Managing Networks, Users & Applications in the New Millennium

Transcription

1 Managing Networks, Users & Applications in the New Millennium John Thomas 1

2 Agenda What is Network Management? Current Architecture(s) Two New Architectures Examples Concluding Remarks 2

3 Network Management s Primary Role Validate user experience connectivity, response times Anticipate network change failures, growth, user mobility, new apps online Enforce conformance with corporate policies user auditing/control, user/application differentiation Report findings to management who s not happy, what s my ROI Identify how to leverage network as an asset marketing! 3

4 NetMgmt Must Grow w/ Networking Trends Users more mobile, demanding & skilled expected to conform to corporate policies (e.g. URL blocking) Applications more delay sensitive, bandwidth hungry (aka multimedia) unsupported apps on network (e.g. DOOM) Both Users & Applications Have Increased dependency on network Require Service Level differentiation 4

5 NetMgmt Must Grow w/ Networking Trends New Network Designs Intranets Extranets VPNs Traffic Patterns (e.g. unexpected congestion points) increasingly short-lived flows (e.g. WEB) dynamic ports encryption n-tiered architectures 5

6 Agenda What is Network Management? Current Architecture(s) Two New Architectures Examples Concluding Remarks 6

7 Current Network Management Architecture 3rd Party Apps Cisco Apps SAP BMC Patrol MRTG NMS Platform Standardsbased protocols Intelligent Network Devices NMS Framework e.g. HP OV SNMP SNMP, RMON, Telnet, ICMP Management Instrumentation & Control Mechanisms High Performance, Robust Network Infrastructure 7

8 SNMP owned the 90s Motivation behind SNMP manage heterogeneous networking devices (not systems, users or applications) enhancement of SGMP console consolidation SNMP Architecture Intelligent Managers, dumb Agents TRAP-directed polling (unreliable) Clear-text communities MIBs document what is available from a device 8

9 SNMP Needs help in the 00s SNMP is practical & will live-on, but Security in V3 required for more configuration control Unwieldy instancing/indexing makes life difficult Not Extranet friendly (typically not allowed thru FW) MIB s continue to pro-create, but don t define relationships 9

10 NMS/Frameworks Still useful But - eliminate duplication of efforts (e.g. fault mgmt) provide structured, documented integration Proprietary APIs slow development from ISVs Integration today requires application co-location, which complicates software install system admin & maintenance Common place to represent each device, but not store it s information 10

11 Report Card - Current Network Management Architecture Apps #1 App #2 App #3 App #4 NMS SNMP, RMON, Telnet, ICMP Management Instrumentation & Control Mechanisms High Performance, Robust Network Infrastructure 11

12 What will happen to our friends? SNMP will continue to be a good data collection mechanism You can manage a device with SNMP, not a network Remember - Simple Network Management Protocol NMS Frameworks become a node on the Management Intranet the architectures of the prior generation of management products are not likely to dominate the market over the next five years September 1999 Susan Aldrich - Patricia Seybold Group James Herman & Theodore Forbath - Northeast Consulting Resources 12

13 Agenda What is Network Management? Current Architecture(s) Two New Architectures - WBEM - DEN Examples Concluding Remarks 13

14 WBEM Network Management Architecture XML/CIM Management Intranet BMC Patrol Cisco App #1 NMS App #n Microsoft Standardsbased protocols Intelligent System SNMP, RMON, Telnet, ICMP, HTTP, COPS, DMI Management Instrumentation & Control Mechanisms High Performance, Robust Network Infrastructure 14

15 WBEM Built Upon DMTF s CIM WBEM initiative Cisco, Compaq, Microsoft, Intel, BMC - Build a Common Information Model(CIM) for management - Harness the power of the Web for management interoperation => CIM & XML make up the WBEM core technology 15

16 So What is CIM? The Common Information Model (CIM) defines the Schemas used to represent the real-world objects being managed. CIM uses an objectoriented paradigm, where manageable objects and their inter-relationships are modeled using the concepts of classes and instances. Vendors extend the standard classes to represent unique feature/functions. It may be helpful to think of CIM as standard and extended MIBs that also include relationship definitions 16

