ENTERASYS-PWA-MIB

EnabledStatus1 = enabled2 = disabledA simple status value for the object. · Integer32

Reference: Port Web Authentication Architectural Specification

The administrative enable/disable state for Port Web Authentication Control in a System. Enabling this object turns on the PWA system.

DisplayStringRepresents textual information taken from the NVT ASCII character set, as defined in pages 4, 10-11 of RFC 854. To summarize RFC 854, the NVT ASCII repertoire specifies: - the use of character codes 0-127 (decimal) - the graphics characters (32-126) are interpreted as US ASCII - NUL, LF, CR, BEL, BS, HT, VT and FF have the special meanings specified in RFC 854 - the other 25 codes have no standard interpretation - the sequence 'CR LF' means newline - the sequence 'CR NUL' means carriage-return - an 'LF' not preceded by a 'CR' means moving to the same column on the next line. - the sequence 'CR x' for any x other than LF or NUL is illegal. (Note that this also means that a string may end with either 'CR LF' or 'CR NUL', but not with CR.) Any object defined using this syntax may not exceed 255 characters in length. SIZE (0..32) · OCTET STRING · hint 255a

This is the hostname part the Uniform Resource Locator (URL). This object is a DNS/WINS name and is considered to be bound to the etsysPwaSystemAuthIPAddress. This object must not contain the protocol portion of the URL nor any directory or filenames. Changing this objects value changes the default name of the http server located at the local switch. An administrator can change this objects value to whatever name is appropriate for their network.

SnmpAdminStringAn octet string containing administrative information, preferably in human-readable form. To facilitate internationalization, this information is represented using the ISO/IEC IS 10646-1 character set, encoded as an octet string using the UTF-8 transformation format described in [RFC2279]. Since additional code points are added by amendments to the 10646 standard from time to time, implementations must be prepared to encounter any code point from 0x00000000 to 0x7fffffff. Byte sequences that do not correspond to the valid UTF-8 encoding of a code point or are outside this range are prohibited. The use of control codes should be avoided. When it is necessary to represent a newline, the control code sequence CR LF should be used. The use of leading or trailing white space should be avoided. For code points not directly supported by user interface hardware or software, an alternative means of entry and display, such as hexadecimal, may be provided. For information encoded in 7-bit US-ASCII, the UTF-8 encoding is identical to the US-ASCII encoding. UTF-8 may require multiple bytes to represent a single character / code point; thus the length of this object in octets may be different from the number of characters encoded. Similarly, size constraints refer to the number of encoded octets, not the number of characters represented by an encoding. Note that when this TC is used for an object that is used or envisioned to be used as an index, then a SIZE restriction MUST be specified so that the number of sub-identifiers for any object instance does not exceed the limit of 128, as defined by [RFC3416]. Note that the size of an SnmpAdminString object is measured in octets, not characters. SIZE (0..255) · OCTET STRING · hint 255t

The banner that will be displayed on the web login page of the Port Web Authentication Control in a System. This banner is a courtesy introduction to the network, which the user sees on the login page.

EnabledStatus1 = enabled2 = disabledA simple status value for the object. · Integer32

The enable state of the name services application. Enabling this object turns on the Domain Name Service (DNS) and the Windows Internet Naming Services (WINS) clients. These clients will resolve only requests for the etsysPwaSystemAuthHostName. Disabling this object would require users in the network to know and use the etsysPwaSystemAuthIPAddress of this system.

