CISCO-LWAPP-AAA-MIB
AI MIB Summary
The CISCO-LWAPP-AAA-MIB provides management access to Authentication, Authorization, and Accounting (AAA) parameters on Cisco Central Controllers terminating LWAPP tunnels from lightweight access points. It enables monitoring of TACACS and RADIUS session states, authentication methods (PAP, CHAP, MD5-CHAP), and Local Significant Certificate (LSC) configurations required for securing the controller-to-AP control plane.
This MIB is intended to be implemented on all those devices operating as Central Controllers (CC), that terminate the Light Weight Access Point Protocol tunnel from Cisco Light-weight LWAPP Access Points.
Information provided by this MIB is used to manage AAA information on the controller.
The relationship between CC and the LWAPP APs can be depicted as follows:
+......+ +......+ +......+
+ + + + + +
+ CC + + CC + + CC +
+ + + + + +
+......+ +......+ +......+
.. . . .. . . . . . . . . . . . . . . . . . .
+......+ +......+ +......+ +......+
+ + + + + + + +
+ AP + + AP + + AP + + AP +
+ + + + + + + +
+......+ +......+ +......+ +......+
. . . . . . . . . . . . . . . . . . .
+......+ +......+ +......+ +......+
+ + + + + + + +
+ MN + + MN + + MN + + MN +
+ + + + + + + +
+......+ +......+ +......+ +......+
The LWAPP tunnel exists between the controller and the APs. The MNs communicate with the APs through the protocol defined by the 802.11 standard.
LWAPP APs, upon bootup, discover and join one of the controllers and the controller pushes the configuration, that includes the WLAN parameters, to the LWAPP APs. The APs then encapsulate all the 802.11 frames from wireless clients inside LWAPP frames and forward the LWAPP frames to the controller.
GLOSSARY
Access Point ( AP )
An entity that contains an 802.11 medium access control ( MAC ) and physical layer ( PHY ) interface and provides access to the distribution services via the wireless medium for associated clients.
LWAPP APs encapsulate all the 802.11 frames in LWAPP frames and sends them to the controller to which it is logically connected.
Light Weight Access Point Protocol ( LWAPP )
This is a generic protocol that defines the communication between the Access Points and the Central Controller.
Mobile Node ( MN )
A roaming 802.11 wireless device in a wireless network associated with an access point. Mobile Node and client are used interchangeably.
Terminal Access Controller Access-Control System ( TACACS )
A remote authentication protocol that is used to communicate with an authentication server. TACACS allows a remote access server to communicate with an authentication server in order to determine if the user has access to the network.
Remote Authentication Dial In User Service (RADIUS)
It is an AAA (authentication, authorization and accounting) protocol for applications such as network access or IP mobility. It is intended to work in both local and roaming situations.
Wireless LAN ( WLAN )
It is a wireless local area network, which is the linking of two or more computers without using wires. It uses radio communication to accomplish the same functionality of a wired LAN.
PAP - Password Authentication Protocol CHAP - Challenge Handshake Authentication Protocol MD5-CHAP - Message Digest 5 Challenge Handshake Authentication Protocol
LSC - Local Significant Certificate
LSC can be used if we want our own public key infrastructure (PKI) to provide better security, to have control of our certificate authority (CA), and to define policies, restrictions, and usages on the generated certificates.
REFERENCE
[1] Wireless LAN Medium Access Control ( MAC ) and Physical Layer ( PHY ) Specifications
[2] Draft-obara-capwap-lwapp-00.txt, IETF Light Weight Access Point Protocol
Main OID:
ciscoLwappAAAMIB.1.3.6.1.4.1.9.9.598
59
Objects
Active
Status
8
Dependencies
Imported Objects
Objects
59 total| Object Name |
|---|
ciscoLwappAAAMIBThis MIB is intended to be implemented on all those
devices operating as Central Controllers (CC), that
terminate the Light Weight Access Point Protocol
tunnel from Cisco Light-weight LWAPP Access Points.
Information provided by this MIB is used to manage
AAA information on the controller.
The relationship between CC and the LWAPP APs
can be depicted as follows:
+......+ +......+ +......+
+ + + + + +
+ CC + + CC + + CC +
+ + + + + +
+......+ +......+ +......+
.. . .
.. . .
. . . .
. . . .
. . . .
. . . .
+......+ +......+ +......+ +......+
+ + + + + + + +
+ AP + + AP + + AP + + AP +
+ + + + + + + +
+......+ +......+ +......+ +......+
. . .
. . . .
. . . .
. . . .
. . . .