17 What Is CIM(2)? An object-oriented information model A conceptual framework within which any information system may be modeled independent of repository and implementation standardizes data and reduces its complexity Supports enterprise-wide (vs. node-centric) management of data Allows integration of management information from different sources with different syntaxes 17

18 What is CIM (3)? Core Model Captures information that is applicable to all knowledge domains Common Models Information common to particular management areas, but independent of a particular technology or implementation. Include Systems, Applications, Devices, Networks, Databases, and Events Extension Models Represent vendor or technology-specific extensions that are often dependent on a particular environment or platform 18

19 Why Object Oriented? Why Not Just a Schema Network elements and services differ from other directory objects Standard objects are simple and exist within static boundaries a user is always a user Network elements and services are complex objects and exist in a constantly changing environment a modular switch can change functions Product Service Network Device Customer Must model the interaction between network elements, network services, the network, and clients of the network 19

20 Elements of CIM CIM object-oriented building blocks Object Class (type) Inheritance (reuse, vendor extension) Associations and aggregations (relationships between objects) Cardinality (number of components that participate in each side of a relationship) Methods (interaction with objects) Constraints and meta-data (how an object or relationship is used) Perhaps CIM s most important differentiator from previous standards is its ability to show the relationships between different elements and components that make up a computer system or a corporate network Elisabeth Horwitt 20

21 Building Blocks of CIM Managed Objects in CIM PhysicalElement and LogicalElement Provides ability to abstract a complex object (such as a router) into its physical and logical aspects Wide range of applicability (from wires and chips through routers, switches, desktop computers, and systems) Associations and Aggregations Describes relationships between two classes and the characteristics of that relationship Example: A Service (OSPF) runs inside a Physical Element (a router) and an association is used to describe that relationship 21

22 Using the Building Blocks of CIM Physical Realization Information Model Logical Representation ManagedSystemElement Name: string Description: string Caption: string Status: PhysicalPackage string InstallDate: datetime Removable: boolean PhysicalFrame Replaceable: boolean HotSwappable: boolean Height: real32 Depth: real32 Width: real32 Weight: real32 Instance PhysicalElement Name: "RouterRack" Description: "Rack used used to store store routers" routers" Description: Caption: "" "" "Rack used to store routers" CreationClassName: string [key] Caption: Status: "In Use" Status: "In Use" "" Tag: string [key] InstallDate: 8/19/ :53 AM Status: InstallDate: "In 8/19/1994 Use" 10:53 AM CreationClassName: "Rack" Manufacturer: string InstallDate: CreationClassName: Tag: "A " 8/19/1994 "Rack" 10:53 AM Model: string Manufacturer: "Rack-Em-Up Inc." Tag: "A " Model: "R4-10x15" CableManagementStrategy: SKU: string string Manufacturer: SKU: " " "Rack-Em-Up Inc." SerialNumber: string SerialNumber: "REU " ServicePhilosophy: uint16 [ ] Model: "R4-10x15" PartNumber: "REU152 ServiceDescriptions: Version: string SKU: " " PhysicalElement string [ ] Removable: False False PartNumber: string Replacable: False LockPresent: SerialNumber: Replacable: False "REU " HotSwappable: False AudibleAlarm: CreationClassName: OtherIdentifyingInfo: booleanstring [key] PartNumber: HotSwappable: Height: "8 ft" "REU152" False Tag: PoweredOn: string [key] boolean Depth: "18 in" VisibleAlarm: boolean Height: Width: "18 in" PhysicalFrame "8 ft" SecurityBreach: Manufacturer: string uint16 Depth: Weight: "92"18 lbs in" CableManagementStrategy: "RatsNest" BreachDescription: Model: string string Width: "18 in" "RatsNest" CableManagementStrategy: string LockPresent: True SKU: string Weight: LockPresent: "92 lbs True ServicePhilosophy: IsLocked: Rack boolean SerialNumber: PhysicalPackage uint16 [ ] Chassis IsLocked: True string IsLocked: TypeOfRack: True17 ServiceDescriptions: string [ ] TypeOfRack: LockPresent: Version: uint16 string NumberOfPowerCords: CountryDesignation: uint16 "USA" Removable: CountryDesignation: boolean PartNumber: string Replaceable: CurrentRequiredOrProduced: sint16 AudibleAlarm: boolean OtherIdentifyingInfo: HotSwappable: string HeatGeneration: uint16 VisibleAlarm: 0..1 boolean PoweredOn: Height: real32 boolean ChassisTypes: uint16 [ ] SecurityBreach: uint16 Depth: real32 TypeDescriptions: string [ ] BreachDescription: Width: real32 string IsLocked: booleanchassisinrack Weight: real32 22

