RADIUS Working Group                                     Bernard Aboba
     INTERNET-DRAFT                                               Microsoft
     <draft-ietf-radius-clientmib-01.txt>                         Glen Zorn
     25 March 1997                                                Microsoft
     
     
                               RADIUS Client MIB
     
     
     1.  Status of this Memo
     
     This document is an Internet-Draft.  Internet-Drafts are working docu-
     ments of the Internet Engineering Task Force (IETF),  its  areas,  and
     its  working groups.  Note that other groups may also distribute work-
     ing documents as Internet-Drafts.
     
     Internet-Drafts are draft documents valid for a maximum of six  months
     and  may  be updated, replaced, or obsoleted by other documents at any
     time.  It is inappropriate to use Internet-Drafts as  reference  mate-
     rial or to cite them other than as ``work in progress.''
     
     To  learn  the  current status of any Internet-Draft, please check the
     ``1id-abstracts.txt'' listing contained in the Internet-Drafts  Shadow
     Directories   on   ds.internic.net   (US  East  Coast),  nic.nordu.net
     (Europe), ftp.isi.edu (US West Coast), or munnari.oz.au (Pacific Rim).
     
     The  distribution  of  this memo is unlimited.  It is filed as <draft-
     ietf-radius-clientmib-01.txt>, and  expires October  1,  1997.  Please
     send comments to the authors.
     
     
     2.  Abstract
     
     This  memo  defines a set of extensions which instrument RADIUS client
     functions. These extensions represent  a  portion  of  the  Management
     Information  Base  (MIB)  for use with network management protocols in
     the Internet community.  Using these  extensions  IP-based  management
     stations can manage RADIUS clients.
     
     
     3.  Introduction
     
     This  memo  defines a portion of the Management Information Base (MIB)
     for use with network management protocols in the  Internet  community.
     In  particular,  it describes managed objects used for managing RADIUS
     clients.
     
     Today a wide range of network devices, including  routers  and  NASes,
     act  as  RADIUS clients in order to provide authentication, authoriza-
     tion, and accounting services. As a result, the  effective  management
     of RADIUS clients is of considerable importance.
     
     
     
     
     
     
     Aboba & Zorn                                                  [Page 1]


     INTERNET-DRAFT                                           25 March 1997
     
     
     4.  The SNMPv2 Network Management Framework
     
     The  SNMPv2 Network Management Framework consists of four major compo-
     nents.  They are:
     
           o  RFC 1902 which defines the SMI, the mechanisms used for
              describing and naming objects for the purpose of management.
     
           o  RFC 1905 which defines the protocol used for network access to
              managed objects.
     
           o  RFC 1907 defines the core set of managed objects for the
              Internet suite of protocols.
     
           o  RFC 1909 which defines the administrative aspects of the
              framework.
     
     The Framework permits new objects to be defined  for  the  purpose  of
     experimentation and evaluation.
     
     
     4.1.  Object Definitions
     
     Managed  objects  are accessed via a virtual information store, termed
     the Management Information Base  or  MIB.   Objects  in  the  MIB  are
     defined  using  the  subset  of  Abstract  Syntax Notation One (ASN.1)
     defined in the SMI. In particular, each object object type is named by
     an  OBJECT  IDENTIFIER, an administratively assigned name.  The object
     type together with an object instance serves to  uniquely  identify  a
     specific  instantiation of the object. For human convenience, we often
     use a textual string, termed the descriptor, to refer  to  the  object
     type.
     
     
     5.  Overview
     
     This MIB module contains a scalar as well as a single table:
     
     (1)  the RADIUS Server Table contains one row for each
          RADIUS server that the client shares a secret with.
     
     Each  entry in the RADIUS Server Table includes twelve counts present-
     ing a view of the activity of the RADIUS client.
     
     
     6.  Definitions
     
     RADIUS-CLIENT-MIB DEFINITIONS ::= BEGIN
     
     IMPORTS
         MODULE-IDENTITY, OBJECT-TYPE,
         OBJECT-IDENTITY, experimental,
         Counter32, Gauge32, Integer32,
         IpAddress, TimeTicks             FROM SNMPv2-SMI
     
     
     
     Aboba & Zorn                                                  [Page 2]