+......+ +......+ +......+ +......+
+ + + + + + + +
+ MN + + MN + + MN + + MN +
+ + + + + + + +
+......+ +......+ +......+ +......+
The LWAPP tunnel exists between the controller and
the APs. The MNs communicate with the APs through
the protocol defined by the 802.11 standard.
LWAPP APs, upon bootup, discover and join one of the
controllers and the controller pushes the configuration,
that includes the WLAN parameters, to the LWAPP APs.
The APs then encapsulate all the 802.11 frames from
wireless clients inside LWAPP frames and forward
the LWAPP frames to the controller.
GLOSSARY
Access Point ( AP )
An entity that contains an 802.11 medium access
control ( MAC ) and physical layer ( PHY ) interface
and provides access to the distribution services via
the wireless medium for associated clients.
LWAPP APs encapsulate all the 802.11 frames in
LWAPP frames and sends them to the controller to which
it is logically connected.
Light Weight Access Point Protocol ( LWAPP )
This is a generic protocol that defines the
communication between the Access Points and the
Central Controller.
Mobile Node ( MN )
A roaming 802.11 wireless device in a wireless
network associated with an access point. Mobile Node
and client are used interchangeably.
Terminal Access Controller Access-Control System
( TACACS )
A remote authentication protocol that is used to
communicate with an authentication server.
TACACS allows a remote access server to communicate
with an authentication server in order to determine
if the user has access to the network.
Remote Authentication Dial In User Service (RADIUS)
It is an AAA (authentication, authorization and accounting)
protocol for applications such as network access or
IP mobility. It is intended to work in both local and
roaming situations.
Wireless LAN ( WLAN )
It is a wireless local area network, which is the
linking of two or more computers without using wires.
It uses radio communication to accomplish the same
functionality of a wired LAN.
PAP - Password Authentication Protocol
CHAP - Challenge Handshake Authentication Protocol
MD5-CHAP - Message Digest 5 Challenge Handshake Authentication
Protocol
LSC - Local Significant Certificate
LSC can be used if we want our own public key
infrastructure (PKI) to provide better security,
to have control of our certificate authority (CA),
and to define policies, restrictions, and usages
on the generated certificates.
REFERENCE
[1] Wireless LAN Medium Access Control ( MAC ) and
Physical Layer ( PHY ) Specifications
[2] Draft-obara-capwap-lwapp-00.txt, IETF Light
Weight Access Point Protocol MODULE-IDENTITY .1.3.6.1.4.1.9.9.598 |
ciscoLwappAAAMIBNotifs OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.598.0 |
ciscoLwappAAARadiusServerGlobalActivatedThis notification is sent by the agent when the
controller detects that the RADIUS server is
activated in the global list. The RADIUS server
is identified by the address (claRadiusAddress)
and port number (claRadiusPortNum). NOTIFICATION-TYPE .1.3.6.1.4.1.9.9.598.0.1 |
ciscoLwappAAARadiusServerGlobalDeactivatedThis notification is sent by the agent when the
controller detects that the RADIUS server is
deactivated in the global list. The RADIUS server
is identified by the address (claRadiusAddress)
and port number (claRadiusPortNum). NOTIFICATION-TYPE .1.3.6.1.4.1.9.9.598.0.2 |
ciscoLwappAAARadiusServerWlanActivatedThis notification is sent by the agent when the
controller detects that the RADIUS server is
activated on the WLAN. The RADIUS server
is identified by the address (claRadiusAddress)
and port number (claRadiusPortNum). NOTIFICATION-TYPE .1.3.6.1.4.1.9.9.598.0.3 |
ciscoLwappAAARadiusServerWlanDeactivatedThis notification is sent by the agent when the
controller detects that the RADIUS server is
deactivated on the WLAN. The RADIUS server
is identified by the address (claRadiusAddress)
and port number (claRadiusPortNum). NOTIFICATION-TYPE .1.3.6.1.4.1.9.9.598.0.4 |
ciscoLwappAAARadiusReqTimedOutThis notification is sent by the agent when the
controller detects that the RADIUS server failed
to respond to request from a client/user. The RADIUS
server is identified by the address (claRadiusAddress)
and port number (claRadiusPortNum). NOTIFICATION-TYPE .1.3.6.1.4.1.9.9.598.0.5 |
ciscoLwappAAAMIBObjects OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.598.1 |
claConfigObjects OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.598.1.1 |
claPriorityTableThis table contains entries for AAA authentication
methods configured in the controller. At startup,
all the entries in this table are set up by the central
controller. A management application can later change
the priority order using the claPriorityOrder. SEQUENCE OF ClaPriorityEntry .1.3.6.1.4.1.9.9.598.1.1.1 |
claPriorityEntryA conceptual row in claPriorityTable. There is an entry in
this table for each AAA authentication method available at the
agent, as identified by a value of claPriorityAuth. ClaPriorityEntry .1.3.6.1.4.1.9.9.598.1.1.1.1 |
claPriorityAuthThis object represents the authentication method used to
authenticate users.
