CISCO-AUTH-FRAMEWORK-MIB

CiscoAuthMethod1 = other2 = dot1x3 = macAuthBypass4 = webAuthThe authentication methods and protocols supported in Authentication Framework. other : none of the below. dot1x : 802.1x Protocol. macAuthBypass: MAC Authentication Bypass. webAuth : Web-Proxy Authentication. 'other' is a read only value which can not be used in set operation. · Integer32

The authentication method registered with Authentication Framework.

Unsigned32

A unique number which indicates the default priority of a authentication method. The default priority is assigned by Authentication Framework during method registration. The method with smallest value has highest priority.

Unsigned32

A unique number which indicates the default execution order of a authentication method. The default execution order is assigned by Authentication Framework during method registration. The method with smallest value will be execute first.

CiscoAuthControlledDirections0 = both1 = inThe controlled direction values for capable ports in Authentication Framework. both: control is required to be exerted over both incoming and outgoing traffic through the controlled port. in : control is required to be exerted over the incoming traffic through the controlled port. · Integer32

Specifies the controlled direction of this port.

SnmpAdminStringAn octet string containing administrative information, preferably in human-readable form. To facilitate internationalization, this information is represented using the ISO/IEC IS 10646-1 character set, encoded as an octet string using the UTF-8 transformation format described in [RFC2279]. Since additional code points are added by amendments to the 10646 standard from time to time, implementations must be prepared to encounter any code point from 0x00000000 to 0x7fffffff. Byte sequences that do not correspond to the valid UTF-8 encoding of a code point or are outside this range are prohibited. The use of control codes should be avoided. When it is necessary to represent a newline, the control code sequence CR LF should be used. The use of leading or trailing white space should be avoided. For code points not directly supported by user interface hardware or software, an alternative means of entry and display, such as hexadecimal, may be provided. For information encoded in 7-bit US-ASCII, the UTF-8 encoding is identical to the US-ASCII encoding. UTF-8 may require multiple bytes to represent a single character / code point; thus the length of this object in octets may be different from the number of characters encoded. Similarly, size constraints refer to the number of encoded octets, not the number of characters represented by an encoding. Note that when this TC is used for an object that is used or envisioned to be used as an index, then a SIZE restriction MUST be specified so that the number of sub-identifiers for any object instance does not exceed the limit of 128, as defined by [RFC3416]. Note that the size of an SnmpAdminString object is measured in octets, not characters. SIZE (0..255) · OCTET STRING · hint 255t

Specifies the name of the fallback profile to be used when failing over to Web Proxy Authentication. A zero length string indicates that fallback mechanism to Web Proxy Authentication is disabled in Authentication Framework.

CiscoAuthHostMode1 = singleHost2 = multiHost3 = multiAuth4 = multiDomainThe authentication mode of a controlled port. singleHost: port allows one host to connect and authenticate in a single domain. multiHost : port allows multiple hosts to connect. Once a host is authenticated, all remaining hosts are also authenticated in a single domain. multiAuth : port allows multiple hosts to connect. Each host is authenticated separately in a single domain. multiDomain: port allows multiple domains to be authenticated. · Integer32

Specifies the authentication host mode for this port.

TruthValue1 = true2 = falseRepresents a boolean value. · Integer32

Specifies if the Pre-Authentication Open Access feature allows clients/devices to gain network access before authentication is performed. A value of 'true' for this object indicates that client/device is able to gain network access before authentication is performed.

CiscoAuthControlledPortControl1 = forceUnauthorized2 = auto3 = forceAuthorizedThe authorization control values of Authentication Framework on a controlled port. forceUnauthorized: the controlled port is forced to be unauthorized unconditionally. auto : authorization of the controlled port will be determined by an authentication process. forceAuthorized : The controlled port is forced to be authorized unconditionally. · Integer32

Specifies the authorization control for this port.

TruthValue1 = true2 = falseRepresents a boolean value. · Integer32

Specifies if reauthentication is enabled for this port.

