ONEACCESS-AAA-MIB Table View

Configuring Radius Server:
For the device to authenticate with an radius server
database, the following parameters have to be configured.
The cli command for adding a radius server details is
radius-server <RADIUS-server-ip> [<RADIUS-UDP-port>] <shared-key> [ <interface> <unit> ]
The snmp table will contain the following attributes.
1) hostname or IP Address  			String
2) Radius Server Port 				Integer 1-65535
3) Shared Key   					String.
4) Retransmit  						Integer 1-100  default 3
5) Timeout 							Integer 1-600  default 3
6) Interface 						InterfaceIndex

oacAAARadiusServerConfigEntry row .1.3.6.1.4.1.13191.10.3.4.10.1.1.1

The Radius Server config entry will hold the details
of one radius servers configured for the client to
send the requests for authentication.
This table is indexed on oacAAARadiusServrInfo which can
be either an ipaddre…

Indexes

oacAAARadiusServerInfo oacAAARadiusServerPort

Column	Syntax	OID
oacAAARadiusServerInfo The Info can be an : A.B.C.D IPv4 host address A.B.C.D Ipv4 subnet hostname Hostname.	SNMPv2-TCDisplayStringr/w Type Constraints: range: 0..255 Description: Represents textual information taken from the NVT ASCII character set, as defined in pages 4, 10-11 of RFC 854. To summarize RFC 854, the NVT ASCII repertoire specifies: - the use of c…	.1.3.6.1.4.1.13191.10.3.4.10.1.1.1.1
oacAAARadiusServerPort The default server port to which radius client will connect to a radius server is 1812. But the user can always specify the port to which the client should connect when contacting the configured radius server.	Integer32r/w Constraints: range: 1-65535	.1.3.6.1.4.1.13191.10.3.4.10.1.1.1.2
oacAAARadiusServerSharedKey Pre shared key between the radius client and server.	OctetStringr/w Constraints: range: 8-255	.1.3.6.1.4.1.13191.10.3.4.10.1.1.1.3
oacAAARadiusServerRetries The Client can do the configured number of retries to this radius server before moving to the next radius server. The default number of retries is 3.	Integer32r/w Constraints: range: 1-100	.1.3.6.1.4.1.13191.10.3.4.10.1.1.1.4
oacAAARadiusServerTimeout The nummber of seconds to wait before to call a timeout. The default value is 3 seconds.	Integer32r/w Constraints: range: 1-600	.1.3.6.1.4.1.13191.10.3.4.10.1.1.1.5
oacAAARadiusServerInterface The interface for this device to use to contact the radius server for auth requests. It is identified by the ifIndex. Each interface/unit is identified by an ifIndex.	IF-MIBInterfaceIndexr/w Type Constraints: range: 1..2147483647 Description: A unique value, greater than zero, for each interface or interface sub-layer in the managed system. It is recommended that values are assigned contiguously starting from 1. The value for each interface sub-layer must …	.1.3.6.1.4.1.13191.10.3.4.10.1.1.1.6
oacAAARadiusServerRowStatus The Row status for an entry in the oacAAARadiusServerConfigTable.	SNMPv2-TCRowStatusr/w Type Values: 1 active 2 notInService 3 notReady 4 createAndGo 5 createAndWait 6 destroy Description: The RowStatus textual convention is used to manage the creation and deletion of conceptual rows, and is used as the value of the SYNTAX clause for the status column of a conceptual row (as described in Section 7.7.1 of …	.1.3.6.1.4.1.13191.10.3.4.10.1.1.1.7

Configuring Tacacs client:
The cli to add tacacs server info for the tacacs client is
tacacs-server <host> [<port>] <key> [ <interface> <unit> ]
Hence the snmp table for to hold the tacacs server info has the following
1) hostname or IP Address 			OCTET STRING
2) TACACs serverport 				Integer 1-65535
3) Shared Key 						OCTET STRING
4) Timeout 							integer	1-600 default 3
5) Interface 						InterfaceIndex

oacAAATacacsServerConfigEntry row .1.3.6.1.4.1.13191.10.3.4.10.1.3.1

An entry holds the information per tacacs server configured.
the entry is uniquely identified/indexed by the oacAAATacacsServerInfo
which can be either the IPv4 address or an hostname.