23 Using the Building Blocks of CIM Physical Realization Information Model Logical Representation ManagedSystemElement Name: string Description: string Caption: string Status: PhysicalPackage string InstallDate: datetime Removable: boolean PhysicalFrame Replaceable: boolean HotSwappable: boolean Height: real32 Depth: real32 Width: real32 Weight: real32 PhysicalElement Instance CreationClassName: string [key] Tag: string [key] Manufacturer: string Model: string CableManagementStrategy: SKU: string string ServicePhilosophy: SerialNumber: string uint16 [ ] ServiceDescriptions: Version: string PhysicalElement string [ ] LockPresent: PartNumber: boolean string AudibleAlarm: CreationClassName: OtherIdentifyingInfo: boolean string string [key] VisibleAlarm: Tag: PoweredOn: string [key] boolean boolean PhysicalFrame SecurityBreach: Manufacturer: string uint16 CableManagementStrategy: BreachDescription: Model: string string string ServicePhilosophy: IsLocked: SKU: Rack string boolean SerialNumber: PhysicalPackage uint16 [ ] Chassis ServiceDescriptions: string string [ ] TypeOfRack: LockPresent: Version: uint16 string Removable: boolean CountryDesignation: AudibleAlarm: PartNumber: string Replaceable: boolean OtherIdentifyingInfo: HotSwappable: string HeatGeneration: uint16 VisibleAlarm: 0..1 boolean PoweredOn: Height: real32 boolean ChassisTypes: uint16 [ ] SecurityBreach: uint16 Depth: real32 TypeDescriptions: string [ ] BreachDescription: Width: real32 string IsLocked: booleanchassisinrack Weight: real32 Rack: Name= Rack 1 ChassisInRack NumberOfPowerCords: uint16 CurrentRequiredOrProduced: sint16 ChassisInRack ChassisInRack Chassis: Name= Chas A Chassis: Name= Chas B Chassis: Name= Chas D 23

24 Using the Building Blocks of CIM Physical Realization Information Model Logical Representation ManagedSystemElement Name: string Description: string Caption: string Status: PhysicalPackage string InstallDate: datetime Removable: boolean PhysicalFrame Replaceable: boolean HotSwappable: boolean Height: real32 Depth: real32 Width: real32 Weight: real32 PhysicalElement CreationClassName: string [key] Tag: string [key] Manufacturer: string Model: string CableManagementStrategy: SKU: string string ServicePhilosophy: SerialNumber: string uint16 [ ] ServiceDescriptions: Version: string PhysicalElement string [ ] LockPresent: PartNumber: boolean string AudibleAlarm: CreationClassName: OtherIdentifyingInfo: boolean string string [key] VisibleAlarm: Tag: PoweredOn: string [key] boolean boolean PhysicalFrame SecurityBreach: Manufacturer: string uint16 CableManagementStrategy: BreachDescription: Model: string string string ServicePhilosophy: IsLocked: SKU: Rack string boolean SerialNumber: PhysicalPackage uint16 [ ] Chassis ServiceDescriptions: string string [ ] TypeOfRack: LockPresent: Version: uint16 string Removable: boolean CountryDesignation: AudibleAlarm: PartNumber: string Replaceable: boolean OtherIdentifyingInfo: HotSwappable: string HeatGeneration: uint16 VisibleAlarm: 0..1 boolean PoweredOn: Height: real32 boolean ChassisTypes: uint16 [ ] SecurityBreach: uint16 Depth: real32 TypeDescriptions: string [ ] BreachDescription: Width: real32 string IsLocked: booleanchassisinrack Weight: real32 NumberOfPowerCords: uint16 CurrentRequiredOrProduced: sint16 Rack: ChassisInRack Chassis: Name= Rack 1 Name= Chas A Rack: Name= Rack 2 ChassisInRack Chassis: Name= Chas B Chassis: Name= Chas D Chassis: Name= Chas A Chassis: Name= Chas C Chassis: Name= Chas D 24

