TN-NAS-MIB: View SNMP OID List / Download MIB

TBD

If checked, successfully authenticated supplicants/clients are reauthenticated after the interval specified by the Reauthentication Period.Reauthentication for 802.1X-enabled ports can be used to detect if a new device is plugged into a switch port or if a supplicant is no longer attached. For MAC-based ports, reauthentication is only useful if the RADIUS server configuration has changed. It does not involve communication between the switch and the client, and therefore doesn't imply that a client is still present on a port. Enumeration: 'enable': 1, 'disable': 2.

Determines the period, in seconds, after which a connected client must be reauthenticated. This is only active if the Reauthentication Enabled checkbox is checked. Valid values are in the range 1 to 3600 seconds.

Determines the time for retransmission of Request Identity EAPOL frames. Valid values are in the range 1 to 65535 seconds. This has no effect for MAC-based ports..

This setting applies to the following modes, i.e. modes using the Port Security functionality to secure MAC addresses: Single 802.1X, Multi 802.1X, MAC-Based Auth. When the NAS module uses the Port Security module to secure MAC addresses, the Port Security module needs to check for activity on the MAC address in question at regular intervals and free resources if no activity is seen within a given period of time. This parameter controls exactly this period and can be set to a number between 10 and 1000000 seconds. If reauthentication is enabled and the port is in an 802.1X-based mode, this is not so critical, since supplicants that are no longer attached to the port will get removed upon the next reauthentication, which will fail. But if reauthentication is not enabled, the only way to free resources is by aging the entries. For ports in MAC-based Auth. mode, reauthentication doesn't cause direct communication between the switch and the client, so this will not detect whether the client is still attached or not, and the only way to free any resources is to age the entry..

This setting applies to the following modes, i.e. modes using the Port Security functionality to secure MAC addresses: Single 802.1X, Multi 802.1X, MAC-Based Auth. If a client is denied access - either because the RADIUS server denies the client access or because the RADIUS server request times out, the client is put on hold in the Unauthorized state. The hold timer does not count during an on-going authentication. In MAC-based Auth. mode, the switch will ignore new frames coming from the client during the hold time. The Hold Time can be set to a number between 10 and 1000000 seconds..

RADIUS-assigned QoS provides a means to centrally control the traffic class to which traffic coming from a successfully authenticated supplicant is assigned on the switch. The RADIUS server must be configured to transmit special RADIUS attributes to take advantage of this feature. When checked, the individual ports' ditto setting determine whether RADIUS-assigned QoS Class is enabled on that port. When unchecked, RADIUS-server assigned QoS Class is disabled on all ports.. Enumeration: 'enable': 1, 'disable': 2.

RADIUS-assigned VLAN provides a means to centrally control the VLAN on which a successfully authenticated supplicant is placed on the switch. Incoming traffic will be classified to and switched on the RADIUS-assigned VLAN. The RADIUS server must be configured to transmit special RADIUS attributes to take advantage of this feature. When checked, the individual ports' ditto setting determine whether RADIUS-assigned VLAN is enabled on that port. When unchecked, RADIUS-server assigned VLAN is disabled on all ports.. Enumeration: 'enable': 1, 'disable': 2.

A Guest VLAN is a special VLAN - typically with limited network access - on which 802.1X-unaware clients are placed after a network administrator-defined timeout. The switch follows a set of rules for entering and leaving the Guest VLAN as listed below. When checked, the individual ports' ditto setting determines whether the port can be moved into Guest VLAN. When unchecked, the ability to move to the Guest VLAN is disabled on all ports.. Enumeration: 'enable': 1, 'disable': 2.

This is the value that a port's Port VLAN ID is set to if a port is moved into the Guest VLAN. It is only changeable if the Guest VLAN option is globally enabled. Valid values are in the range [1; 4094].

The number of times the switch transmits an EAPOL Request Identity frame without response before considering entering the Guest VLAN is adjusted with this setting. The value can only be changed if the Guest VLAN option is globally enabled. Valid values are in the range [1; 255]..

The switch remembers if an EAPOL frame has been received on the port for the life-time of the port. Once the switch considers whether to enter the Guest VLAN, it will first check if this option is enabled or disabled. If disabled (unchecked; default), the switch will only enter the Guest VLAN if an EAPOL frame has not been received on the port for the life-time of the port. If enabled (checked), the switch will consider entering the Guest VLAN even if an EAPOL frame has been received on the port for the life-time of the port. The value can only be changed if the Guest VLAN option is globally enabled.. Enumeration: 'enable': 1, 'disable': 2.

This table displays and sets port configuratio.

This entry represents a port configuration.

The port number for which the configuration below applies.

If NAS is globally enabled, this selection controls the port's authentication mode.

When RADIUS-Assigned QoS is both globally enabled and enabled (checked) on a given port, the switch reacts to QoS Class information carried in the RADIUS Access-Accept packet transmitted by the RADIUS server when a supplicant is successfully authenticated. If present and valid, traffic received on the supplicant's port will be classified to the given QoS Class. If (re-)authentication fails or the RADIUS Access-Accept packet no longer carries a QoS Class or it's invalid, or the supplicant is otherwise no longer present on the port, the port's QoS Class is immediately reverted to the original QoS Class (which may be changed by the administrator in the meanwhile without affecting the RADIUS-assigned). This option is only available for single-client modes, i.e Port-based 802.1X, Single 802.1X Enumeration: 'enable': 1, 'disable': 2.