local - indicates that local password is used
for authentication.
radius - indicates that RADIUS method is used for
authentication.
tacacsplus - indicates that TACACS method is used for
authentication. Enumeration .1.3.6.1.4.1.9.9.598.1.1.1.1.1 |
claPriorityOrderThis is the priority order of an authentication method to
be used in user authentication for a session. At start up,
the agent assigns the value of this object. Later this can
be changed by the management station. This object reflects
the relative priority of the authentication method denoted
by claPriorityAuth with respect to already configured
authentication methods.
The zero value indicates that the priority is not set and that
the authentication methods are applied in ascending order.
Each object must contain a unique value for claPriorityOrder
or zero. In the case when a priority is set for a value that
is already used by existing object the existing object's
claPriorityOrder with be swapped.rw Unsigned32 .1.3.6.1.4.1.9.9.598.1.1.1.1.2 |
claTacacsServerTableThis table represents the information about configuring
the Accounting, Authentication and Authorization servers.
The creation of a new row in claTacacsServerTable is
through an explicit network management action
results in creation of an entry in this table.
Similarly, deletion of a row in claTacacsServerTable
through user action causes the deletion of corresponding
row in this table. The claTacacsServerType defines the
server type being used and the claTacacsServerPriority
defines the priority the server accessed within a given
type. SEQUENCE OF ClaTacacsServerEntry .1.3.6.1.4.1.9.9.598.1.1.2 |
claTacacsServerEntryEach entry in this table provides information about
the server that is configured for AAA. Each entry is
uniquely identified by the server type and priority
that server is accessed. ClaTacacsServerEntry .1.3.6.1.4.1.9.9.598.1.1.2.1 |
claTacacsServerTypeThis attribute identifies the type of the server
being configured. Enumeration .1.3.6.1.4.1.9.9.598.1.1.2.1.1 |
claTacacsServerPriorityThe priority value for this entry. This value
determines the unique priority for this entry.
The priority value for this entry determines the
order in which the server configured in this entry
is accessed. The lower the number, the higher the
priority. For example if there are 2 entries with
priority 1 and 2 respectively, the controller will
try the server with priority 1 before it tries
the server with priority 2. Unsigned32 .1.3.6.1.4.1.9.9.598.1.1.2.1.2 |
claTacacsServerAddressTypeThis object represents the type of the network
address made available through claTacacsServerAddress.
This object must be set to a valid value before
setting the row to 'active'.rw InetAddressType (INET-ADDRESS-MIB) .1.3.6.1.4.1.9.9.598.1.1.2.1.3 |
claTacacsServerAddressThis object represents the address of the AAA server.
The type of the address stored in this object is
determined by the claTacacsServerAddressType object.
This object must be set to a valid value before
setting the row to 'active'.rw InetAddress (INET-ADDRESS-MIB) .1.3.6.1.4.1.9.9.598.1.1.2.1.4 |
claTacacsServerPortNumThe port number for this server. This object must be
set to a valid value before setting the row to
'active'.rw InetPortNumber (INET-ADDRESS-MIB) .1.3.6.1.4.1.9.9.598.1.1.2.1.5 |
claTacacsServerEnabledWhen set to true the server state is enabled,
otherwise the state is disabled.rw TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.598.1.1.2.1.6 |
claTacacsServerSecretTypeThe claTacacsServerSecret value is set based on this
type. When reading this object, the value 'default'
is always returned. This object must be set to a valid
value before setting the row to 'active'.rw CLSecKeyFormat (CISCO-LWAPP-TC-MIB) .1.3.6.1.4.1.9.9.598.1.1.2.1.7 |
claTacacsServerSecretThe key configured for this server. For get operation
this always returns a string with asterisks. This object
must be set to a valid value before setting the row to
'active'. This object can be modified when a row is in
the 'active' state.rw DisplayString (SNMPv2-TC) .1.3.6.1.4.1.9.9.598.1.1.2.1.8 |
claTacacsServerTimeoutThe number of seconds between retransmissions. This
object can be modified when a row is in the 'active'
state.rw Unsigned32 .1.3.6.1.4.1.9.9.598.1.1.2.1.9 |
claTacacsServerStorageTypeThe storage type for this conceptual row. Conceptual
rows having the value 'permanent' need not allow
write-access to any columnar objects in the row.rw StorageType (SNMPv2-TC) .1.3.6.1.4.1.9.9.598.1.1.2.1.10 |
claTacacsServerRowStatusUsed to add or delete an entry in this table.
