STATUS current
DESCRIPTION
"A number uniquely identifying each RADIUS
Accounting server with which this client
communicates."
::= { radiusAccServerExtEntry 1 }
radiusAccServerInetAddressType OBJECT-TYPE
SYNTAX InetAddressType
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The type of address format used for the
radiusAccServerInetAddress object."
::= { radiusAccServerExtEntry 2 }
radiusAccServerInetAddress OBJECT-TYPE
SYNTAX InetAddress
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The IP address of the RADIUS accounting
server referred to in this table entry, using
the version-neutral IP address format."
::= { radiusAccServerExtEntry 3 }
radiusAccClientServerInetPortNumber OBJECT-TYPE
SYNTAX InetPortNumber ( 1..65535 )
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The UDP port the client is using to send requests
to this accounting server. The value zero (0) is
invalid."
REFERENCE "RFC 2866 section 3"
::= { radiusAccServerExtEntry 4 }
radiusAccClientExtRoundTripTime OBJECT-TYPE
SYNTAX TimeTicks
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The time interval between the most recent
Accounting-Response and the Accounting-Request that
matched it from this RADIUS accounting server."
REFERENCE "RFC 2866 section 2"
::= { radiusAccServerExtEntry 5 }
-- Request/Response statistics
--
-- Requests = Responses + PendingRequests + ClientTimeouts
--
-- Responses - MalformedResponses - BadAuthenticators -
-- UnknownTypes - PacketsDropped = Successfully received
radiusAccClientExtRequests OBJECT-TYPE
SYNTAX Counter32
UNITS "packets"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of RADIUS Accounting-Request packets
sent. This does not include retransmissions.
This counter may experience a discontinuity when the
RADIUS Accounting Client module within the managed
entity is reinitialized, as indicated by the current
value of radiusAccClientCounterDiscontinuity."
REFERENCE "RFC 2866 section 4.1"
::= { radiusAccServerExtEntry 6 }
radiusAccClientExtRetransmissions OBJECT-TYPE
SYNTAX Counter32
UNITS "packets"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of RADIUS Accounting-Request packets
retransmitted to this RADIUS accounting server.
Retransmissions include retries where the
Identifier and Acct-Delay have been updated, as
well as those in which they remain the same.
This counter may experience a discontinuity when the
RADIUS Accounting Client module within the managed
entity is reinitialized, as indicated by the current
value of radiusAccClientCounterDiscontinuity."
REFERENCE "RFC 2866 section 2"
::= { radiusAccServerExtEntry 7 }
radiusAccClientExtResponses OBJECT-TYPE
SYNTAX Counter32
UNITS "packets"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of RADIUS packets received on the
accounting port from this server. This counter
may experience a discontinuity when the RADIUS
Accounting Client module within the managed entity is
reinitialized, as indicated by the current value of
radiusAccClientCounterDiscontinuity."
REFERENCE "RFC 2866 section 4.2"
::= { radiusAccServerExtEntry 8 }
radiusAccClientExtMalformedResponses OBJECT-TYPE
SYNTAX Counter32
UNITS "packets"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of malformed RADIUS Accounting-Response
packets received from this server. Malformed packets
include packets with an invalid length. Bad
authenticators and unknown types are not included as
malformed accounting responses. This counter may
experience a discontinuity when the RADIUS Accounting
Client module within the managed entity is
reinitialized, as indicated by the current
value of radiusAccClientCounterDiscontinuity."
REFERENCE "RFC 2866 section 3"
::= { radiusAccServerExtEntry 9 }
radiusAccClientExtBadAuthenticators OBJECT-TYPE
SYNTAX Counter32
UNITS "packets"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of RADIUS Accounting-Response
packets that contained invalid authenticators
received from this server. This counter may
experience a discontinuity when the RADIUS
Accounting Client module within the managed
entity is reinitialized, as indicated by the
current value of
radiusAccClientCounterDiscontinuity."
REFERENCE "RFC 2866 section 3"
::= { radiusAccServerExtEntry 10 }
radiusAccClientExtPendingRequests OBJECT-TYPE
SYNTAX Gauge32
UNITS "packets"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of RADIUS Accounting-Request packets
sent to this server that have not yet timed out or
received a response. This variable is incremented
when an Accounting-Request is sent and decremented
due to receipt of an Accounting-Response, a timeout,
or a retransmission. This counter may experience a
discontinuity when the RADIUS Accounting Client module
within the managed entity is reinitialized, as
indicated by the current value of
radiusAccClientCounterDiscontinuity."
REFERENCE "RFC 2866 section 2"
::= { radiusAccServerExtEntry 11 }
radiusAccClientExtTimeouts OBJECT-TYPE
SYNTAX Counter32
UNITS "timeouts"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of accounting timeouts to this server.
After a timeout, the client may retry to the same
server, send to a different server, or give up.
A retry to the same server is counted as a
retransmit as well as a timeout. A send to a different
server is counted as an Accounting-Request as well as
a timeout. This counter may experience a discontinuity
when the RADIUS Accounting Client module within the
managed entity is reinitialized, as indicated by the
current value of radiusAccClientCounterDiscontinuity."
