3.94.2.2	INTEGER	not-accessible	This trap displays which authorization method is failed.
zyxelAaaNotifications	1.3.6.1.4.1.890.1.15.3.94.3
NTF zyAaaAuthenticationFailure	1.3.6.1.4.1.890.1.15.3.94.3.1			Management connection authentication has failed.
NTF zyAaaAuthorizationFailure	1.3.6.1.4.1.890.1.15.3.94.3.2			Management connection authorization has failed.

RFC description

Authentication, authorization and accounting (AAA) management for network access control.

Start monitoring ZyXEL managed switches/access devices (RADIUS/TACACS+ server-address/priority config status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download ZYXEL-AAA-MIB

What Is ZYXEL-AAA-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

RFC description