module dot1Xv2 { namespace "ieee:ns:yang:ieee-port-dot1x"; prefix "dot1x"; import ieee-types { prefix ieee; } import ietf-yang-types { prefix yang; } import ietf-interfaces { prefix if; } organization "Institute of Electrical and Electronics Engineers"; contact "Web URL: http://ieee.org/ E-mail: corporate-communications@ieee.org Postal: U.S.A. Phone: +1 732-563-6820 Fax: +1 732-981-9511"; description "Port-based network access control allows a network administrator to restrict the use of IEEE 802 LAN service access points (ports) to secure communication between authenticated and authorized devices. IEEE Std 802.1X specifies an architecture, functional elements, and protocols that support mutual authentication between the clients of ports attached to the same LAN and secure communication between the ports. The following control allows a port to be reinitialized, terminating (and potentially restarting) authentication exchanges and MKA operation, based on a data model described in a set of YANG modules."; revision "2015-03-10" { description "Initial Version."; reference "IEEE 802.1X-2014, PAE (Port Access Entity) management information model."; } /* * Type definitions used by dot1X YANG module */ typedef nidType { type string { // Need to confirm this. length "0..100"; } } typedef sessionUserNameType { description "utf8 definition"; type string { length "0..253"; } } typedef sessionIdType { description "utf8 definition"; type string { length "3..253"; } } typedef accessCapabilitiesType { type bits { bit eap { position 0; } bit mka { position 1; } bit macsec { position 2; } bit higher-layer { position 3; } bit higher-layer-fallback { position 4; } bit vendor-specific { position 5; } } } typedef portNumberType { type uint16; } typedef keyNumberType { type uint32; } typedef associationNumberType { type uint16; } typedef sciListType { // To be defined. type uint16; } typedef cknType { // To be defined. type uint16; } typedef kmdType { // To be defined. type uint16; } typedef authType { // To be defined. type uint16; } typedef cipherSuitesType { // Structure to be defined. type uint16; } grouping nidGroup { list paeNidGroup { key "nids"; leaf nids { type sessionUserNameType; } leaf use-eap { type enumeration { enum never; enum immediate; enum mka-fail; } default "immediate"; description "Determines when the Logon Process will initiate EAP, if the Supplicant and or Authenticator are enabled."; } leaf unauth-allowed { type enumeration { enum never; enum immediate; enum auth-fail; } default "immediate"; description "Determines when the Logon Process will tell the CP state machine to provide unauthenticated connectivity."; } leaf unsecure-allowed { type enumeration { enum never; enum immediate; enum mka-fail; enum mka-server; } default "immediate"; description "Determines when the Logon Process will tell the CP state machine to provide authenticated but unsecured connectivity."; } leaf unauthenticated-access { type enumeration { enum no-access; enum fallback-access; enum limited-access; enum open-access; } default "no-access"; } leaf access-capabilities { type accessCapabilitiesType; description "Authentication mechanisms."; } } } grouping nidGroupState { list paeNidGroup { key "nids"; leaf nids { type sessionUserNameType; } leaf kmd { type kmdType; } leaf nid { type nidType; } } } feature pacp-eap-supplicant { description "This feature indicates that the device supports a PACP EAP Supplicant."; } feature pacp-eap-authenticator { description "This feature indicates that the device supports a PACP EAP Authenticator."; } feature mka { description "This feature indicates that the device supports MKA"; } feature macsec { description "This feature indicates that the device supports MACsec on the Controlled Port."; } feature announcements { description "This feature indicates that the device supports the ability to send EAPOL announcements."; } feature listener { description "This feature indicates that the device supports the ability to use receive EAPOL announcements."; } feature virtual-ports { description "This feature indicates that the device supports the virtual ports for a real port."; } feature in-service-upgrades { description "This feature indicates that the device supports MKA in-service upgrades."; } // Configuration objects used by 802.1X YANG module // PAE object container pae-system { leaf system-access-control { type enumeration { enum disabled; enum enabled; } description "Setting this control to 'disabled' deletes any virtual ports previously instantiated, and terminates authentication exchanges and MKA operation. Each real port PAE behaves as if enabledVirtualPorts was clear, the PAEs Supplicant, Authenticator, and KaY as if their enabled controls were clear, and Logon Process(es) as if unauthAllowed was Immediate. Announcements can be transmitted (subject to other controls), both periodically and in response to announcement requests (conveyed by EAPOL-Starts or EAPOL-Announcement-Reqs) but are sent with a single NID Set, with a null NID, and the Access Information TLV (and no other) with an accessStatus of No Access, accessRequested false, OpenAccess, and no accessCapabilities. The control variable settings for each real port PAE are unaffected, and will be used once systemAccessControl is set to 'enabled'"; } leaf system-announcements { type enumeration { enum disabled; enum enabled; } description "Setting this control to Disabled causes each PAE to behave as if enabled were clear for the PAE's Announcement functionality. The independent controls for each PAE apply if systemAnnouncements is Enabled."; } leaf eapol-protocol-version { type uint32; description "The EAPOL protocol version for this system."; } leaf mka-version { type uint32; description "The MKA protocol version for this system."; } } /* * Port Authentication Entity (PAE) Object */ augment "/if:interfaces/if:interface" { //when "if:type = 'ianaif:macSecControlledIF'"; leaf vp-enable { if-feature virtual-ports; type boolean; description "A real port's PAE may be configured to create virtual ports to support mlti-access LANs provided that MKA and MACsec operation is enabled for that port."; } leaf port-type { description "The port type of the PAE."; type enumeration { enum real-port; enum virtual-port; } } /* * Suppplicant only applicable to RealPort types. */ container supplicant { leaf held-period { type uint16; units seconds; default "60"; } leaf retry-max { type uint8; default "2"; description "Specifies the maximum number of re-authentication attempts on an authenticator port before port is unauthorized."; } } /* * Authenticator */ container authenticator { leaf quiet-period { type uint16; units seconds; default "60"; description "Number of seconds that the switch remains in the quiet state following a failed authentication exchange with the client"; reference "IEEE 802.1X Clause 8.6, Figure 12-3"; } leaf reauth-period { type uint16; units seconds; default "3600"; description "This object indicates the time period of the reauthentication to the supplicant."; reference "IEEE 802.1X Clause 8.6, Figure 12-3"; } leaf retry-max { type uint8; default "2"; description "Specifies the maximum number of re-authentication attempts on an authenticator port before port is unauthorized."; } } /* * MKA */ container kay { leaf enable { type boolean; default "true"; } container actor { leaf priority { type uint8; default "0"; } container sci { leaf mac-address { type ieee:mac-address; } leaf port-id { type portNumberType; } } } container key-server { leaf priority { type uint8; default "0"; } container sci { leaf mac-address { type ieee:mac-address; } leaf port-id { type portNumberType; } } } container group { leaf join { type boolean; } leaf form { type boolean; } leaf new { type boolean; } } container macsec { leaf capable { type boolean; default "false"; } leaf desired { type boolean; default "false"; } } leaf suspend-on-request { type boolean; default "false"; } leaf suspend-for { type uint8; default "0"; } leaf suspend-while { type uint8; default "0"; } /* * Participants */ list participant { key "participants"; leaf participants { type uint16; } leaf cached { type boolean; default "false"; } leaf active { type boolean; default "false"; } leaf retain { type boolean; default "false"; } leaf activate { type enumeration { enum principal; enum livePeers; enum potential-peers; enum distCKN; } default "principal"; } container peers { leaf live { type sciListType; } leaf potential { type sciListType; } } leaf ckn { type cknType; } leaf kmd { type kmdType; } leaf nid { type nidType; } leaf auth-data { type authType; } leaf principal { type boolean; } leaf distCKN { type cknType; } } } /* * Logon NIDs */ container logon-nid { leaf selected { type nidType; } uses nidGroup; } /* * Announcer */ container announcer { leaf enable { type boolean; default "false"; } list announce { key "announces"; leaf announces { type uint16; } leaf nid { type nidType; } } uses nidGroup; } /* * Listener */ container listener { leaf enable { type boolean; default "false"; } } } augment "/if:interfaces-state/if:interface" { //when "if:type = 'ianaift:macSecControlledIF'"; leaf controlled-port-number { config false; type portNumberType; } leaf uncontrolled-port-number { config false; type portNumberType; } leaf common-port-number { type portNumberType; } container virtual-port { if-feature virtual-ports; leaf max { type uint32; } leaf current { type yang:gauge32; } leaf start { type uint32; } leaf peer-address { type ieee:mac-address; } } /* * Suppplicant only applicable to RealPort types. */ container supplicant { leaf enabled { type boolean; } leaf authenticate { type boolean; } leaf authenticated { type boolean; } leaf failed { type boolean; } } /* * Authenticator */ container authenticator { leaf enabled { type boolean; } leaf authenticate { type boolean; } leaf authenticated { type boolean; } leaf failed { type boolean; } } /* * MKA */ container kay { container actor { container sci { leaf mac-address { type ieee:mac-address; } leaf port-id { type portNumberType; } } } container key-server { container sci { leaf mac-address { type ieee:mac-address; } leaf port-id { type portNumberType; } } } container macsec { leaf protect { type boolean; } leaf validate { type boolean; } leaf replay-protect { type boolean; } } leaf active { type boolean; } leaf authenticated { type boolean; } leaf secured { type boolean; } leaf failed { type boolean; } leaf txKN { type keyNumberType; } leaf rxKN { type keyNumberType; } leaf txAN { type associationNumberType; } leaf rxAN { type associationNumberType; } /* * Participants */ list participant { key "participants"; leaf participants { type uint16; } container peers { leaf live { type sciListType; } leaf potential { type sciListType; } } leaf ckn { type cknType; } leaf kmd { type kmdType; } leaf nid { type nidType; } leaf auth-data { type authType; } leaf principal { type boolean; } leaf distCKN { type cknType; } } } /* * Logon NIDs */ container logon-nid { leaf connected { type nidType; } leaf requested { type nidType; } uses nidGroup; } /* * Announcer */ container announcer { list announce { key "announces"; leaf announces { type uint16; } leaf nid { type nidType; } leaf access-status { // Need to confirm these types. type enumeration { enum no-access; enum acess-requested-fail; enum open-access; enum no-access-capabilities; } } } uses nidGroupState; } /* * Listener */ container listener { list announcement { key "announcements"; leaf announcements { type uint8; } leaf nid { type nidType; } leaf kmd { type kmdType; } leaf specific { type boolean; } leaf access-status { // Need to confirm these types. type enumeration { enum no-access; enum acess-requested-fail; enum open-access; enum no-access-capabilities; } } leaf requested-nid { type boolean; } leaf unauthenticated-access { // Need to confirm these types. type enumeration { enum no-access; enum acess-requested-fail; enum open-access; enum no-access-capabilities; } } leaf access-capabilities { type accessCapabilitiesType; } leaf cipher-suites { type cipherSuitesType; } } } /* * EapolStatistics */ container eapol-statistics { leaf invalid-eapol-frame-rx { type yang:counter32; } leaf eap-length-error-frames { type yang:counter32; } leaf eapol-announcements-rx { type yang:counter32; } leaf eapol-announce-reqs-rx { type yang:counter32; } leaf eapol-port-unavailable { type yang:counter32; } leaf eapol-start-frames-rx { type yang:counter32; } leaf eapol-eap-frames-rx { type yang:counter32; } leaf eapol-logoff-frames-rx { type yang:counter32; } leaf eapol-mk-no-cfn { type yang:counter32; } leaf eapol-mk-invalid-frames-rx { type yang:counter32; } leaf last-eapol-frame-source { type ieee:mac-address; } leaf last-eapol-frame-version { type yang:counter32; } leaf eapol-supp-eap-frames-tx { type yang:counter32; } leaf eapol-logoff-frames-tx { type yang:counter32; } leaf eapol-announcements-tx { type yang:counter32; } leaf eapol-announce-reqs-tx { type yang:counter32; } leaf eapol-start-frames-tx { type yang:counter32; } leaf eapol-auth-eap-frames-tx { type yang:counter32; } leaf eapol-mka-frames-tx { type yang:counter32; } } } container nid-group { uses nidGroup; } }