Indexes

oacAAATacacsServerInfo oacAAATacacsServerPort

Column	Syntax	OID
oacAAATacacsServerInfo The Info can be an : A.B.C.D IPv4 host address A.B.C.D Ipv4 subnet hostname Hostname.	SNMPv2-TCDisplayStringr/w Type Constraints: range: 0..255 Description: Represents textual information taken from the NVT ASCII character set, as defined in pages 4, 10-11 of RFC 854. To summarize RFC 854, the NVT ASCII repertoire specifies: - the use of c…	.1.3.6.1.4.1.13191.10.3.4.10.1.3.1.1
oacAAATacacsServerPort The default for an tacacs client to connect to tacacs server is 49. But this can vary depending on the server configuration. Hence when a tacacs server is added the port on which this server is running has to be specifi…	Integer32r/w Constraints: range: 1-65535	.1.3.6.1.4.1.13191.10.3.4.10.1.3.1.2
oacAAATacacsServerSharedKey The shared key will be used to authenticate a tacacs client with the tacacs server. This has key is different from the user authentication keys.	OctetStringr/w Constraints: range: 8-255	.1.3.6.1.4.1.13191.10.3.4.10.1.3.1.3
oacAAATacacsServerTimeout The default timeout value for an client to wait for a response from the tacacs server is set to 3 seconds. but this can be modified by setting a value.	Integer32r/w Constraints: range: 1-600	.1.3.6.1.4.1.13191.10.3.4.10.1.3.1.4
oacAAATacacsServerInterface The interface which this tacacs client should use to contact the configured tacacs server. The interface is identified by the ifIndex.	IF-MIBInterfaceIndexr/w Type Constraints: range: 1..2147483647 Description: A unique value, greater than zero, for each interface or interface sub-layer in the managed system. It is recommended that values are assigned contiguously starting from 1. The value for each interface sub-layer must …	.1.3.6.1.4.1.13191.10.3.4.10.1.3.1.5
oacAAATacacsServerRowStatus The Rowstatus for this entry.	SNMPv2-TCRowStatusr/w Type Values: 1 active 2 notInService 3 notReady 4 createAndGo 5 createAndWait 6 destroy Description: The RowStatus textual convention is used to manage the creation and deletion of conceptual rows, and is used as the value of the SYNTAX clause for the status column of a conceptual row (as described in Section 7.7.1 of …	.1.3.6.1.4.1.13191.10.3.4.10.1.3.1.6

AAA configuration on OneOS
The AAA servers can be configured to either authenticate
user login or authenticate enable commands for a given user.
OneOS can either use all radius servers or all tacas servers
or	a group of configured radius servers
or a group of configured tacacs servers
or only the local database. By default if a radius/tacacs
servers are configured,	ONEOS will use the AAA servers in the
order in which they are configured.
The following commands are available to configure the AAA servers.
aaa authentication login {default|console|network} {<group-name>|radius|tacacs}
aaa authentication enable {default|console|network} {<group-name>|radius|tacacs}
          
Hence the following will be the attributes for the
AAA authentication configuration table
1) Authentication for (login or enable)  				Integer as enum
2) Authentication from (default or console or network) 	Integer as enum
3) Authentication servertype 							String

oacAAAAuthenticationServerConfigEntry row .1.3.6.1.4.1.13191.10.3.4.10.1.5.1

An entry will define how a login/enable from console or network
will use which group of servers of either radius or tacacs.
Each entry is uniquly identified by an dual index.

Indexes

oacAAAAuthenticationFeature oacAAAAuthenticationReqSrc

Column	Syntax	OID
oacAAAAuthenticationFeature A user can login to the device and just monitor. A user can configure the device when he enters the enabled mode. The device will challenge an user for authentication when ever he enters and enabled command.	Enumerationr/w Enumerated Values: 1 login 2 enable	.1.3.6.1.4.1.13191.10.3.4.10.1.5.1.1
oacAAAAuthenticationReqSrc The user can access the device either thru the default mode or from the console or from the network like ssh and telnet.	Enumerationr/w Enumerated Values: 1 default 2 console 3 network	.1.3.6.1.4.1.13191.10.3.4.10.1.5.1.2
oacAAAAuthenticationSvrType The authentication servers can be either a group of radius serves or a group of tacacs servers or all radius servers or all tacacs server.	OctetStringr/w Constraints: range: 1-255	.1.3.6.1.4.1.13191.10.3.4.10.1.5.1.3
oacAAAAuthenticationServerRowStatus The Row status for this entry.	SNMPv2-TCRowStatusr/w Type Values: 1 active 2 notInService 3 notReady 4 createAndGo 5 createAndWait 6 destroy Description: The RowStatus textual convention is used to manage the creation and deletion of conceptual rows, and is used as the value of the SYNTAX clause for the status column of a conceptual row (as described in Section 7.7.1 of …	.1.3.6.1.4.1.13191.10.3.4.10.1.5.1.4