     INTERNET-DRAFT                                           25 March 1997
     
     
         RowStatus, TruthValue,
         DisplayString                    FROM SNMPv2-TC
         MODULE-COMPLIANCE, OBJECT-GROUP  FROM SNMPv2-CONF;
     
     
     radius OBJECT-IDENTITY
            STATUS  current
            DESCRIPTION
                    "The OID assigned to RADIUS MIB work by the IANA."
            ::= { not-assigned-yet }
     
     radiusClientMIB MODULE-IDENTITY
         LAST-UPDATED "9703021659Z"
         ORGANIZATION "IETF RADIUS Working Group."
         CONTACT-INFO
                 " Bernard Aboba
                   Microsoft
                   One Microsoft Way
                   Redmond, WA  98052
                   US
     
                   Phone: +1 206 936 6605
                   EMail: bernarda@microsoft.com"
         DESCRIPTION
                 "The MIB module for RADIUS Client Management."
         ::= { radius 2 }
     
     radiusClientMIBObjects     OBJECT IDENTIFIER ::= { radiusClientMIB 1 }
     
     radiusClient      OBJECT IDENTIFIER ::= { radiusClientMIBObjects 1 }
     
     radiusClientInvalidServerAddresses OBJECT-TYPE
            SYNTAX Counter32
            MAX-ACCESS read-only
            STATUS current
            DESCRIPTION
     "The total number of RADIUS Access-Response messages received
     from unknown addresses since client start-up"
            ::= { radiusClient 1 }
     
     radiusServerTable OBJECT-TYPE
         SYNTAX     SEQUENCE OF RadiusServerEntry
         MAX-ACCESS not-accessible
         STATUS     current
         DESCRIPTION
                 "The (conceptual) table listing the RADIUS servers with
                 which the client shares a secret."
         ::= { radiusClient 2 }
     
     radiusServerEntry OBJECT-TYPE
         SYNTAX     RadiusServerEntry
         MAX-ACCESS not-accessible
         STATUS     current
         DESCRIPTION
     
     
     
     Aboba & Zorn                                                  [Page 3]


     INTERNET-DRAFT                                           25 March 1997
     
     
                 "An entry (conceptual row) representing a RADIUS server
                 with which the client shares a secret."
         INDEX      { radiusServerIndex }
         ::= { radiusServerTable 1 }
     
     RadiusServerEntry ::= SEQUENCE {
         radiusServerIndex                           Integer32,
         radiusServerAddress                         IpAddress,
         radiusClientAccessRequests                  Counter32,
         radiusClientAccessRetransmissions           Counter32,
         radiusClientAccessAccepts                   Counter32,
         radiusClientAccessChallenges                Counter32,
         radiusClientMalformedAccessResponses        Counter32,
         radiusClientAuthenticationBadAuthenticators Counter32,
         radiusClientAccessRejects                   Counter32,
         radiusClientTimeouts                        Counter32,
         radiusClientAccountingRequests              Counter32,
         radiusClientAccountingRetransmissions       Counter32,
         radiusClientAccountingResponses             Counter32,
         radiusClientAccountingBadAuthenticators     Counter32
     }
     
     radiusServerIndex OBJECT-TYPE
         SYNTAX     Integer32
         MAX-ACCESS not-accessible
         STATUS     current
         DESCRIPTION
                 "The RADIUS server with whom the client interacts."
         ::= { radiusServerEntry 1 }
     
     radiusServerAddress OBJECT-TYPE
         SYNTAX     IpAddress
         MAX-ACCESS read-only
         STATUS     current
         DESCRIPTION
                 "The IP address of the RADIUS server
                 referred to in this table entry."
         ::= { radiusServerEntry 2 }
     
     radiusClientAccessRequests OBJECT-TYPE
            SYNTAX Counter32
            MAX-ACCESS read-only
            STATUS current
            DESCRIPTION
     "The total number of RADIUS Access-Request messages sent
     since client start-up"
            ::= { radiusServerEntry 3 }
     
     radiusClientAccessRetransmissions OBJECT-TYPE
            SYNTAX Counter32
            MAX-ACCESS read-only
            STATUS current
            DESCRIPTION
     "The total number of RADIUS Access-Request messages retransmitted
     
     
     
     Aboba & Zorn                                                  [Page 4]


