ENTERASYS-MULTI-AUTH-MIB

EtsysMultiAuthTypes1 = ieee8021x2 = pwa3 = macAuth4 = cep5 = radiusSnooping6 = autoTracking7 = quarantineAgentThis convention enumerates the authentication types supported by Enterasys Networks' devices. · Integer32

The authentication type the entry properties pertain to.

Unsigned32 (0 | 1..65535) · seconds

Reference: RFC 2865, 'Remote Authentication Dial In User Service (RADIUS)', Section 5.27

The maximum number of seconds an authenticated session may last before termination of the session. A value of zero indicates that no session timeout will be applied. This value MAY be superseded by a session timeout value provided by the authenticating server. For example, if a session is authenticated by a RADIUS server, that server may encode a Session-Timeout Attribute in its authentication response. The operational timeout value of a given authenticated session is specified by the etsysMultiAuthSessionSessionTimeout object.

Unsigned32 (0 | 1..65535) · seconds

Reference: RFC 2865, 'Remote Authentication Dial In User Service (RADIUS)', Section 5.28

The maximum number of consecutive seconds an authenticated session may be idle before termination of the session. A value of zero indicates that no idle timeout will be applied. This value MAY be superseded by a idle timeout value provided by the authenticating server. For example, if a session is authenticated by a RADIUS server, that server may encode a Idle-Timeout Attribute in its authentication response. The operational idle timeout value of a given authenticated session is specified by the etsysMultiAuthSessionIdleTimeout object.

Gauge32

The current number of users the are actively authenticated or have authentications in progress for this authentication type in the system.

INTEGER1 = forceUnauthorized2 = forceAuthorized3 = authOptional4 = authRequired · Integer32

This object specifies the authorization mode to use for packets received on this interface. A value of forceUnauthorized(1) indicates that the interface is always unauthenticated. A value of forceAuthorized(2) indicates that users on this port will always be considered to be authenticated. A value of authOptional(3) indicates that authentication is optional on this interface. Packets received from unauthenticated users on the interface will be processed using the static configuration of the interface. Users may promote the policy applied to their traffic by actively authenticating on this interface. A value of authRequired(4) indicates that all packets received on the interface will be dropped until authentication succeeds. Some authentication types, such as PWA, will not be fully functional in this mode of operation.

Unsigned32

The maximum number of users that can be actively authenticated or have authentications in progress at one time on this interface.

Unsigned32

The user configured number of users that can be actively authenticated or have authentications in progress at one time on this interface. This object has a default value equal to the value of etsysMultiAuthPortMaxNumUsers for this interface. If the value set to this object is less than its current value, it will have the same effect as setting the etsysMultiAuthPortClearUsers object to a value of true(1).

Gauge32

The current number of users that are actively authenticated or have authentications in progress at one time on this interface. By definition this value can not exceed the value specified by etsysMultiAuthPortMaxNumUsers for the same interface.

TruthValue1 = true2 = falseRepresents a boolean value. · Integer32

Setting this object to a value of true(1) will cause all users that are currently authenticated or that have authentications in progress on this interface to become unauthenticated. This will cause any such entries with matching ifIndex values in the etsysMultiAuthSessionStationTable tables to change their authorization status to authTerminated(5). Setting this object to a value of false(2) has no effect. This object will always return a value of false(2).

BITS

This object allows for the enabling or disabling of each trap on a per interface basis. Setting a given bit to a value of 1 allows traps of that type to be sent for events on that interface. Setting a given bit to a value of 0 disallows traps of that type to be sent for events on that interface. The individual bits correlate to specific traps as follows: BIT NOTIFICATION ---------------------------------------------------------------- authSuccessTrap(0) etsysMultiAuthSuccess authFailedTrap(1) etsysMultiAuthFailed authTerminatedTrap(2) etsysMultiAuthTerminated maxNumUsersReachedTrap(3) etsysMultiAuthMaxNumUsersReached

Gauge32

The current number of users the are actively authenticated or have authentications in progress for this authentication type on the specified port.