This table holds upto 40 banner messages used in authentication

oacAAAAuthenticationConfigBannerSeqEntry row .1.3.6.1.4.1.13191.10.3.4.10.1.6.1

Each entry will hold one banner string

Indexes

oacAAAAuthenticationBannerSequence

Column	Syntax	OID
oacAAAAuthenticationBannerSequence The maximum number of strings that can be stored are 40.	Integer32r/w Constraints: range: 1-40	.1.3.6.1.4.1.13191.10.3.4.10.1.6.1.1
oacAAAAuthenticationBannerString banner test is a set of string maximum upto 255 characters.	OctetStringr/w Constraints: range: 1-255	.1.3.6.1.4.1.13191.10.3.4.10.1.6.1.2
oacAAAAuthenticationBannerSeqRowStatus The row status of this entry	SNMPv2-TCRowStatusr/w Type Values: 1 active 2 notInService 3 notReady 4 createAndGo 5 createAndWait 6 destroy Description: The RowStatus textual convention is used to manage the creation and deletion of conceptual rows, and is used as the value of the SYNTAX clause for the status column of a conceptual row (as described in Section 7.7.1 of …	.1.3.6.1.4.1.13191.10.3.4.10.1.6.1.3

Configuring AAA Group Servers:
The cli command to configure a group of servers
		aaa group server { radius | tacacs } <group-name>
		server {<A.B.C.D>|<hostname> }
	The SNMP table for group servers will be
	1) group name 		OCTET STRING
	2) group type 		INTEGER (ENUM)
	3) server			OCTET STRING

oacAAAGroupServerConfigEntry row .1.3.6.1.4.1.13191.10.3.4.10.1.7.1

A group server entry will hold information about an
configured radius or tacacs server to which group it belongs to.

Indexes

oacAAAServerGroupName

Column	Syntax	OID
oacAAAServerGroupName The group name which is the index for each entry.	SNMPv2-TCDisplayStringr/w Type Constraints: range: 0..255 Description: Represents textual information taken from the NVT ASCII character set, as defined in pages 4, 10-11 of RFC 854. To summarize RFC 854, the NVT ASCII repertoire specifies: - the use of c…	.1.3.6.1.4.1.13191.10.3.4.10.1.7.1.1
oacAAAServerGroupType Only server of type defined above can be added to this group. all the servers can be either of type radius or type tacacs.	Enumerationr/w Enumerated Values: 1 radius 2 tacacs	.1.3.6.1.4.1.13191.10.3.4.10.1.7.1.2
oacAAAServerGroupServerInfo This object will hold the inforamtion about the server, which can be an IPv4 Address or an Hostname.	SNMPv2-TCDisplayStringr/w Type Constraints: range: 0..255 Description: Represents textual information taken from the NVT ASCII character set, as defined in pages 4, 10-11 of RFC 854. To summarize RFC 854, the NVT ASCII repertoire specifies: - the use of c…	.1.3.6.1.4.1.13191.10.3.4.10.1.7.1.3
oacAAAServerGroupRowStatus The row status for this entry.	SNMPv2-TCRowStatusr/w Type Values: 1 active 2 notInService 3 notReady 4 createAndGo 5 createAndWait 6 destroy Description: The RowStatus textual convention is used to manage the creation and deletion of conceptual rows, and is used as the value of the SYNTAX clause for the status column of a conceptual row (as described in Section 7.7.1 of …	.1.3.6.1.4.1.13191.10.3.4.10.1.7.1.4

This table provides the information for AAA accounting commands.
SNMP table for the above command will be
1) access level of the command  	INTEGER 0-15
2) tacacs+ group					OCTET STRING default all.

oacAAAAccCmdsConfigEntry row .1.3.6.1.4.1.13191.10.3.4.10.1.9.1

each entry will define an access level and the tacacs group name.

Indexes

oacAAAAccCmdAccessLevel

Column	Syntax	OID
oacAAAAccCmdAccessLevel The command access level for which accounting has to be done.	Integer32r/w Constraints: range: 0-15	.1.3.6.1.4.1.13191.10.3.4.10.1.9.1.1
oacAAAAccTacacsGroupName The group of servers that can be used to perform accounting for a given command access level.	SNMPv2-TCDisplayStringr/w Type Constraints: range: 0..255 Description: Represents textual information taken from the NVT ASCII character set, as defined in pages 4, 10-11 of RFC 854. To summarize RFC 854, the NVT ASCII repertoire specifies: - the use of c…	.1.3.6.1.4.1.13191.10.3.4.10.1.9.1.2
oacAAAAccCmdsRowStatus The row status for this entry.	SNMPv2-TCRowStatusr/w Type Values: 1 active 2 notInService 3 notReady 4 createAndGo 5 createAndWait 6 destroy Description: The RowStatus textual convention is used to manage the creation and deletion of conceptual rows, and is used as the value of the SYNTAX clause for the status column of a conceptual row (as described in Section 7.7.1 of …	.1.3.6.1.4.1.13191.10.3.4.10.1.9.1.3