REFERENCE "RFC 2866 section 2"
::= { radiusAccServerExtEntry 12 }
radiusAccClientExtUnknownTypes OBJECT-TYPE
SYNTAX Counter32
UNITS "packets"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of RADIUS packets of unknown type that
were received from this server on the accounting port.
This counter may experience a discontinuity when the
RADIUS Accounting Client module within the managed
entity is reinitialized, as indicated by the current
value of radiusAccClientCounterDiscontinuity."
REFERENCE "RFC 2866 section 4"
::= { radiusAccServerExtEntry 13 }
radiusAccClientExtPacketsDropped OBJECT-TYPE
SYNTAX Counter32
UNITS "packets"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of RADIUS packets that were received from
this server on the accounting port and dropped for some
other reason. This counter may experience a
discontinuity when the RADIUS Accounting Client module
within the managed entity is reinitialized, as indicated
by the current value of
radiusAccClientCounterDiscontinuity."
::= { radiusAccServerExtEntry 14 }
radiusAccClientCounterDiscontinuity OBJECT-TYPE
SYNTAX TimeTicks
UNITS "centiseconds"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The number of centiseconds since the last
discontinuity in the RADIUS Accounting Client
counters. A discontinuity may be the result of a
reinitialization of the RADIUS Accounting Client
module within the managed entity."
::= { radiusAccServerExtEntry 15 }
-- conformance information
radiusAccClientMIBConformance OBJECT IDENTIFIER
::= { radiusAccClientMIB 2 }
radiusAccClientMIBCompliances OBJECT IDENTIFIER
::= { radiusAccClientMIBConformance 1 }
radiusAccClientMIBGroups OBJECT IDENTIFIER
::= { radiusAccClientMIBConformance 2 }
-- units of conformance
radiusAccClientMIBCompliance MODULE-COMPLIANCE
STATUS deprecated
DESCRIPTION
"The compliance statement for accounting clients
implementing the RADIUS Accounting Client MIB.
Implementation of this module is for IPv4-only
entities, or for backwards compatibility use with
entities that support both IPv4 and IPv6."
MODULE -- this module
MANDATORY-GROUPS { radiusAccClientMIBGroup }
::= { radiusAccClientMIBCompliances 1 }
radiusAccClientExtMIBCompliance MODULE-COMPLIANCE
STATUS current
DESCRIPTION
"The compliance statement for accounting
clients implementing the RADIUS Accounting
Client IPv6 Extensions MIB. Implementation of
this module is for entities that support IPv6,
or support IPv4 and IPv6."
MODULE -- this module
MANDATORY-GROUPS { radiusAccClientExtMIBGroup }
OBJECT radiusAccServerInetAddressType
SYNTAX InetAddressType { ipv4(1), ipv6(2) }
DESCRIPTION
"An implementation is only required to support
IPv4 and globally unique IPv6 addresses."
OBJECT radiusAccServerInetAddress
SYNTAX InetAddress ( SIZE (4|16) )
DESCRIPTION
"An implementation is only required to support
IPv4 and globally unique IPv6 addresses."
::= { radiusAccClientMIBCompliances 2 }
-- units of conformance
radiusAccClientMIBGroup OBJECT-GROUP
OBJECTS { radiusAccClientIdentifier,
radiusAccClientInvalidServerAddresses,
radiusAccServerAddress,
radiusAccClientServerPortNumber,
radiusAccClientRoundTripTime,
radiusAccClientRequests,
radiusAccClientRetransmissions,
radiusAccClientResponses,
radiusAccClientMalformedResponses,
radiusAccClientBadAuthenticators,
radiusAccClientPendingRequests,
radiusAccClientTimeouts,
radiusAccClientUnknownTypes,
radiusAccClientPacketsDropped
}
STATUS deprecated
DESCRIPTION
"The basic collection of objects providing management of
RADIUS Accounting Clients."
::= { radiusAccClientMIBGroups 1 }
radiusAccClientExtMIBGroup OBJECT-GROUP
OBJECTS { radiusAccClientIdentifier,
radiusAccClientInvalidServerAddresses,
radiusAccServerInetAddressType,
radiusAccServerInetAddress,
radiusAccClientServerInetPortNumber,
radiusAccClientExtRoundTripTime,
radiusAccClientExtRequests,
radiusAccClientExtRetransmissions,
radiusAccClientExtResponses,
radiusAccClientExtMalformedResponses,
radiusAccClientExtBadAuthenticators,
radiusAccClientExtPendingRequests,
radiusAccClientExtTimeouts,
radiusAccClientExtUnknownTypes,
radiusAccClientExtPacketsDropped,
radiusAccClientCounterDiscontinuity
}
STATUS current
DESCRIPTION
"The basic collection of objects providing management of
RADIUS Accounting Clients."
::= { radiusAccClientMIBGroups 2 }
END
8. Security Considerations
There are no management objects defined in this MIB that have a MAX-
ACCESS clause of read-write and/or read-create. So, if this MIB is
implemented correctly, then there is no risk that an intruder can
alter or create any management objects of this MIB via direct SNMP
SET operations.