     INTERNET-DRAFT                                           25 March 1997
     
     
     since client start-up"
            ::= { radiusServerEntry 4 }
     
     radiusClientAccessAccepts OBJECT-TYPE
            SYNTAX Counter32
            MAX-ACCESS read-only
            STATUS current
            DESCRIPTION
     "The total number of RADIUS Access-Accept messages received
     since client start-up"
            ::= { radiusServerEntry 5 }
     
     radiusClientAccessChallenges OBJECT-TYPE
            SYNTAX Counter32
            MAX-ACCESS read-only
            STATUS current
            DESCRIPTION
     "The total number of RADIUS Access-Challenge messages received
     since client start-up"
            ::= { radiusServerEntry 6 }
     
     radiusClientMalformedAccessResponses OBJECT-TYPE
            SYNTAX Counter32
            MAX-ACCESS read-only
            STATUS current
            DESCRIPTION
     "The total number of malformed RADIUS Access-Response messages received
     since client start-up"
            ::= { radiusServerEntry 7 }
     
     radiusClientAuthenticationBadAuthenticators OBJECT-TYPE
            SYNTAX Counter32
            MAX-ACCESS read-only
            STATUS current
            DESCRIPTION
     "The total number of RADIUS Access-Response messages containing invalid
     authenticators received since client start-up"
            ::= { radiusServerEntry 8 }
     
     radiusClientAccessRejects OBJECT-TYPE
          SYNTAX Counter32
          MAX-ACCESS read-only
          STATUS current
          DESCRIPTION
     "The total number of RADIUS Access-Reject messages sent since client start-up"
            ::= { radiusServerEntry  9 }
     
     radiusClientTimeouts OBJECT-TYPE
          SYNTAX Counter32
          MAX-ACCESS read-only
          STATUS current
          DESCRIPTION
     "The total number of timeouts since client startup"
            ::= { radiusServerEntry  10 }
     
     
     
     Aboba & Zorn                                                  [Page 5]


     INTERNET-DRAFT                                           25 March 1997
     
     
     radiusClientAccountingRequests OBJECT-TYPE
            SYNTAX Counter32
            MAX-ACCESS read-only
            STATUS current
            DESCRIPTION
     "The total number of RADIUS Accounting-Request messages sent
     since client start-up"
            ::= { radiusServerEntry 11 }
     
     radiusClientAccountingRetransmissions OBJECT-TYPE
            SYNTAX Counter32
            MAX-ACCESS read-only
            STATUS current
            DESCRIPTION
     "The total number of RADIUS Accounting-Request messages retransmitted
     since client start-up"
            ::= { radiusServerEntry 12 }
     
     radiusClientAccountingResponses OBJECT-TYPE
            SYNTAX Counter32
            MAX-ACCESS read-only
            STATUS current
            DESCRIPTION
     "The total number of RADIUS Accounting-Response messages received
     since client start-up"
            ::= { radiusServerEntry 13 }
     
     radiusClientAccountingBadAuthenticators OBJECT-TYPE
            SYNTAX Counter32
            MAX-ACCESS read-only
            STATUS current
            DESCRIPTION
     "The total number of RADIUS Accounting-Response messages which
     contained invalid  authenticators received since client start-up"
            ::= { radiusServerEntry 14 }
     
     -- conformance information
     
     radiusClientMIBConformance
                      OBJECT IDENTIFIER ::= { radiusClientMIB 2 }
     radiusClientMIBCompliances
                      OBJECT IDENTIFIER ::= { radiusClientMIBConformance 1 }
     radiusClientMIBGroups  OBJECT IDENTIFIER ::= { radiusClientMIBConformance 2 }
     
     
     -- compliance statements
     
     radiusClientMIBCompliance MODULE-COMPLIANCE
         STATUS  current
         DESCRIPTION
                 "The compliance statement for Clients implementing the RADIUS Client
                 MIB."
         MODULE  -- this module
             MANDATORY-GROUPS { radiusClientMIBGroup }
     
     
     
     Aboba & Zorn                                                  [Page 6]


     INTERNET-DRAFT                                           25 March 1997
     
     
         ::= { radiusClientMIBCompliances 1 }
     
     
     -- units of conformance
     
     radiusClientMIBGroup OBJECT-GROUP
         OBJECTS { radiusClientInvalidServerAddresses,
                   radiusServerAddress,
                   radiusClientAccessRequests,
                   radiusClientAccessRetransmissions,
                   radiusClientAccessAccepts,
                   radiusClientAccessChallenges,
                   radiusClientMalformedAccessResponses,
                   radiusClientAuthenticationBadAuthenticators,
                   radiusClientAccessRejects,
                   radiusClientTimeouts,
                   radiusClientAccountingRequests,
                   radiusClientAccountingRetransmissions,
                   radiusClientAccountingResponses,
                   radiusClientAccountingBadAuthenticators
                }
         STATUS  current
         DESCRIPTION
                 "The basic collection of objects providing management of
                 RADIUS Clients."
         ::= { radiusClientMIBGroups 1 }
     
     END
     
     
     7.  Security considerations
     
     All MIB variables described in this document are read-only.
     
     
     8.  Acknowledgments
     
     Thanks to Narendra Gidwani of Microsoft, Allan C. Rubens of MERIT, and
     Peter  Heitman of American Internet Corporation for useful discussions
     of this problem space.
     