InetAddressType0 = unknown1 = ipv42 = ipv63 = ipv4z4 = ipv6z16 = dnsA value that represents a type of Internet address. unknown(0) An unknown address type. This value MUST be used if the value of the corresponding InetAddress object is a zero-length string. It may also be used to indicate an IP address that is not in one of the formats defined below. ipv4(1) An IPv4 address as defined by the InetAddressIPv4 textual convention. ipv6(2) An IPv6 address as defined by the InetAddressIPv6 textual convention. ipv4z(3) A non-global IPv4 address including a zone index as defined by the InetAddressIPv4z textual convention. ipv6z(4) A non-global IPv6 address including a zone index as defined by the InetAddressIPv6z textual convention. dns(16) A DNS domain name as defined by the InetAddressDNS textual convention. Each definition of a concrete InetAddressType value must be accompanied by a definition of a textual convention for use with that InetAddressType. To support future extensions, the InetAddressType textual convention SHOULD NOT be sub-typed in object type definitions. It MAY be sub-typed in compliance statements in order to require only a subset of these address types for a compliant implementation. Implementations must ensure that InetAddressType objects and any dependent objects (e.g., InetAddress objects) are consistent. An inconsistentValue error must be generated if an attempt to change an InetAddressType object would, for example, lead to an undefined InetAddress value. In particular, InetAddressType/InetAddress pairs must be changed together if the address type changes (e.g., from ipv6(2) to ipv4(1)). · Integer32

This object has been deprecated. Refer to etsysPwaSystemAuthIPAddress for the reason. The textual convention for InetAddressType states that this object must be registered immediately before the InetAddress that it defines. etsysPwaSystemAuthInetAddressType MUST be used for all future implementations of this MIB.

IpAddress SIZE (4)

This object has been deprecated due to an incorrect initial implementation of this MIB. This object was originally an InetAddress but some versions of the E7 firmware implemented it as an IpAddress. The syntax of this object was changed to allow management of the existing products. The etsysPwaSystemAuthInetAddress object MUST be used for all future implementations of this MIB.

INTEGER1 = chap2 = pap · Integer32

The authentication protocol used for this switch module. When set to a chap(1), the authentication scheme used will be the 'PPP Challenge Handshake Authentication Protocol (CHAP)', when set to a pap(2), the scheme will be 'Password Authentication Protocol (PAP)'. When using the CHAP protocol, the username and password utilize the CHAP protocol method of encryption to encrypt the users password in the http transmission of the submitted form on the segment between the end-station and the switch port. The PAP protocol is less secure than CHAP and does not provide any encryption on the segment between the end-station the switch port. The username and password go over this segment in the http transmission of the submitted form in plain text format.

SnmpAdminStringAn octet string containing administrative information, preferably in human-readable form. To facilitate internationalization, this information is represented using the ISO/IEC IS 10646-1 character set, encoded as an octet string using the UTF-8 transformation format described in [RFC2279]. Since additional code points are added by amendments to the 10646 standard from time to time, implementations must be prepared to encounter any code point from 0x00000000 to 0x7fffffff. Byte sequences that do not correspond to the valid UTF-8 encoding of a code point or are outside this range are prohibited. The use of control codes should be avoided. When it is necessary to represent a newline, the control code sequence CR LF should be used. The use of leading or trailing white space should be avoided. For code points not directly supported by user interface hardware or software, an alternative means of entry and display, such as hexadecimal, may be provided. For information encoded in 7-bit US-ASCII, the UTF-8 encoding is identical to the US-ASCII encoding. UTF-8 may require multiple bytes to represent a single character / code point; thus the length of this object in octets may be different from the number of characters encoded. Similarly, size constraints refer to the number of encoded octets, not the number of characters represented by an encoding. Note that when this TC is used for an object that is used or envisioned to be used as an index, then a SIZE restriction MUST be specified so that the number of sub-identifiers for any object instance does not exceed the limit of 128, as defined by [RFC3416]. Note that the size of an SnmpAdminString object is measured in octets, not characters. SIZE (0..255) · OCTET STRING · hint 255t

The domain name for which this module resides in.