Unsigned32 · seconds

Specifies the reauthentication interval, after which the port will be reauthenticated if value of the corresponding instance of cafPortReauthEnabled is 'true'. A value of zero indicates that the reauthentication interval is downloaded from AAA server when this port is authenticated.

Unsigned32 · seconds

Specifies the interval after which a further authentication attempt should be made to this port if it is not authorized. A value of zero indicates that no further authentication attempt will be made if this port is unauthorized.

Integer32 (-1 | 0 | 1..65535) · seconds

Specifies the period of time that a client associating with this port is allowed to be inactive before being terminated. A value of zero indicates that inactivity timeout is disabled on this port. A value of -1 indicates that inactivity timeout is downloaded from the AAA server when this port is authenticated.

INTEGER1 = restrict2 = shutdown3 = protect4 = replace · Integer32

Specifies the action to be taken due to a security violation occurs on this port. restrict: This port will be moved to restricted state. shutdown: This port will be shutdown from Authentication Framework perspective. protect : This port will be moved to protected state. replace : The current authentication session on this port will be terminated and replaced by a new authentication session, upon the detection of security violation on the current authentication session on the port.

CiscoAuthMethodListThe list of authentication methods provided within Authentication Framework. Each octet represents an authentication method which is defined in CiscoAuthMethod. The DESCRIPTION clause of CiscoAuthMethodList objects must fully describe the relationship between methods. · OCTET STRING

This object specifies the administrative execution order of authentication methods on the port. Methods are executed in the order as specified in the method list. Method which is at the beginning of the method list will be executed first. Method which is at the end of method list will be executed last. A zero length string of this object indicates that no per port execution order configuration has been specified on this port. The actual execution order is based on the value of cafAuthMethodDefaultExecOrder in cafAuthMethodRegTable.

CiscoAuthMethodListThe list of authentication methods provided within Authentication Framework. Each octet represents an authentication method which is defined in CiscoAuthMethod. The DESCRIPTION clause of CiscoAuthMethodList objects must fully describe the relationship between methods. · OCTET STRING

This object specifies the administrative priority of authentication methods on the port. The priority of each method is assigned based on the method list. Method which is at the beginning of the method list has highest priority. Method which is at the end of method list has lowest priority. A zero length string of this object indicates that no per port method priority configuration has been specified on this port. The actual execution order is based on the value of cafAuthMethodDefaultExecOrder in cafAuthMethodRegTable.

CiscoAuthMethodListThe list of authentication methods provided within Authentication Framework. Each octet represents an authentication method which is defined in CiscoAuthMethod. The DESCRIPTION clause of CiscoAuthMethodList objects must fully describe the relationship between methods. · OCTET STRING

This object indicates the authentication methods currently available on this port.

CiscoAuthMethodListThe list of authentication methods provided within Authentication Framework. Each octet represents an authentication method which is defined in CiscoAuthMethod. The DESCRIPTION clause of CiscoAuthMethodList objects must fully describe the relationship between methods. · OCTET STRING

This object indicates the operational execution order of authentication methods on this port. Methods are executed in the order as specified in the method list. Method which is at the beginning of the method list will be executed first. Method which is at the end of method list will be executed last.

CiscoAuthMethodListThe list of authentication methods provided within Authentication Framework. Each octet represents an authentication method which is defined in CiscoAuthMethod. The DESCRIPTION clause of CiscoAuthMethodList objects must fully describe the relationship between methods. · OCTET STRING

This object indicates the operational priority of authentication methods on this port. Methods have the priority as specified in the method list. Method which is at the beginning of the method list has highest priority. Method which is at the end of method list has lowest priority.

Unsigned32

This object specifies the maximum number of retry should be performed before generating Authentication Fail event. A value of zero indicates that Authentication Fail event will be generated upon authentication fail without any retry.

TruthValue1 = true2 = falseRepresents a boolean value. · Integer32

This object specifies whether no action will be performed when an Authentication Fail event occurs. Setting 'true' on this object indicates that no action will be performed when Authentication Fail event occurs. The read-only value 'false' indicates that an action will be performed when an Authentication Fail event occurs.