The required parameters for this entry are
claTacacsServerAddress, claTacacsServerAddressType,
claTacacsServerPortNum, claTacacsServerSecret and
claTacacsServerSecretType should be provided.
When a row is in 'active' state, some objects
in this table can be modified as described in each
individual object's description.rw RowStatus (SNMPv2-TC) .1.3.6.1.4.1.9.9.598.1.1.2.1.11 |
claWlanTableAAA table corresponding to a WLAN. When WLAN is added a
new entry gets added to this table. The entry is removed
when the WLAN is removed. SEQUENCE OF ClaWlanEntry .1.3.6.1.4.1.9.9.598.1.1.3 |
claWlanEntryEach entry in this table provides AAA information for
a WLAN. ClaWlanEntry .1.3.6.1.4.1.9.9.598.1.1.3.1 |
claWlanAcctServerEnabledStatus to indicate whether the account server
is enabled(true) or disabled(false) for this WLAN.rw TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.598.1.1.3.1.1 |
claWlanAuthServerEnabledThis object represents the status whether the authentication
server is enabled(true) or disabled(false) for this WLAN.rw TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.598.1.1.3.1.2 |
claRadiusServerGlobalActivatedEnabledThe object to control the generation of
ciscoLwappAAARadiusServerGlobalActivated
notification.
A value of 'true' indicates that the agent generates
ciscoLwappAAARadiusServerGlobalActivated
notification.
A value of 'false' indicates that the agent doesn't
generate ciscoLwappAAARadiusServerGlobalActivated
notification.rw TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.598.1.1.4 |
claRadiusServerGlobalDeactivatedEnabledThe object to control the generation of
ciscoLwappAAARadiusServerGlobalDeactivated
notification.
A value of 'true' indicates that the agent generates
ciscoLwappAAARadiusServerGlobalDeactivated
notification.
A value of 'false' indicates that the agent doesn't
generate ciscoLwappAAARadiusServerGlobalDeactivated
notification.rw TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.598.1.1.5 |
claRadiusServerWlanActivatedEnabledThe object to control the generation of
ciscoLwappAAARadiusServerWlanActivated
notification.
A value of 'true' indicates that the agent generates
ciscoLwappAAARadiusServerWlanActivated
notification.
A value of 'false' indicates that the agent doesn't
generate ciscoLwappAAARadiusServerWlanActivated
notification.rw TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.598.1.1.6 |
claRadiusServerWlanDeactivatedEnabledThe object to control the generation of
ciscoLwappAAARadiusServerWlanDeactivated
notification.
A value of 'true' indicates that the agent generates
ciscoLwappAAARadiusServerWlanDeactivated
notification.
A value of 'false' indicates that the agent doesn't
generate ciscoLwappAAARadiusServerWlanDeactivated
notification.rw TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.598.1.1.7 |
claRadiusReqTimedOutEnabledThe object to control the generation of
ciscoLwappAAARadiusReqTimedOut notification.
A value of 'true' indicates that the agent generates
ciscoLwappAAARadiusReqTimedOut notification.
A value of 'false' indicates that the agent doesn't
generate ciscoLwappAAARadiusReqTimedOut notification.rw TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.598.1.1.8 |
claSaveUserDataThis object is used to save the guest user config to NVRAM.
Setting to the value of 'true' would save the data.
Setting to the value of 'false' would have no implications
here.rw TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.598.1.1.9 |
claWebRadiusAuthenticationThis object is used to configure the Web RADIUS Authentication
parameters on the WLC.
PAP (1) - Configure Web RADIUS Authentication in PAP mode.
CHAP (2) - Configure Web RADIUS Authentication in CHAP mode.
MD5-CHAP (3) - Configure Web RADIUS Authentication in MD5-CHAP mode.rw Enumeration .1.3.6.1.4.1.9.9.598.1.1.10 |
claRadiusFallbackModeThis object is used to configure the RADIUS Fallback Test mode
on the WLC. Following are the configurable options:
off (1) - Disables RADIUS server fallback test.
passive (2) - Sets server status based on last transaction.
active (3) - Sends probes to dead servers to test status.rw Enumeration .1.3.6.1.4.1.9.9.598.1.1.11 |
claRadiusFallbackUsernameThis object is used to configure the RADIUS Fallback Test
username to be sent in dead server probesrw SnmpAdminString (SNMP-FRAMEWORK-MIB) .1.3.6.1.4.1.9.9.598.1.1.12 |
claRadiusFallbackIntervalThis object is used to configure the probe interval (when
claRadiusFallbackMode is in active mode) or inactive time
(when claRadiusFallbackMode is in passive mode)rw TimeInterval .1.3.6.1.4.1.9.9.598.1.1.13 |
claRadiusAuthMacDelimiterThe delimiter to be used for RADIUS authentication servers.
