ZYXEL-PORT-AUTHENTICATION-MIB

All MIBs › ZYXEL-PORT-AUTHENTICATION-MIB

Organization: Enterprise Solution ZyXEL

Last Updated: 2012-07-01

Category: ZyXEL Security and Access Control

Description: Manages ZyXEL IEEE 802.1X port authentication for network access control using RADIUS supplicant verification.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is ZYXEL-PORT-AUTHENTICATION-MIB?

ZYXEL-PORT-AUTHENTICATION-MIB is a ZyXEL private enterprise MIB for IEEE 802.1X port-based network access control, placing it in the switching/network access security category. It exposes per-port authentication configuration (enabled/disabled, authentication mode) and the resulting per-port/per-supplicant authentication state, such as authorized, unauthorized, or pending, as clients attempt to authenticate via RADIUS. Its monitoring value is primarily a security/software-status one: it lets an administrator see which ports currently have authenticated devices, which are blocked pending or failing authentication, and thereby detect unauthorized access attempts or RADIUS communication problems. It explicitly depends on IEEE 802.1X and RADIUS (AAA) infrastructure, since port state here is driven by the switch's interaction with an external RADIUS server. It is typically deployed on ZyXEL access switches in enterprise or campus networks enforcing NAC (network access control) policies at the wiring closet, where ZYXEL-PORT-AUTHENTICATION-MIB SNMP monitoring supports detecting failed or blocked 802.1X authentication attempts.

IPNetwork Monitor allows you to monitor SNMP objects defined in ZYXEL-PORT-AUTHENTICATION-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

ZyXEL managed Ethernet switch

Monitoring Examples

An operator would poll the per-port 802.1X authentication state to confirm a port has transitioned to authorized after a client successfully authenticates via RADIUS, or to spot a port stuck in unauthorized/pending state indicating a failed credential check or unreachable RADIUS server. A cluster of ports simultaneously failing authentication would point to a RADIUS server outage rather than a per-user credential issue. No sample objects were listed for this MIB, so exact table/column names are unconfirmed, but the functional monitoring target is per-port 802.1X authorization state.

What Can Be Monitored

802.1X enabled state per port
port authorization status (authorized/unauthorized/pending)
authentication failures
supplicant/client identity per port

Imported Objects

From BRIDGE-MIB

dot1dBasePort

OBJECT-TYPE

From P-BRIDGE-MIB

EnabledStatus

From SNMPv2-SMI

MODULE-IDENTITY
OBJECT-TYPE

From ZYXEL-ES-SMI

esMgmt

OBJECT-IDENTITY

OIDs

OID symbolic	OID numeric	Type	Access	Description
zyxelPortAuthentication	1.3.6.1.4.1.890.1.15.3.62			The subtree for port authentication
zyxelPortAuthenticationSetup	1.3.6.1.4.1.890.1.15.3.62.1
ENA zyPortAuthenticationState	1.3.6.1.4.1.890.1.15.3.62.1.1	EnabledStatus	read-write	Enable/Disable 802.1x port authentication for the switch.
zyxelPortAuthenticationPortTable	1.3.6.1.4.1.890.1.15.3.62.1.2		not-accessible	The table contains port authentication configuration
zyxelPortAuthenticationPortEntry	1.3.6.1.4.1.890.1.15.3.62.1.2.1		not-accessible	An entry contains port authentication configuration.
ENA zyPortAuthenticationPortState	1.3.6.1.4.1.890.1.15.3.62.1.2.1.1	EnabledStatus	read-write	Enable/Disable 802.1x port authentication on the port. You must first allow 802.1x authentication on the Switch before configuring it on each port.
ENA zyPortReAuthenticationPortState	1.3.6.1.4.1.890.1.15.3.62.1.2.1.2	EnabledStatus	read-write	Enable/Disable 802.1x port re-authentication on the port. Specify if a subscriber has to periodically re-enter his or her username and password to stay connected to the port.
INT zyPortReAuthenticationPortTimer	1.3.6.1.4.1.890.1.15.3.62.1.2.1.3	INTEGER	read-write	Specify the length of time required to pass before a client has to re-enter his or her username and password to stay connected to the port.
INT zyPortAuthenticationPortQuietPeriod	1.3.6.1.4.1.890.1.15.3.62.1.2.1.4	INTEGER	read-write	Specify the number of seconds the port remains in the HELD state and rejects further authentication requests from the connected client after a failed authentication exchange.
INT zyPortAuthenticationPortTxPeriod	1.3.6.1.4.1.890.1.15.3.62.1.2.1.5	INTEGER	read-write	Specify the number of seconds the Switch waits for client's response before re-sending an identity request to the client.
INT zyPortAuthenticationPortSupplicantTimeout	1.3.6.1.4.1.890.1.15.3.62.1.2.1.6	INTEGER	read-write	Specify the number of seconds the Switch waits for client's response to a challenge request before sending another request.
INT zyPortAuthenticationPortMaxRequest	1.3.6.1.4.1.890.1.15.3.62.1.2.1.7	INTEGER	read-write	Specify the number of times the Switch tries to authenticate client(s) before sending unresponsive ports to the Guest VLAN. This is set to 2 by default. That is, the Switch attempts to authenticate a client twice. If the client does not respond to the first authentication request, the Switch tries again. If the client still does not respond to the second request, the Switch sends the client to the Guest VLAN. The client needs to send a new request to be authenticated by the Switch again.
ENA zyPortAuthenticationPortGuestVlanState	1.3.6.1.4.1.890.1.15.3.62.1.2.1.8	EnabledStatus	read-write	Enable/Disable Guest VLAN on the port. Clients that fail authentication are placed in the guest VLAN and can receive limited services.
INT zyPortAuthenticationPortGuestVlan	1.3.6.1.4.1.890.1.15.3.62.1.2.1.9	INTEGER	read-write	Enter the number that identifies the guest VLAN. Make sure this is a VLAN recognized in your network. A guest VLAN is a pre-configured VLAN on the Switch that allows non-authenticated users to access limited network resources through the Switch. You must also enable IEEE 802.1x authentication on the Switch and the associated ports.
INT zyPortAuthenticationPortGuestVlanHostMode	1.3.6.1.4.1.890.1.15.3.62.1.2.1.10	INTEGER	read-write	Specify how the Switch authenticates users when more than one user connect to the port (using a hub). Select Multi-Host to authenticate only the first user that connects to this port. If the first user enters the correct credential, any other users are allowed to access the port without authentication. If the first user fails to enter the correct credential, they are all put in the guest VLAN. Once the first user who did authentication logs out or disconnects from the port, rest of the users are blocked until a user does the authentication process again. Select Multi-Secure to authenticate each user that connects to this port.
INT zyPortAuthenticationPortGuestVlanHostModeMultiSecureNumber	1.3.6.1.4.1.890.1.15.3.62.1.2.1.11	INTEGER	read-write	If you set Host-mode to Multi-Secure, specify the maximum number of users that the Switch will authenticate on this port.

RFC description

Port-level authentication configuration and management for ZyXEL switches.

Start monitoring ZyXEL managed Ethernet switch (802.1X per-port authorized/unauthorized status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download ZYXEL-PORT-AUTHENTICATION-MIB

What Is ZYXEL-PORT-AUTHENTICATION-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description