Integer32 (-1 | 0 | 1..2147483647)

This object specifies the Authentication Failed VLAN number. The read-only value of -1 indicates that this object is not applicable on this port. The read-only value of zero indicates that this port will not be authorized to any VLAN when Authentication Failed event occurs. Setting a non-zero value on this object indicates that this port will be authorized to the VLAN as specified by this object value, when Authentication Fail event occurs.

TruthValue1 = true2 = falseRepresents a boolean value. · Integer32

This object specifies whether the next authentication method will be used if an Authentication Fail event is generated by the current authentication method. Setting this object to 'true' indicates that the next available authentication method will be used when Authentication Fail event occurs. The read-only value 'false' indicates that the next available authentication method will not be used when Authentication Fail event occurs.

TruthValue1 = true2 = falseRepresents a boolean value. · Integer32

This object specifies whether an action is performed when No Response event occurs. Setting 'true' on this object indicates that no action will be performed when No Response event occurs. The read-only value 'false' of this object indicates that an action will be performed when No Response event occurs.

Integer32 (-1 | 0 | 1..2147483647)

This object specifies the No Response Authorized VLAN number. The read-only value of -1 indicates that this object is not applicable on this port. The read-only value of zero indicates that this port will not be authorized to any VLAN when No Response event occurs. Setting a non-zero value on this object indicates that this port will be authorized to the VLAN as specified by this object value, when No Response event occurs.

TruthValue1 = true2 = falseRepresents a boolean value. · Integer32

This object indicates whether an action is performed if an AAA Server Reachability event occurs. Setting 'true' on this object indicates that no action will be performed when AAA Server Reachability event occurs. The read-only value 'false' indicates that an action will be performed when AAA Server Reachability event occurs.

TruthValue1 = true2 = falseRepresents a boolean value. · Integer32

This object specifies if current authorization will remain unchanged for the port when AAA Server Reachability event occurs. Setting 'true' on this object indicates that current authorization will remain unchanged for the port when AAA Server Reachability event occurs. The read-only value 'false' indicates that the current authorization will not be retained for the port when AAA Server Reachability event occurs.

Integer32 (-1 | 0 | 1..2147483647)

This object specifies the AAA Server Reachability Authorized VLAN number. The read-only value of -1 indicates that this object is not applicable on this port. The read-only value of zero indicates that this port will not be authorized to any VLAN when AAA Server Reachability event occurs. Setting a non-zero value on this object indicates that this port will be authorized to the VLAN as specified by this object value, when AAA Server Reachability event occurs.

INTEGER1 = none2 = reinitialize · Integer32

This object specifies the action applied to the port upon AAA recovery. none : no action will be applied. reinitialize: the port will be reinitialized with the current authentication method.

OCTET STRING SIZE (1..64)

A unique identifier of the authentication session.

MacAddressRepresents an 802 MAC address represented in the `canonical' order defined by IEEE 802.1a, i.e., as if it were transmitted least significant bit first, even though 802.5 (in contrast to other 802.x protocols) requires MAC addresses to be transmitted most significant bit first. SIZE (6) · OCTET STRING · hint 1x:

Indicates the MAC address of the device associates with the authentication session.

InetAddressType0 = unknown1 = ipv42 = ipv63 = ipv4z4 = ipv6z16 = dnsA value that represents a type of Internet address. unknown(0) An unknown address type. This value MUST be used if the value of the corresponding InetAddress object is a zero-length string. It may also be used to indicate an IP address that is not in one of the formats defined below. ipv4(1) An IPv4 address as defined by the InetAddressIPv4 textual convention. ipv6(2) An IPv6 address as defined by the InetAddressIPv6 textual convention. ipv4z(3) A non-global IPv4 address including a zone index as defined by the InetAddressIPv4z textual convention. ipv6z(4) A non-global IPv6 address including a zone index as defined by the InetAddressIPv6z textual convention. dns(16) A DNS domain name as defined by the InetAddressDNS textual convention. Each definition of a concrete InetAddressType value must be accompanied by a definition of a textual convention for use with that InetAddressType. To support future extensions, the InetAddressType textual convention SHOULD NOT be sub-typed in object type definitions. It MAY be sub-typed in compliance statements in order to require only a subset of these address types for a compliant implementation. Implementations must ensure that InetAddressType objects and any dependent objects (e.g., InetAddress objects) are consistent. An inconsistentValue error must be generated if an attempt to change an InetAddressType object would, for example, lead to an undefined InetAddress value. In particular, InetAddressType/InetAddress pairs must be changed together if the address type changes (e.g., from ipv6(2) to ipv4(1)). · Integer32