There are a number of managed objects in this MIB that may contain
sensitive information. These are:
radiusAcctServerIPAddress
This can be used to determine the address of the RADIUS accounting
server with which the client is communicating. This information
could be useful in mounting an attack on the accounting server.
radiusAcctServerInetAddress
This can be used to determine the address of the RADIUS accounting
server with which the client is communicating. This information
could be useful in mounting an attack on the accounting server.
radiusAcctClientServerPortNumber
This can be used to determine the port number on which the RADIUS
accounting client is sending. This information could be useful in
impersonating the client in order to send data to the accounting
server.
radiusAcctClientServerInetPortNumber
This can be used to determine the port number on which the RADIUS
accounting client is sending. This information could be useful in
impersonating the client in order to send data to the accounting
server.
It is thus important to control even GET access to these objects and
possibly to even encrypt the values of these object when sending them
over the network via SNMP. Not all versions of SNMP provide features
for such a secure environment.
SNMP versions prior to SNMPv3 do not provide a secure environment.
Even if the network itself is secure (for example by using IPsec),
there is no control as to who on the secure network is allowed to
access and GET/SET (read/change/create/delete) the objects in this
MIB.
It is RECOMMENDED that implementers consider the security features as
provided by the SNMPv3 framework (see [RFC3410], section 8),
including full support for the SNMPv3 cryptographic mechanisms (for
authentication and privacy).
Further, deployment of SNMP versions prior to SNMPv3 is NOT
RECOMMENDED. Instead, it is RECOMMENDED to deploy SNMPv3 and to
enable cryptographic security. It is then a customer/operator
responsibility to ensure that the SNMP entity giving access to an
instance of this MIB module is properly configured to give access to
the objects only to those principals (users) that have legitimate
rights to indeed GET or SET (change/create/delete) them.
9. References
9.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC2578] McCloghrie, K., Ed., Perkins, D., Ed., and J.
Schoenwaelder, Ed., "Structure of Management Information
Version 2 (SMIv2)", STD 58, RFC 2578, April 1999.
[RFC2579] McCloghrie, K., Ed., Perkins, D., Ed., and J.
Schoenwaelder, Ed., "Textual Conventions for SMIv2",
STD 58, RFC 2579, April 1999.
[RFC2580] McCloghrie, K., Perkins, D., and J. Schoenwaelder,
"Conformance Statements for SMIv2", STD 58, RFC 2580,
April 1999.
[RFC2866] Rigney, C., "RADIUS Accounting", RFC 2866, June 2000.
[RFC3411] Harrington, D., Presuhn, R., and B. Wijnen, "An
Architecture for Describing Simple Network Management
Protocol (SNMP) Management Frameworks", STD 62, RFC 3411,
December 2002.
[RFC4001] Daniele, M., Haberman, B., Routhier, S., and J.
Schoenwaelder, "Textual Conventions for Internet Network
Addresses", RFC 4001, February 2005.
9.2. Informative References
[RFC2620] Aboba, B. and G. Zorn, "RADIUS Accounting Client MIB",
RFC 2620, June 1999.
[RFC2865] Rigney, C., Willens, S., Rubens, A., and W. Simpson,
"Remote Authentication Dial In User Service (RADIUS)", RFC
2865, June 2000.
[RFC3410] Case, J., Mundy, R., Partain, D., and B. Stewart,
"Introduction and Applicability Statements for Internet-
Standard Management Framework", RFC 3410, December 2002.
[RFC4671] Nelson, D., "RADIUS Accounting Server MIB for IPv6", RFC
4671, August 2006.
Appendix A. Acknowledgements
The authors of the original MIB are Bernard Aboba and Glen Zorn.
Many thanks to all reviewers, especially to Dave Harrington, Dan
Romascanu, C.M. Heard, Bruno Pape, Greg Weber, and Bert Wijnen.
Author’s Address
David B. Nelson
Enterasys Networks
50 Minuteman Road
Andover, MA 01810
USA
EMail: dnelson@enterasys.com
Full Copyright Statement
Copyright (C) The Internet Society (2006).
This document is subject to the rights, licenses and restrictions
contained in BCP 78, and except as set forth therein, the authors
retain all their rights.
This document and the information contained herein are provided on an
"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property
The IETF takes no position regarding the validity or scope of any
Intellectual Property Rights or other rights that might be claimed to
pertain to the implementation or use of the technology described in
this document or the extent to which any license under such rights
might or might not be available; nor does it represent that it has
made any independent effort to identify any such rights. Information
on the procedures with respect to rights in RFC documents can be
found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any
assurances of licenses to be made available, or the result of an
attempt made to obtain a general license or permission for the use of
such proprietary rights by implementers or users of this
specification can be obtained from the IETF on-line IPR repository at
http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary
rights that may cover technology that may be required to implement
this standard. Please address the information to the IETF at
ietf-ipr@ietf.org.
Acknowledgement
Funding for the RFC Editor function is provided by the IETF