When RADIUS-Assigned VLAN is both globally enabled and enabled (checked) for a given port, the switch reacts to VLAN ID information carried in the RADIUS Access-Accept packet transmitted by the RADIUS server when a supplicant is successfully authenticated. If present and valid, the port's Port VLAN ID will be changed to this VLAN ID, the port will be set to be a member of that VLAN ID, and the port will be forced into VLAN unaware mode. Once assigned, all traffic arriving on the port will be classified and switched on the RADIUS-assigned VLAN ID. If (re-)authentication fails or the RADIUS Access-Accept packet no longer carries a VLAN ID or it's invalid, or the supplicant is otherwise no longer present on the port, the port's VLAN ID is immediately reverted to the original VLAN ID (which may be changed by the administrator in the meanwhile without affecting the RADIUS-assigned). This option is only available for single-client modes, i.e. Port-based 802.1X, Single 802.1X. Enumeration: 'enable': 1, 'disable': 2.

TWhen Guest VLAN is both globally enabled and enabled (checked) for a given port, the switch considers moving the port into the Guest VLAN according to the rules outlined below. This option is only available for EAPOL-based modes, i.e.: Port-based 802.1X, Single 802.1X, Multi 802.1X Enumeration: 'enable': 1, 'disable': 2.

The current state of the port. Enumeration: 'globallyDisabled': 3, 'authOrUnauth': 4, 'linkDown': 0, 'authorized': 1, 'unauthorized': 2.

This table contains the configuration of auth counter.

This entry represents an auth counter.

NAS auththenticate count

NAS unauththenticate count

This table contains the configuration of port status.

This entry represents a port status.

The port's current administrative state.

The current state of the port. Enumeration: 'globallyDisabled': 3, 'authOrUnauth': 4, 'linkDown': 0, 'authorized': 1, 'unauthorized': 2.

The QoS class assigned by the RADIUS server. The field is blank if no QoS class is assigned.

The VLAN ID that NAS has put the port in. The field is blank, if the Port VLAN ID is not overridden by NAS.

This table contains the configuration of client status.

This entry represents a client status.

1 for last client/supplication; 2 for selected client/supplication.

The MAC address of the last supplicant/client.

The VLAN ID on which the last frame from the last supplicant/client was received.

802.1X-based: The user name (supplicant identity) carried in the most recently received Response Identity EAPOL frame. MAC-based: Not applicable.

This table contains the configuration of Selected backend server counter.

This entry represents an Selected backend server counter.

802.1X-based: Counts the number of times that the switch receives the first request from the backend server following the first response from the supplicant. Indicates that the backend server has communication with the switch. MAC-based: Counts all Access Challenges received from the backend server for this port (left-most table) or client (right-most table).

802.1X-based: Counts the number of times that the switch sends an EAP Request packet following the first to the supplicant. Indicates that the backend server chose an EAP-method. MAC-based: Not applicable.

802.1X- and MAC-based: Counts the number of times that the switch receives a success indication. Indicates that the supplicant/client has successfully authenticated to the backend server.

802.1X- and MAC-based: Counts the number of times that the switch receives a failure message. This indicates that the supplicant/client has not authenticated to the backend server.

802.1X-based: Counts the number of times that the switch attempts to send a supplicant's first response packet to the backend server. Indicates the switch attempted communication with the backend server. Possible retransmissions are not counted. MAC-based: Counts all the backend server packets sent from the switch towards the backend server for a given port or client (right-most table). Possible retransmissions are not counted.

This table contains the configuration of selected EAPOL counter.

This entry represents a selected EAPOL counter.

The number of valid EAPOL frames of any type that have been received by the switch.

The number of valid EAPOL Response Identity frames that have been received by the switch.

The number of valid EAPOL response frames (other than Response Identity frames) that have been received by the switch.

The number of EAPOL Start frames that have been received by the switch.

The number of valid EAPOL Logoff frames that have been received by the switch.

The number of EAPOL frames that have been received by the switch in which the frame type is not recognized.

The number of EAPOL frames that have been received by the switch in which the Packet Body Length field is invalid.

The number of EAPOL frames of any type that have been transmitted by the switch.

The number of EAPOL Request Identity frames that have been transmitted by the switch.

The number of valid EAPOL Request frames (other than Request Identity frames) that have been transmitted by the switch.

This table contains the configuration of attached client status.

This entry represents an attached client status.

The number of attached clients/supplications.

Shows the identity of the supplicant, as received in the Response Identity EAPOL frame. If no supplicants are attached, it shows No supplicants attached. This is not available for MAC-based Auth..

For Multi 802.1X, this column holds the MAC address of the attached supplicant. For MAC-based Auth., this column holds the MAC address of the attached client. If no clients are attached, it shows No clients attached.

This column holds the VLAN ID that the corresponding client is currently secured through the Port Security module.

The client can either be authenticated or unauthenticated. In the authenticated state, it is allowed to forward frames on the port, and in the unauthenticated state, it is blocked. As long as the backend server hasn't successfully authenticated the client, it is unauthenticated. If an authentication fails for one or the other reason, the client will remain in the unauthenticated state for Hold Time seconds. Enumeration: 'globallyDisabled': 3, 'linkDown': 0, 'authorized': 1, 'unauthorized': 2.

Shows the date and time of the last authentication of the client (successful as well as unsuccessful).

select specific attached client. Enumeration: 'selected': 1, 'unselected': 0.

This table contains the configuration of clearing counter.

This entry represents a clear counter.

The action of clearing counter. Enumeration: 'clear': 1, 'unclear': 0.