Indicates the type of Internet address of the client associates with the authentication session.

InetAddressDenotes a generic Internet address. An InetAddress value is always interpreted within the context of an InetAddressType value. Every usage of the InetAddress textual convention is required to specify the InetAddressType object that provides the context. It is suggested that the InetAddressType object be logically registered before the object(s) that use the InetAddress textual convention, if they appear in the same logical row. The value of an InetAddress object must always be consistent with the value of the associated InetAddressType object. Attempts to set an InetAddress object to a value inconsistent with the associated InetAddressType must fail with an inconsistentValue error. When this textual convention is used as the syntax of an index object, there may be issues with the limit of 128 sub-identifiers specified in SMIv2, STD 58. In this case, the object definition MUST include a 'SIZE' clause to limit the number of potential instance sub-identifiers; otherwise the applicable constraints MUST be stated in the appropriate conceptual row DESCRIPTION clauses, or in the surrounding documentation if there is no single DESCRIPTION clause that is appropriate. SIZE (0..255) · OCTET STRING

Indicates the Internet address of the client associates with the authentication session. The type of this address is determined by the value of cafSessionClientAddrType object.

INTEGER1 = idle2 = running3 = noMethod4 = authenticationSuccess5 = authenticationFailed6 = authorizationSuccess7 = authorizationFailed · Integer32

Indicates the current status of the authentication session. idle : the session has been initialized and no method has run yet. running : an authentication method is running for this session. noMethod : no authentication method has provided a result for this session. authenticationSuccess: an authentication method has resulted in authentication success for this session. authenticationFailed: an authentication method has resulted in authentication failed for this session. authorizationSuccess: authorization is successful for this session. authorizationFailed : authorization is failed for this session.

INTEGER1 = other2 = data3 = voice · Integer32

Indicates the type of domain that the authentication session belongs to. other : none of the below. data : indicates the data domain. voice: indicates the voice domain.

CiscoAuthHostMode1 = singleHost2 = multiHost3 = multiAuth4 = multiDomainThe authentication mode of a controlled port. singleHost: port allows one host to connect and authenticate in a single domain. multiHost : port allows multiple hosts to connect. Once a host is authenticated, all remaining hosts are also authenticated in a single domain. multiAuth : port allows multiple hosts to connect. Each host is authenticated separately in a single domain. multiDomain: port allows multiple domains to be authenticated. · Integer32

Indicates the authentication host mode of the port in the authentication session.

CiscoAuthControlledDirections0 = both1 = inThe controlled direction values for capable ports in Authentication Framework. both: control is required to be exerted over both incoming and outgoing traffic through the controlled port. in : control is required to be exerted over the incoming traffic through the controlled port. · Integer32

Indicates the operational controlled directions parameter for this port in the authentication session.

CnnEouPostureTokenStringPosture token which representing the endpoint device's relative compliance to the network compliance policy. Valid characters are a-z, A-Z, 0-9, ,'#', '-', '_', and '.'. Posture token string is case sensitive and permits the value of empty string. SIZE (0..255) · OCTET STRING

Indicates the posture token associates with the authentication session.