25 XML Extensible Markup Language a simplified derivative of SGML XML structures data it uses TAGs much like HTML with an unambiguous grammar Transported using HTTP Used to encode CIM data for exchange between management stations Courtesy of the W3C (not DMTF) 25

26 HTML Example <html> <head> <title>welcome to Harvard University</title> <meta name="keywords" content="harvard University Harvard University Harvard College Harvard College Harvard University Harvard University Harvard College Harvard College"> <meta name="description" content= "The Harvard University Homepage: an overview of academic programs, campus life, resources, news and events, with extensive links to other web sites located throughout the University."> <script language="javascript"> <!-- //Create array of nav bar "on" images 26

27 XML / CIM Example <?XML version="1.0" > <!DOCTYPE CIM SYSTEM " <CIM CIMVERSION="2.0" DTDVERSION="1.0" > <CLASS> <CLASSPATH> <NAMESPACEPATH> <ROUTER>WBEM_ROUTER_2</ROUTER> <NAMESPACE> <NAMESPACENODE>ROOT</NAMESPACENODE> <NAMESPACE> <NAMESPACENODE>CIMV2</NAMESPACENODE> </NAMESPACE> </NAMESPACE> </NAMESPACEPATH> <CLASSNAME>CIM_ManagedSystemElement</CLASSNAME> </CLASSPATH> <QUALIFIER NAME="Abstract" LOCAL="true" TYPE="boolean OVERRIDABLE="EnableOverride 27

28 Agenda What is Network Management? Current Architecture(s) Two New Architectures - WBEM - DEN Examples Concluding Remarks 28

29 DEN Network Management Architecture Unifying Model LDAPv3 based Directory Management Intranet BMC Patrol Cisco App #1 NMS App #n Microsoft Standardsbased protocols Intelligent System SNMP, RMON, Telnet, ICMP, HTTP, COPS, DMI Management Instrumentation & Control Mechanisms High Performance, Robust Network Infrastructure 29

30 DEN Bridges CIM and LDAP DEN is both an information model and a directory mapping Major portions integrated into the Core and Common Models Specifies a mapping to a directory Adds classes specifically for mapping Translates relationships Mapping is not automatic, but a separate activity of specification Could specify additional mappings 30

31 DEN Extends DMTF s CIM WBEM initiative Cisco, Compaq, Microsoft, Intel, BMC - Build a Common Information Model(CIM) for management - Harness the power of the Web for management interoperation => CIM & XML make up the WBEM core technology DEN Initiative Cisco, Microsoft - An extension of CIM focused on modeling network elements and services - An optimized mapping that assumes a directory as the data repository => CIM & LDAPv3/Directory make up the DEN core technology Cisco will continue to innovate, then standardize... 31

32 DEN Extends CIM DEN CIM LDAP Schema Mappings v2.1 v2.2 v2.3 System Policy User Core Apps Database Logical Network Physical Device Extension Schema 32

33 What Does DEN Consist Of? Physical Sub-Model Physical structure and connectivity of network devices; enhanced to model other objects Logical Sub-Model Logical connectivity and topology, network services, protocols, and administrative domains; hooks for defining interaction with users and other entities Policy Sub-Model How entities are controlled and provisioned Set of mappings to a Directory 33

34 Why use an LDAP Directory? A special purpose database optimized for reads Contain user, group & application info Facilitate finding info Highly distributed, scalable by design Replicated for High Availability LDAP provides standardization Simply, because it is there and business already knows how to use it, and.. It provides information containment, security and descriptive power. John Strassner - the father of DEN 34