StationAddressType0 = unknown1 = ipv42 = ipv63 = mac16 = dnsA value representing a network address that can be used to identify a station on the network. unknown(0) An unknown address type. This value MUST be used if the value of the corresponding StationAddress object is a zero-length string. It may also be used to indicate an station address which is not in one of the formats defined below. ipv4(1) An IPv4 address as defined by the InetAddressIPv4 textual convention as defined in RFC3291. ipv6(2) An IPv6 address as defined by the StationAddressIPv6 textual convention below. mac(3) An 802.3 MAC layer address, i.e. an Ethernet address, defined by the MacAddress textual convention as defined in RFC2579. dns(16) A DNS domain name as defined by the InetAddressDNS textual convention as defined in RFC3291. Each definition of a concrete StationAddressType value must be accompanied by a definition of a textual convention for use with that StationAddressType. The StationAddressType textual convention SHOULD NOT be subtyped in object type definitions to support future extensions. It MAY be subtyped in compliance statements in order to require only a subset of these address types for a compliant implementation.Reference: STD0058 (RFC2579), Textual Conventions for SMIv2. RFC3291, Textual Conventions for Internet Network Addresses. · Integer32

The type of station represented by etsysMultiAuthStationAddr.

StationAddressDenotes a generic Internet address. An StationAddress value is always interpreted within the context of an StationAddressType value. Every usage of the StationAddress textual convention is required to specify the StationAddressType object which provides the context. It is suggested that the StationAddressType object is logically registered before the object(s) which use the StationAddress textual convention if they appear in the same logical row. The value of an StationAddress object must always be consistent with the value of the associated StationAddressType object. Attempts to set an StationAddress object to a value which is inconsistent with the associated StationAddressType must fail with an inconsistentValue error. When this textual convention is used as the syntax of an index object, there may be issues with the limit of 128 sub-identifiers specified in SMIv2, STD 58. In this case, the object definition MUST include a 'SIZE' clause to limit the number of potential instance sub-identifiers. SIZE (0..255) · OCTET STRING

The station address for the authenticated user.

TruthValue1 = true2 = falseRepresents a boolean value. · Integer32

Setting this object to a value of true(1) will cause any users with the specified station address that are currently authenticated or that have authentications in progress to become unauthenticated. This will cause any entries with matching etsysMultiAuthStationAddr values in the etsysMultiAuthSessionStationTable tables to change their authorization status to authTerminated(5). Setting this object to a value of false(2) has no effect. This object will always return a value of false(2).

EtsysMultiAuthTypes1 = ieee8021x2 = pwa3 = macAuth4 = cep5 = radiusSnooping6 = autoTracking7 = quarantineAgentThis convention enumerates the authentication types supported by Enterasys Networks' devices. · Integer32

The type of authentication agent for this session.

EtsysMultiAuthStatus1 = authSuccess2 = authFailed3 = authInProgress4 = authServerTimeout5 = authTerminatedThe status of authentication for this session. A value of authSuccess(1) means authentication was attempted and succeeded. A value of authFailed(2) means authentication was attempted and failed for a reason other than communication timing out with the authorization server. A value of authInProgress(3) means that the authorization process has been started but has not completed yet. A value of authServerTimeout(4) means that the request to the authorization server for this session timed out without a reply from the server. A value of authTerminated(5) indicates that the session was active or in progress and was subsequently terminated. A session may be terminated for several reasons, including but not limited to, session timeout, idle timeout, the ifOperStatus of the interface on which the session was authenticated transitioning out of the up(1) state, or explicit administrative management action. · Integer32

The status of authentication for this session.

TimeStampThe value of the sysUpTime object at which a specific occurrence happened. The specific occurrence must be defined in the description of any object defined using this type. If sysUpTime is reset to zero as a result of a re- initialization of the network management (sub)system, then the values of all TimeStamp objects are also reset. However, after approximately 497 days without a re- initialization, the sysUpTime object will reach 2^^32-1 and then increment around to zero; in this case, existing values of TimeStamp objects do not change. This can lead to ambiguities in the value of TimeStamp objects. · TimeTicks

The value of sysUpTime when this session last attempted authorization. For entries that have a value of authInProgress(3) for etsysMultiAuthSessionStationAuthStatus this object MAY return a value of zero.

INTEGER1 = radius2 = local · Integer32

The type of authentication server used to authenticate this session. A value of radius(1) indicates that a RADIUS request and response were attempted in order to authenticate the session. A value of local(2) indicates that the session was authenticated by a local file or configuration on the device itself.