InetAddressType0 = unknown1 = ipv42 = ipv63 = ipv4z4 = ipv6z16 = dnsA value that represents a type of Internet address. unknown(0) An unknown address type. This value MUST be used if the value of the corresponding InetAddress object is a zero-length string. It may also be used to indicate an IP address that is not in one of the formats defined below. ipv4(1) An IPv4 address as defined by the InetAddressIPv4 textual convention. ipv6(2) An IPv6 address as defined by the InetAddressIPv6 textual convention. ipv4z(3) A non-global IPv4 address including a zone index as defined by the InetAddressIPv4z textual convention. ipv6z(4) A non-global IPv6 address including a zone index as defined by the InetAddressIPv6z textual convention. dns(16) A DNS domain name as defined by the InetAddressDNS textual convention. Each definition of a concrete InetAddressType value must be accompanied by a definition of a textual convention for use with that InetAddressType. To support future extensions, the InetAddressType textual convention SHOULD NOT be sub-typed in object type definitions. It MAY be sub-typed in compliance statements in order to require only a subset of these address types for a compliant implementation. Implementations must ensure that InetAddressType objects and any dependent objects (e.g., InetAddress objects) are consistent. An inconsistentValue error must be generated if an attempt to change an InetAddressType object would, for example, lead to an undefined InetAddress value. In particular, InetAddressType/InetAddress pairs must be changed together if the address type changes (e.g., from ipv6(2) to ipv4(1)). · Integer32

A value that represents a type of etsysPwaSystemAuthInetAddress. unknown(0) An unknown address type. This value MUST be used if the value of the corresponding InetAddress object is a zero-length string. It may also be used to indicate an IP address which is not in one of the formats defined below. ipv4(1) An IPv4 address as defined by the InetAddressIPv4 textual convention. ipv6(2) An IPv6 address as defined by the InetAddressIPv6 textual convention.

InetAddressDenotes a generic Internet address. An InetAddress value is always interpreted within the context of an InetAddressType value. Every usage of the InetAddress textual convention is required to specify the InetAddressType object that provides the context. It is suggested that the InetAddressType object be logically registered before the object(s) that use the InetAddress textual convention, if they appear in the same logical row. The value of an InetAddress object must always be consistent with the value of the associated InetAddressType object. Attempts to set an InetAddress object to a value inconsistent with the associated InetAddressType must fail with an inconsistentValue error. When this textual convention is used as the syntax of an index object, there may be issues with the limit of 128 sub-identifiers specified in SMIv2, STD 58. In this case, the object definition MUST include a 'SIZE' clause to limit the number of potential instance sub-identifiers; otherwise the applicable constraints MUST be stated in the appropriate conceptual row DESCRIPTION clauses, or in the surrounding documentation if there is no single DESCRIPTION clause that is appropriate. SIZE (0..255) · OCTET STRING

The IP address bound to the etsysPwaSystemAuthHostName. The format of this object is defined in the etsysPwaSystemAuthInetAddressType object. This address MUST be supplied for authentication to work. This is a globally unique address and must be the same value configured into every authenticating switch in the domain. Each switch terminates any IP traffic destined to this etsysPwaSystemAuthInetAddress. If the port is in either promiscousAuto(4) or auto(2) mode, described in the etsysPwaControlledPortControl object, then the local switch in question responds to http requests with a login page. If the port is in any other mode, then all traffic destined for etsysPwaSystemAuthInetAddress is discarded. Please note that neither the etsysPwaSystemAuthHostName object nor this object refer to any specific machine in the network. These objects are always relative to the connection between an end station and a switch. Traffic destined for this IP is never seen over interswitch links.

EnabledStatus1 = enabled2 = disabledA simple status value for the object. · Integer32

The enable state of the PWA enhanced mode. When this feature is enabled users on unauthenticated ports will be presented the login page on their initial web access. The etsysPwaControlledPortControl object MUST be set to auto(2) for this feature to function correctly. If etsysPwaControlledPortControl is not set to auto(2), or if this feature is disabled, users must enter the value of etsysPwaSystemAuthHostName in order to get the login page.

EnabledStatus1 = enabled2 = disabledA simple status value for the object. · Integer32

When this object is set to enabled, the secureharbour logo will be displayed on the PWA login web pages. When it is set to disabled, the logo will not be displayed.