35 CIM / DEN Value Proposition Integration of end systems, networks, and users into one coherent model Common model enables centralized repository for common information Common representation of information enables different applications to share and reuse data Device-dependent repositories are costly and don t scale Enables Binding people to services Policy-based management requires a network-wide model rather than a device specific one 35

36 Agenda What is Network Management? Current Architecture(s) New Architectures Examples - WBEM - DEN Concluding Remarks 36

37 WBEM Example #1 CW2000 Management Intranet Heterogeneous Management Servers Inventory CIM/XML CIM/XML Device ID AssetView 37

38 Cisco s Management Intranet Ecosystem Partnerships Partnerships 38

39 Example #2 - Using XML to Exchange Data Service Service Management Management Q1 00 CiscoWorks 2000 Service Level Management Suite Measure & report on performance & availability for VPNs, VoIP, QoS, etc. Extensible application with open data access 39

40 Service Level Manager End to End Scenario Service Service Management Management Q1 00 Head Office VPN-Gwy-SFO Router-Chicago Lan Users Router-NewYork Wwwin-HR NAS ISP Branch Office Dial-User Mass RTP Irvine SC# Verified by Sorce Destination How tested SLAM SLA Type Comments 1 Inverse LAN-Users to wwwin-hr HTTP End to end test 2 Cisco Router-NewYork - VPN-Gwy-SFO PING ICMP 3 Cisco VPN-Gwy-SFO - wwwin-hr Http HTTP 4 Inverse Dial-User - wwwin-hr RAS Connectivity 5 Cisco VPN-Gwy-SFO - RTP, Irvine, Mass Jitter VoIP 40

41 Reporting End to End Service Levels Service Service Management Management Q1 00 Edge to Edge Edge to Service 41

42 Agenda What is Network Management? Current Architecture(s) New Architectures Examples - WBEM - DEN Concluding Remarks 42

43 DEN Example #1 CiscoAssure User Policies Users identified by - login ID (NT/NDS) - IP/MAC address - DNS name Sample policies include - Admission control (VLAN membership, Firewalling) - Network Connectivity - Service Availability - Preferential treatment (QoS) 43

44 User Policies Available Today - Done Without DEN HR HR21 LOGIN VLAN ( /24) HR Sales Sales20 Sales 1. Get DHCP on LOGIN VLAN 2. Login to NT/NDS 3. URT.BAT downloaded/executed login info sent to URT server URT server configures switch for appropriate VLAN client release/renew IP DHCP URT CW2000 NT/NDS Domain Sales VLAN ( /24) Controller HR VLAN ( /24) 44

45 User Policies w/ DEN USER assigned to OU/Group Directory & Domain Controller Client PC USER logs in to Msoft or NDS domain controller Application Server URT maps User or OU/Group to USER Class URT Server USER Class mapped to IP Pool CNR DHCP Server Slow Link QPM sets QoS policy by USER class Router directs USER session to QPM specified queue QPM Server 45

46 Cisco Qos Policy Manager Directory Support QPM will support major enterprise Directory Services via LDAPv3 Initially certify with: Active Directory iplanet Directory Service then later certify with: NDS SecureWay Directory Service IETF policy standards and DMTF CIM and DEN compliant Based on IETF drafts for Core and QoS policy schema and information model 46

47 QoS Policy Manager Directory Enabled Networking Summer 2000 Functionality Enable user-based policies by reading from directory the user group to address bindings made by Cisco DHCP (CNR) Share policy by exporting QoS policies to directory eg HP WebQoS reads QPM policy to enforce similar QoS on server Future directions Read user or application profiles including QoS requirements 47

48 COPS is key for dynamic, scalable policy provisioning Common Open Policy Service Protocol for policy decision point (PDP) to policy enforcement point (PEP) communication Provides negotiation & capabilities discovery, dynamic policies Roles (labels) are assigned to network interfaces COPS-RSVP for policing signaled QoS IETF RFC standard enables device to query policy server for policy decision upon receiving RSVP request from host for QoS COPS-PR for Provisioning draft stage promise of multi-vendor interoperability standardized protocol standard PIB for representing policies to devices 48