InetAddressType0 = unknown1 = ipv42 = ipv63 = ipv4z4 = ipv6z16 = dnsA value that represents a type of Internet address. unknown(0) An unknown address type. This value MUST be used if the value of the corresponding InetAddress object is a zero-length string. It may also be used to indicate an IP address that is not in one of the formats defined below. ipv4(1) An IPv4 address as defined by the InetAddressIPv4 textual convention. ipv6(2) An IPv6 address as defined by the InetAddressIPv6 textual convention. ipv4z(3) A non-global IPv4 address including a zone index as defined by the InetAddressIPv4z textual convention. ipv6z(4) A non-global IPv6 address including a zone index as defined by the InetAddressIPv6z textual convention. dns(16) A DNS domain name as defined by the InetAddressDNS textual convention. Each definition of a concrete InetAddressType value must be accompanied by a definition of a textual convention for use with that InetAddressType. To support future extensions, the InetAddressType textual convention SHOULD NOT be sub-typed in object type definitions. It MAY be sub-typed in compliance statements in order to require only a subset of these address types for a compliant implementation. Implementations must ensure that InetAddressType objects and any dependent objects (e.g., InetAddress objects) are consistent. An inconsistentValue error must be generated if an attempt to change an InetAddressType object would, for example, lead to an undefined InetAddress value. In particular, InetAddressType/InetAddress pairs must be changed together if the address type changes (e.g., from ipv6(2) to ipv4(1)). · Integer32

The type of data returned by etsysMultiAuthSessionAuthServerAddr. If the etsysMultiAuthSessionAuthServerType leaf for this entry has a value of local(2) then this object MUST return a a value of unknown(0).

InetAddressDenotes a generic Internet address. An InetAddress value is always interpreted within the context of an InetAddressType value. Every usage of the InetAddress textual convention is required to specify the InetAddressType object that provides the context. It is suggested that the InetAddressType object be logically registered before the object(s) that use the InetAddress textual convention, if they appear in the same logical row. The value of an InetAddress object must always be consistent with the value of the associated InetAddressType object. Attempts to set an InetAddress object to a value inconsistent with the associated InetAddressType must fail with an inconsistentValue error. When this textual convention is used as the syntax of an index object, there may be issues with the limit of 128 sub-identifiers specified in SMIv2, STD 58. In this case, the object definition MUST include a 'SIZE' clause to limit the number of potential instance sub-identifiers; otherwise the applicable constraints MUST be stated in the appropriate conceptual row DESCRIPTION clauses, or in the surrounding documentation if there is no single DESCRIPTION clause that is appropriate. SIZE (0..255) · OCTET STRING

The network address of the authentication server for this session. If the etsysMultiAuthSessionAuthServerType leaf for this entry has a value of local(2) then this object MUST return a zero length string.

Integer32 (0 | 1..65535)

The Policy Profile Index returned from the authentication server for this session. The value of zero indicates that no policy will be applied for this session. If the etsysMultiAuthSessionStationAuthStatus object returns a value of authSuccess(1), then a value of zero is the result of the policy not being configured on the authorization server. For all other values of etsysMultiAuthSessionStationAuthStatus a value of zero for this object is the result of authorization not succeeding or not having completed. All values other than zero are valid Policy Profile Indexes that specify the policy profile the user will receive on this interface. If a given user has been authenticated by multiple authentication types on the same interface the policy that is applied to the user's packets is determined by the precedence of the agents as specified by etsysMultiAuthSystemOperPrecedence. These indexes are suitable for indexing in the ENTERASYS-POLICY-PROFILE-MIB.

TruthValue1 = true2 = falseRepresents a boolean value. · Integer32

This object indicates whether this entry and the policy index contained within it are actively being applied to traffic matching the interface and station address of this entry. A value of true(1) indicates that this entry is being applied. A value of false(2) indicates that the entry is not being applied. Only one authentication type per interface station address ordered pair may be applied at a single time. The operational precedence of the various authentication types determines which if any type will be applied.