The possible values allowed are -
no delimiter (1) - as in xxxxxxxxxxxx.
colon (2) - as in xx:xx:xx:xx:xx:xx.
hyphen (3) - as in xx-xx-xx-xx-xx-xx.
single hyphen (4) - as in xxxxxx-xxxxxx.rw Enumeration .1.3.6.1.4.1.9.9.598.1.1.14 |
claRadiusAcctMacDelimiterThe delimiter to be used for RADIUS accounting servers.
The possible values allowed are -
no delimiter (1) - as in xxxxxxxxxxxx.
colon (2) - as in xx:xx:xx:xx:xx:xx.
hyphen (3) - as in xx-xx-xx-xx-xx-xx.
single hyphen (4) - as in xxxxxx-xxxxxx.rw Enumeration .1.3.6.1.4.1.9.9.598.1.1.15 |
claAcceptMICertificateThis object specifies if controller will accept
Manufactured Installed Certificate from the
access points as part of authorization.rw TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.598.1.1.16 |
claAcceptLSCertificateThis object specifies if controller will accept
Local Significant Certificate from access points
as part of authorization.rw TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.598.1.1.17 |
claAllowAuthorizeLscApAgainstAAAThis object specifies if access points to be authorized
using a AAA RADIUS server or local database.
If this object is false, the access points would be
authorized using a local database.rw TruthValue (SNMPv2-TC) .1.3.6.1.4.1.9.9.598.1.1.18 |
claStatusObjects OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.598.1.2 |
claRadiusServerTableThis table represents the information about the
requests sent to the RADIUS servers.
When a new request gets sent to the RADIUS server
an entry gets added to this table. The agents
maintains a circular queue which automatically
gets overwritten once the queue is full. SEQUENCE OF ClaRadiusServerEntry .1.3.6.1.4.1.9.9.598.1.2.1 |
claRadiusServerEntryEach entry in this table provides information about
a request that is sent to a RADIUS server.
Each entry is uniquely identified by the
request identifier. ClaRadiusServerEntry .1.3.6.1.4.1.9.9.598.1.2.1.1 |
claRadiusReqIdThis object indicates the request identifier of the
request sent to the RADIUS server. Unsigned32 .1.3.6.1.4.1.9.9.598.1.2.1.1.1 |
claRadiusAddressTypeThis object indicates the address type for the RADIUS server.ro InetAddressType (INET-ADDRESS-MIB) .1.3.6.1.4.1.9.9.598.1.2.1.1.2 |
claRadiusAddressThis object indicates the address of the RADIUS server.ro InetAddress (INET-ADDRESS-MIB) .1.3.6.1.4.1.9.9.598.1.2.1.1.3 |
claRadiusPortNumThis object indicates the port number for the RADIUS
server.ro InetPortNumber (INET-ADDRESS-MIB) .1.3.6.1.4.1.9.9.598.1.2.1.1.4 |
claRadiusWlanIdxThis object indicates the WLAN index whether the RADIUS
server is activating and deactivating.ro Unsigned32 .1.3.6.1.4.1.9.9.598.1.2.1.1.5 |
claRadiusClientMacAddressThis object indicates the client MAC address that sent the
request identified by the claRadiusReqId.ro MacAddress (SNMPv2-TC) .1.3.6.1.4.1.9.9.598.1.2.1.1.6 |
claRadiusUserNameThis object identifies the user for whom the request
identified by the claRadiusReqId was sent.ro DisplayString (SNMPv2-TC) .1.3.6.1.4.1.9.9.598.1.2.1.1.7 |
claDBCurrentUsedEntriesThis object specifies the current database entries used.
This includes the number of users, mac filters
configured in the system.ro Gauge32 .1.3.6.1.4.1.9.9.598.1.2.2 |
ciscoLwappAAAMIBConform OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.598.2 |
ciscoLwappAAAMIBCompliances OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.598.2.1 |
ciscoLwappAAAMIBGroups OBJECT IDENTIFIER .1.3.6.1.4.1.9.9.598.2.2 |