49 DEN Example #2 CNS/AD (for SPs) Fault Management Network Devices Performance and Planning Desktop, Net and Server Net Device and App Server Managed Entities Network Services Service Definition and User Subscription L2/L3 Provisioning LDAP, Event Based User and Enterprise Profile Info Configure Segments of the Network Network Configuration Accounting Billing Manage Segments of the Network FCAPS Usage Based Authentication, Credentials VPN, TagVPN, Data Encryption Integrated User Network User and Network Security Security Security Network Management Network Resources 49

50 Enterprise A CNS/AD (UNIX) Cisco Networking Services for Active Directory CNS/AD (NT) Implementation Example AD CNS/AD (UNIX) Service Provider CNS/AD (UNIX) CNS/AD (UNIX) CNS/AD Mobile User Customer DB Integrated directories: Within enterprise Enterprise and ISP Trusted relationship between directories CNS/AD (NT) AD Provisioning Server CNS/AD (NT) Policy Server Enterprise B 50

51 Cisco Networking Services for Active Directory (CNS/AD) CNS/AD provides: A secure, scalable, and distributed event-based infrastructure for device signaling A dynamic, replicable repository for maintaining a variety of user and network data A standard set of APIs for applications to be easily written and extended For the rapid definition and provisioning of network services For the association of users, applications, and network services An integrated set of authentication services 51

52 CNS/AD Foundation Classes and Objects CNS/AD schema is built upon the active directory schema and the DEN foundation classes and objects. Cisco Networking Services for Active Directory (For Example: Cisco Devices, Cisco IOS Services, CNS Services, IP Address Management, Physical and Logical Topologies) Directory Enabled Networks (For Example: Network Device, Network Protocol, Network Media, Network Service, Profile, and Policy) Active Directory NOS Objects (For Example: User, Computer, Printer, Application, Group Policy Object) Active Directory Domain Configuration and Management (For Example: Site, Replication, Schema, Global Catalogue) 52

53 Agenda What is Network Management? Current Architecture(s) New Architectures Examples Concluding Remarks 53

54 Network Management Looking Forward Unifying Model LDAPv3 based Directory Management Intranet BMC Patrol Cisco App #1 NMS App #n XML/CIM Microsoft Standardsbased protocols Intelligent System SNMP, RMON, Telnet, ICMP, HTTP, COPS, DMI Management Instrumentation & Control Mechanisms High Performance, Robust Network Infrastructure 54

55 Cheat Sheet CIM schemas = extensible MIBs + relationships XML defines data like HTML defines page layout Directory is a distributed, unifying data store LDAPv3 defines the access mechanism to the Directory WBEM s focus is management interoperability from desktop thru network to server/appl. DEN adds models for network devices & svcs COPS - key to dynamic, scalable policy provisioning 55

56 SNMP+ LAN Managers Web-based Management Revolution Enterprise Frameworks HP, Tivoli, CA WBEM Initiative Early Web UIs DEN Initiative CiscoWorks2000 Cisco Management Connection QoS Policy Manager 2.0 Cisco Network Registrar WBEM/DEN ratified Ubiquitous enterprise Directory Services Windows 2000 (WMI, Active Directory) CIM Work Continues /1 56

57 CIM Roadmap CIM 2.0 Past Future CIM 2.1 CIM 2.2 CIM 2.3 Core System Device Physical Network User Policy Final DEN Draft Final DEN Draft Submitted to DMTF Additional First CIMfi LDAP CIMfi LDAP Mappings Mappings (Network, etc.) (Physical) Update to DEN Specification 57

58 Credits Content from the following WEB sites was used to build this presentation: 58

59 Please Complete Your Evaluation Form: Managing Networks, Users & Applications in the New Millennium 59

60 Make your plans to attend Cisco Networkers 2000! Las Vegas, NV - June Orlando, FL - July