SnmpAdminStringAn octet string containing administrative information, preferably in human-readable form. To facilitate internationalization, this information is represented using the ISO/IEC IS 10646-1 character set, encoded as an octet string using the UTF-8 transformation format described in [RFC2279]. Since additional code points are added by amendments to the 10646 standard from time to time, implementations must be prepared to encounter any code point from 0x00000000 to 0x7fffffff. Byte sequences that do not correspond to the valid UTF-8 encoding of a code point or are outside this range are prohibited. The use of control codes should be avoided. When it is necessary to represent a newline, the control code sequence CR LF should be used. The use of leading or trailing white space should be avoided. For code points not directly supported by user interface hardware or software, an alternative means of entry and display, such as hexadecimal, may be provided. For information encoded in 7-bit US-ASCII, the UTF-8 encoding is identical to the US-ASCII encoding. UTF-8 may require multiple bytes to represent a single character / code point; thus the length of this object in octets may be different from the number of characters encoded. Similarly, size constraints refer to the number of encoded octets, not the number of characters represented by an encoding. Note that when this TC is used for an object that is used or envisioned to be used as an index, then a SIZE restriction MUST be specified so that the number of sub-identifiers for any object instance does not exceed the limit of 128, as defined by [RFC3416]. Note that the size of an SnmpAdminString object is measured in octets, not characters. SIZE (0..255) · OCTET STRING · hint 255t

Indicates the name of the authenticated user for the authentication session.

SnmpAdminStringAn octet string containing administrative information, preferably in human-readable form. To facilitate internationalization, this information is represented using the ISO/IEC IS 10646-1 character set, encoded as an octet string using the UTF-8 transformation format described in [RFC2279]. Since additional code points are added by amendments to the 10646 standard from time to time, implementations must be prepared to encounter any code point from 0x00000000 to 0x7fffffff. Byte sequences that do not correspond to the valid UTF-8 encoding of a code point or are outside this range are prohibited. The use of control codes should be avoided. When it is necessary to represent a newline, the control code sequence CR LF should be used. The use of leading or trailing white space should be avoided. For code points not directly supported by user interface hardware or software, an alternative means of entry and display, such as hexadecimal, may be provided. For information encoded in 7-bit US-ASCII, the UTF-8 encoding is identical to the US-ASCII encoding. UTF-8 may require multiple bytes to represent a single character / code point; thus the length of this object in octets may be different from the number of characters encoded. Similarly, size constraints refer to the number of encoded octets, not the number of characters represented by an encoding. Note that when this TC is used for an object that is used or envisioned to be used as an index, then a SIZE restriction MUST be specified so that the number of sub-identifiers for any object instance does not exceed the limit of 128, as defined by [RFC3416]. Note that the size of an SnmpAdminString object is measured in octets, not characters. SIZE (0..255) · OCTET STRING · hint 255t

Indicates the name of the address pool from which the session's client IP address is assigned.

SnmpAdminStringAn octet string containing administrative information, preferably in human-readable form. To facilitate internationalization, this information is represented using the ISO/IEC IS 10646-1 character set, encoded as an octet string using the UTF-8 transformation format described in [RFC2279]. Since additional code points are added by amendments to the 10646 standard from time to time, implementations must be prepared to encounter any code point from 0x00000000 to 0x7fffffff. Byte sequences that do not correspond to the valid UTF-8 encoding of a code point or are outside this range are prohibited. The use of control codes should be avoided. When it is necessary to represent a newline, the control code sequence CR LF should be used. The use of leading or trailing white space should be avoided. For code points not directly supported by user interface hardware or software, an alternative means of entry and display, such as hexadecimal, may be provided. For information encoded in 7-bit US-ASCII, the UTF-8 encoding is identical to the US-ASCII encoding. UTF-8 may require multiple bytes to represent a single character / code point; thus the length of this object in octets may be different from the number of characters encoded. Similarly, size constraints refer to the number of encoded octets, not the number of characters represented by an encoding. Note that when this TC is used for an object that is used or envisioned to be used as an index, then a SIZE restriction MUST be specified so that the number of sub-identifiers for any object instance does not exceed the limit of 128, as defined by [RFC3416]. Note that the size of an SnmpAdminString object is measured in octets, not characters. SIZE (0..255) · OCTET STRING · hint 255t

Indicates the name of the feature which authorizes the authentication session.

