RADIUS Authentication Server MIB
obsoleted by
- rfc-4669 — RADIUS Authentication Server MIB for IPv6
Extracted elements (23)
Accounting relationships among counters are embedded as MIB comments: Responses = Accepts + Rejects + Challenges; Pending = Requests - DupRequests - BadAuthenticators - MalformedRequests - UnknownTypes - PacketsDropped - Responses. These invariants guide implementors in cross-checking counter consistency.
The MIB is defined in SMIv2 but can be translated to SMIv1; the translation is semantically equivalent except for objects using Counter64, which cannot be represented in SMIv1 and must be omitted.
A RADIUS proxy acting as both client and server is expected to implement both the RADIUS authentication client MIB (RFC 2618) and this server MIB simultaneously to fully instrument its behavior.
Implementations compliant with this MIB MUST support all objects in the radiusAuthServMIBGroup as mandatory-group conformance. The only settable value for radiusAuthServConfigReset is reset(2).
Per-client counters in radiusAuthClientEntry mirror the server-global totals but scoped to a single client: AccessRequests, DupAccessRequests, AccessAccepts, AccessRejects, AccessChallenges, MalformedAccessRequests, BadAuthenticators, PacketsDropped, and UnknownTypes.
radiusAuthClientAddress (IpAddress, read-only) and radiusAuthClientID (SnmpAdminString, read-only) identify each client by NAS-IP-Address and NAS-Identifier respectively; the ID is not necessarily the same as sysName in MIB-II.
radiusAuthClientTable is a conceptual table indexed by radiusAuthClientIndex (Integer32 1..2147483647), with one row per RADIUS authentication client sharing a secret with the server. Each entry includes client address, ID, and per-client counters.
radiusAuthServIdent (SnmpAdminString, read-only) holds the implementation identification string for the RADIUS authentication server software, e.g., 'FNS-2.1'.
radiusAuthServMIB is the MODULE-IDENTITY for entities implementing the server side of RADIUS authentication. It is assigned OID { radiusAuthentication 1 } under mib-2 67.
radiusAuthServResetTime (TimeTicks, read-only) records time elapsed since the server was last reset; returns zero if the server has no persistent state or does not support reset.
radiusAuthServTotalAccessAccepts, radiusAuthServTotalAccessRejects, and radiusAuthServTotalAccessChallenges (Counter32, read-only) count the respective RADIUS response packet types sent by the server.
radiusAuthServTotalAccessRequests (Counter32, read-only) counts total packets received on the authentication port across all clients.
radiusAuthServTotalBadAuthenticators (Counter32, read-only) counts Authentication-Request packets containing invalid Signature attributes received by the server.
radiusAuthServTotalDupAccessRequests (Counter32, read-only) counts duplicate RADIUS Access-Request packets received by the server.
radiusAuthServTotalInvalidRequests (Counter32, read-only) counts RADIUS Access-Request packets received from unknown (unauthenticated) addresses.
radiusAuthServTotalMalformedAccessRequests (Counter32, read-only) counts malformed Access-Request packets received; bad authenticators and unknown types are explicitly excluded from this count.
radiusAuthServTotalPacketsDropped (Counter32, read-only) counts incoming packets silently discarded for reasons other than malformed content, bad authenticators, or unknown types.
radiusAuthServTotalUnknownTypes (Counter32, read-only) counts RADIUS packets of unknown type received by the server.
radiusAuthServUpTime (TimeTicks, read-only) records time elapsed in hundredths of a second since the server process started; returns zero for stateless implementations.
radiusAuthClientAddress and radiusAuthClientID expose information that could be used to impersonate RADIUS clients; GET access to these objects should be controlled and their values should possibly be encrypted in transit via SNMP.
Read-write objects (notably radiusAuthServConfigReset) are sensitive in non-secure environments; unauthorized SET operations could disrupt RADIUS server operation by forcing reinitialization.
SNMPv1 alone is not a secure environment; the document recommends using SNMPv3 with the User-based Security Model (RFC 2574) and View-based Access Control Model (RFC 2575) to restrict GET/SET access to authorized principals.
radiusAuthServConfigReset (INTEGER, read-write) controls server reinitialization. Writing reset(2) triggers reinitialization. Readable states are other(1), initializing(3), and running(4); reset(2) is never returned on read.