DisplayStringRepresents textual information taken from the NVT ASCII character set, as defined in pages 4, 10-11 of RFC 854. To summarize RFC 854, the NVT ASCII repertoire specifies: - the use of character codes 0-127 (decimal) - the graphics characters (32-126) are interpreted as US ASCII - NUL, LF, CR, BEL, BS, HT, VT and FF have the special meanings specified in RFC 854 - the other 25 codes have no standard interpretation - the sequence 'CR LF' means newline - the sequence 'CR NUL' means carriage-return - an 'LF' not preceded by a 'CR' means moving to the same column on the next line. - the sequence 'CR x' for any x other than LF or NUL is illegal. (Note that this also means that a string may end with either 'CR LF' or 'CR NUL', but not with CR.) Any object defined using this syntax may not exceed 255 characters in length. SIZE (0..32) · OCTET STRING · hint 255a

The username that the Guest Networking feature will use to authenticate users that do not override this value in the login page.

DisplayStringRepresents textual information taken from the NVT ASCII character set, as defined in pages 4, 10-11 of RFC 854. To summarize RFC 854, the NVT ASCII repertoire specifies: - the use of character codes 0-127 (decimal) - the graphics characters (32-126) are interpreted as US ASCII - NUL, LF, CR, BEL, BS, HT, VT and FF have the special meanings specified in RFC 854 - the other 25 codes have no standard interpretation - the sequence 'CR LF' means newline - the sequence 'CR NUL' means carriage-return - an 'LF' not preceded by a 'CR' means moving to the same column on the next line. - the sequence 'CR x' for any x other than LF or NUL is illegal. (Note that this also means that a string may end with either 'CR LF' or 'CR NUL', but not with CR.) Any object defined using this syntax may not exceed 255 characters in length. SIZE (0..32) · OCTET STRING · hint 255a

The password that the Guest Networking feature will use to authenticate users that do not override the guest username. On a read this object will always return an empty string.

TruthValue1 = true2 = falseRepresents a boolean value. · Integer32

true(1) - indicates that etsysPwaGuestPassword was last set with some value other than the empty string. false(2) - indicates that etsysPwaGuestPassword has never been set, or was last set to the empty string.

INTEGER1 = disabled2 = authNone3 = authRadius · Integer32

Guest Networking is a feature that allows a user to get default policy access to the network without having to know a username or password. When this feature is not disabled(1), the username on the login page will be populated with the value from the object etsysPwaGuestUsername and the password will be mask out with asterisks. The password in the login page should never be populated with the value from etsysPwaGuestPassword. When Guest Networking is enabled, and a user submits a request for authentication, and the username is the same as the value from etsysPwaGuestUsername, PWA will use the value from etsysPwaGuestPassword as the password for authentication. When this object is set to disabled(1), Guest Networking will be unavailable. When set to authNone(2) Guest Networking will be enabled and it will not authenticate the guest user using any authentication method. Once the user submits the login page with the username that matches the value from etsysPwaGuestUsername, the default policy of that port will become the active policy. When set to authRadius(3) Guest Networking will be enabled and it will authenticate the guest user using RADIUS authentication Upon a successful authentication from RADIUS, this port will apply the policy returned from RADIUS to that port.

Integer32 (0..120) · seconds

This is the value that is displayed on the PWA login success page as the redirect time. If a user, using PWA enhanced mode, enters a URL of 'http://enterasys.com' prior to being presented with the PWA login page and then successfully authenticates into the network they would be presented with a login success page that displays 'Welcome to the Network. Completing network connections. You will be redirected to http://enterasys.com in approximately 30 seconds'. An end-station that is utilizing the Dynamic Host Configuration Protocol (DHCP) as a means of obtaining an IP address will take some time to transition from the temporary IP address issued by PWA, as part of the authentication process, to the official IP address issued by the network. etsysPwaSystemEnhancedModeRefreshTime provides a configurable time period for the end-stations on a given switch to complete the process of obtaining their official IP addresses and to begin using them. The default value of 30 seconds has been shown to be adequate in most environments. In some networks this time period may need to be longer, and in other networks it could be shorter. In networks that only use static IP addresses a time period on the order of 5 to 10 seconds may be sufficient. A period of less than 5 seconds is not recommended as there is a slight delay after a successful login before the switch transitions the port to forwarding.

EnabledStatus1 = enabled2 = disabledA simple status value for the object. · Integer32

When enabled(1), RADIUS accounting start, interim and stop frames are sent to the configured RADIUS server(s). When disabled(2), accounting packets are not sent to the RADIUS server.