Unsigned32 · seconds

Indicates the leftover time before the next authentication attempt for the authentication session after Server Reachability event occurred. Value zero indicates that this session is currently being authenticated or it is not applicable.

VlanIndexOrZeroThe VLAN ID or zero as defined for Private VLAN feature. If the value is between 1 and 4095 inclusive, it represents an IEEE 802.1Q VLAN-ID. If the value is zero, it is object-specific and must therefore be defined as part of the description of any object which uses this syntax. (0..4095) · Integer32

Indicates the authorized VLAN applied to the authentication session. Value zero indicates that no authorized VLAN has been applied, or it is not applicable.

Unsigned32 · seconds

Indicates the session timeout used by Authentication Framework in the authentication session.

Unsigned32 · seconds

Indicates the leftover time of the current authentication session.

INTEGER1 = unknown2 = terminate3 = reauthenticate · Integer32

Indicates the timeout action on the authentication session, when value of the corresponding instance of cafSessionTimeLeft reaches zero. unknown : None of the below. terminate : Session will be terminated. reauthenticate: Session will be reauthenticated.

Unsigned32 · seconds

Indicates the inactivity timeout used by Authentication Framework in the authentication session.

Unsigned32 · seconds

Indicates the leftover time of the inactivity timer of the authentication session.

TruthValue1 = true2 = falseRepresents a boolean value. · Integer32

The reauthentication control for the authentication session. Setting this object to 'true' cause the current authenticated session to reauthenticate the authenticated client. Setting this object to 'false' has no effect. This object always returns 'false' when being read.

TruthValue1 = true2 = falseRepresents a boolean value. · Integer32

The termination request control for the authentication session. Setting this object to 'true' terminates the current session. Setting this object to 'false' has no effect. This object always returns 'false' when being read.

SnmpAdminStringAn octet string containing administrative information, preferably in human-readable form. To facilitate internationalization, this information is represented using the ISO/IEC IS 10646-1 character set, encoded as an octet string using the UTF-8 transformation format described in [RFC2279]. Since additional code points are added by amendments to the 10646 standard from time to time, implementations must be prepared to encounter any code point from 0x00000000 to 0x7fffffff. Byte sequences that do not correspond to the valid UTF-8 encoding of a code point or are outside this range are prohibited. The use of control codes should be avoided. When it is necessary to represent a newline, the control code sequence CR LF should be used. The use of leading or trailing white space should be avoided. For code points not directly supported by user interface hardware or software, an alternative means of entry and display, such as hexadecimal, may be provided. For information encoded in 7-bit US-ASCII, the UTF-8 encoding is identical to the US-ASCII encoding. UTF-8 may require multiple bytes to represent a single character / code point; thus the length of this object in octets may be different from the number of characters encoded. Similarly, size constraints refer to the number of encoded octets, not the number of characters represented by an encoding. Note that when this TC is used for an object that is used or envisioned to be used as an index, then a SIZE restriction MUST be specified so that the number of sub-identifiers for any object instance does not exceed the limit of 128, as defined by [RFC3416]. Note that the size of an SnmpAdminString object is measured in octets, not characters. SIZE (0..255) · OCTET STRING · hint 255t

The name of the VLAN group that has been used during VLAN assignment for this session. A zero length string indicates that there is no VLAN group been used during VLAN assignment.

CiscoAuthMethod1 = other2 = dot1x3 = macAuthBypass4 = webAuthThe authentication methods and protocols supported in Authentication Framework. other : none of the below. dot1x : 802.1x Protocol. macAuthBypass: MAC Authentication Bypass. webAuth : Web-Proxy Authentication. 'other' is a read only value which can not be used in set operation. · Integer32

Indicates this authentication method.

INTEGER1 = notRun2 = running3 = failedOver4 = authcSuccess5 = authcFailed · Integer32

Indicates the state of this authentication method. notRun : The method has not run for this session. running : The method is running for this session. failedOver : The method has failed and the next method is expected to provide a result. authcSuccess: The method has provided a successful authentication result for this session. authcFailed : The method has provided a failed authentication result for this session.