DateAndTimeA date-time specification. field octets contents range ----- ------ -------- ----- 1 1-2 year* 0..65536 2 3 month 1..12 3 4 day 1..31 4 5 hour 0..23 5 6 minutes 0..59 6 7 seconds 0..60 (use 60 for leap-second) 7 8 deci-seconds 0..9 8 9 direction from UTC '+' / '-' 9 10 hours from UTC* 0..13 10 11 minutes from UTC 0..59 * Notes: - the value of year is in network-byte order - daylight saving time in New Zealand is +13 For example, Tuesday May 26, 1992 at 1:30:15 PM EDT would be displayed as: 1992-5-26,13:30:15.0,-4:0 Note that if only local time is known, then timezone information (fields 8-10) is not present. SIZE (8) · OCTET STRING · hint 2d-1d-1d,1d:1d:1d.1d,1a1d:1d

The local date and time that the session was terminated. If the session is not in the authTerminated(5) state this object MUST return '00000000'H.

Unsigned32 (0 | 1..65535) · seconds

The maximum number of seconds this session may last before automatic termination. A value of zero indicates that no session timeout will be applied. This value MAY be provided by the etsysMultiAuthSessionTimeout object or by the authenticating server.

Unsigned32 (0 | 1..65535) · seconds

The maximum number of consecutive seconds this session may be idle before automatic termination. A value of zero indicates that no idle timeout will be applied. This value MAY be provided by the etsysMultiAuthIdleTimeout object or by the authenticating server.

Gauge32 · seconds

The length of this session in seconds. This object MAY return zero for a session in any state other than authSuccess(1).

Gauge32 · seconds

The number of consecutive seconds this session has been idle. This object MAY return zero for a session in any state other than authSuccess(1).

Integer32 (0 | 1..4094 | 4095)

Reference: RFC 3580, 'IEEE 802.1X Remote Authentication Dial In User Service (RADIUS) Usage Guidelines', Section 3.31

The VLAN Tunnel Attribute (Tunnel-Group-ID) returned from the authentication server for this session. This value is interpreted as the 12 bit VLAN identifier to be applied to traffic from the session entity. Policy VLAN classification rules have precedence in assigning VLAN, however, in the absence of any applicable rules, this VLAN will be used. If the traffic is already tagged, this VLAN will only be applied if TCI overwrite has been enabled (through Policy or ctDot1qPortReplaceTCI). A value of zero indicates that there is no authenticated VLAN ID for the given session (none was provided by the authentication server). Should a session become unauthenticated this value MUST return zero. A value of 4095 indicates that a the session has been authenticated, but that the VLAN returned could not be applied to the port (possibly because of resource constraints or misconfiguration). The traffic from the session entity will be assigned VLAN through Policy or standard 802.1Q mechanisms.

TruthValue1 = true2 = falseRepresents a boolean value. · Integer32

Setting this object to a value of true(1) will cause the specified table entry with the specified station address, ifIndex and agent type that are currently authenticated or that have authentications in progress to become unauthenticated and their authorization status changes to authTerminated(5). Setting this object to a value of false(2) has no effect. This object will always return a value of false(2).

EtsysMultiAuthStatus1 = authSuccess2 = authFailed3 = authInProgress4 = authServerTimeout5 = authTerminatedThe status of authentication for this session. A value of authSuccess(1) means authentication was attempted and succeeded. A value of authFailed(2) means authentication was attempted and failed for a reason other than communication timing out with the authorization server. A value of authInProgress(3) means that the authorization process has been started but has not completed yet. A value of authServerTimeout(4) means that the request to the authorization server for this session timed out without a reply from the server. A value of authTerminated(5) indicates that the session was active or in progress and was subsequently terminated. A session may be terminated for several reasons, including but not limited to, session timeout, idle timeout, the ifOperStatus of the interface on which the session was authenticated transitioning out of the up(1) state, or explicit administrative management action. · Integer32

The status of authentication for this session.

Unsigned32

The maximum number of users that can be actively authenticated or have authentications in progress at one time on the specified module.

Gauge32

The current number of users that are actively authenticated or have authentications in progress at one time on the specified module. By definition this value can not exceed the value specified by etsysMultiAuthModuleMaxNumUsers for the same module.

Counter64 (0..18446744073709551615)

The number of bytes of user data received on this interface.

Counter64 (0..18446744073709551615)

The number of packets of user data received on this interface.

Counter64 (0..18446744073709551615)

The number of bytes of user data transmitted on this interface.

Counter64 (0..18446744073709551615)

The number of packets of user data transmitted on this interface.