     
     9.  References
     
      [1]  C. Rigney, A. Rubens, W. Simpson, S. Willens.  "Remote Authenti-
     cation  Dial  In  User Service (RADIUS)." RFC 2058, Livingston, Merit,
     Daydreamer, January, 1997.
     
     [2]  C. Rigney.  "RADIUS Accounting." RFC 2059,  Livingston,  January,
     1997.
     
     [3]  C.  Rigney,  W. Willats.  "RADIUS Extensions." draft-ietf-radius-
     ext-00.txt, Livingston, January, 1997.
     
     
     
     
     Aboba & Zorn                                                  [Page 7]


     INTERNET-DRAFT                                           25 March 1997
     
     
     [4] "Information processing systems - Open Systems  Interconnection  -
     Specification  of Abstract Syntax Notation One (ASN.1)", International
     Organization for Standardization, International Standard 8824,  Decem-
     ber 1987.
     
     [5]  Case, J., McCloghrie, K., Rose, M., and S. Waldbusser, "Introduc-
     tion to Community-based SNMPv2", RFC 1901, SNMP Research, Inc.,  Cisco
     Systems, Dover Beach Consulting, Inc., International Network Services,
     January, 1996.
     
     [6] Case, J., McCloghrie, K., Rose, M., and S. Waldbusser,  "Structure
     of  Management Information for Version 2 of the Simple Network Manage-
     ment Protocol (SNMPv2)", RFC 1902, SNMP Research, Inc., Cisco Systems,
     Dover Beach Consulting, Inc., International Network Services, January,
     1996.
     
     [7] Case, J., McCloghrie, K., Rose, M., and  S.  Waldbusser,  "Textual
     Conventions  for version 2 of the the Simple Network Management Proto-
     col (SNMPv2)", RFC 1903, SNMP Research,  Inc.,  Cisco  Systems,  Dover
     Beach Consulting, Inc., International Network Services, January, 1996.
     
     [8] Case, J., McCloghrie, K., Rose, M., and  S.  Waldbusser,  "Confor-
     mance  Statements  for  version 2 of the the Simple Network Management
     Protocol (SNMPv2)", RFC 1904,  SNMP  Research,  Inc.,  Cisco  Systems,
     Dover Beach Consulting, Inc., International Network Services, January,
     1996.
     
     [9] Case, J., McCloghrie, K., Rose, M., and S.  Waldbusser,  "Protocol
     Operations  for  Version  2  of the Simple Network Management Protocol
     (SNMPv2)", RFC 1905, SNMP Research, Inc., Cisco Systems,  Dover  Beach
     Consulting, Inc., International Network Services, January, 1996.
     
     [10] Case, J., McCloghrie, K., Rose, M., and S. Waldbusser, "Transport
     Mappings for Version 2  of  the  Simple  Network  Management  Protocol
     (SNMPv2)",  RFC  1906, SNMP Research, Inc., Cisco Systems, Dover Beach
     Consulting, Inc., International Network Services, January, 1996.
     
     [11] Case, J., McCloghrie, K., Rose, M., and S.  Waldbusser,  "Manage-
     ment  Information  Base for Version 2 of the Simple Network Management
     Protocol (SNMPv2)", RFC 1907,  SNMP  Research,  Inc.,  Cisco  Systems,
     Dover Beach Consulting, Inc., International Network Services, January,
     1996.
     
     [12] Case, J., McCloghrie, K., Rose, M., and S.  Waldbusser,  "Coexis-
     tence between Version 1 and Version 2 of the Internet-standard Network
     Management Framework", RFC 1908, SNMP Research, Inc.,  Cisco  Systems,
     Dover Beach Consulting, Inc., International Network Services, January,
     1996.
     
     [13] McCloghrie, K., "An Administrative  Infrastructure  for  SNMPv2",
     RFC 1909, Cisco Systems, February, 1996.
     
     
     
     
     
     
     Aboba & Zorn                                                  [Page 8]


     INTERNET-DRAFT                                           25 March 1997
     
     
     10.  Authors' Addresses
     
     Bernard Aboba
     Microsoft Corporation
     One Microsoft Way
     Redmond, WA 98052
     
     Phone: 206-936-6605
     EMail: bernarda@microsoft.com
     
     Glen Zorn
     Microsoft Corporation
     One Microsoft Way
     Redmond, WA 98052
     
     Phone: 206-703-1559
     EMail: glennz@microsoft.com
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     Aboba & Zorn                                                  [Page 9]