VPN Manager. User Guide. Document 5150

Transcription

1

2 Notice Copyright Notice Copyright 2003 by Aprisma Management Technologies, Inc. All rights reserved worldwide. Use, duplication, or disclosure by the United States government is subject to the restrictions set forth in DFARS (c)(1)(ii) and FAR Liability Disclaimer Aprisma Management Technologies, Inc. ( Aprisma ) reserves the right to make changes in specifications and other information contained in this document without prior notice. In all cases, the reader should contact Aprisma to inquire if any changes have been made. The hardware, firmware, or software described in this manual is subject to change without notice. IN NO EVENT SHALL APRISMA, ITS EMPLOYEES, OFFICERS, DIRECTORS, AGENTS, OR AFFILIATES BE LIABLE FOR ANY INCIDENTAL, INDIRECT, SPECIAL, OR CONSEQUENTIAL DAMAGES WHATSOEVER (INCLUDING BUT NOT LIMITED TO LOST PROFITS) ARISING OUT OF OR RELATED TO THIS MANUAL OR THE INFORMATION CONTAINED IN IT, EVEN IF APRISMA HAS BEEN ADVISED OF, HAS KNOWN, OR SHOULD HAVE KNOWN, THE POSSIBILITY OF SUCH DAMAGES. Trademark, Service Mark, and Logo Information SPECTRUM, IMT, and the SPECTRUM IMT/VNM logo are registered trademarks of Aprisma Management Technologies, Inc., or its affiliates. APRISMA, APRISMA MANAGEMENT TECHNOLOGIES, the APRISMA MANAGEMENT TECHNOLOGIES logo, MANAGE WHAT MATTERS, DCM, VNM, SpectroGRAPH, SpectroSERVER, Inductive Modeling Technology, Device Communications Manager, SPECTRUM Security Manager, and Virtual Network Machine are unregistered trademarks of Aprisma Management Technologies, Inc., or its affiliates. For a complete list of Aprisma trademarks, service marks, and trade names, go to: All referenced trademarks, service marks, and trade names identified in this document, whether registered or unregistered, are the intellectual property of their respective owners. No rights are granted by Aprisma Management Technologies, Inc., to use such marks, whether by implication, estoppel, or otherwise. If you have comments or concerns about trademark or copyright references, please send an to spectrum-docs@aprisma.com; we will do our best to help. Restricted Rights Notice (Applicable to licenses to the United States government only.) This software and/or user documentation is/are provided with RESTRICTED AND LIMITED RIGHTS. Use, duplication, or disclosure by the government is subject to restrictions as set forth in FAR (June 1987) Alternate III(g)(3) (June 1987), FAR (June 1987), or DFARS (c)(1)(ii) (June 1988), and/or in similar or successor clauses in the FAR or DFARS, or in the DOD or NASA FAR Supplement, as applicable. Contractor/manufacturer is Aprisma Management Technologies, Inc. In the event the government seeks to obtain the software pursuant to standard commercial practice, this software agreement, instead of the noted regulatory clauses, shall control the terms of the government's license. Virus Disclaimer Aprisma makes no representations or warranties to the effect that the licensed software is virus-free. Aprisma has tested its software with current virus-checking technologies. However, because no antivirus system is 100-percent effective, we strongly recommend that you write protect the licensed software and verify (with an antivirus system with which you have confidence) that the licensed software, prior to installation, is virus-free. Contact Information Aprisma Management Technologies, Inc., 273 Corporate Drive, Portsmouth, NH USA Phone: U.S. toll-free: Web site: Page 2

3 Contents Notice... 2 Preface... 5 Intended Audience... 5 Text Conventions... 5 Document Feedback... 6 Online Documents... 6 Introduction... 7 Overview... 7 MPLS VPN Support... 7 Network Requirements... 8 Licensing... 9 Installation and Upgrades... 9 Entering a Activation Key and Expiration Date...10 License Expiration...11 Interface Views Access...13 VPN Searches...14 Component Detail...15 Model Details...15 Performance...16 Discovery and Modeling Performing Discoveries...18 VPN Model Creation...19 VPN Site Model Deletion...20 Application Configuration Configuration Access...21 Page 3

4 Configuration Options...23 VPN Discovery...23 Model Information...24 VRF Ping...25 Configuration Information...26 Provisioned VPNs...28 Traps, Events, and Alarms Trap Support...29 Automatically Creating and Deleting VPN Sites...30 Threshold Traps...30 Condition Calculations VPN Condition Calculations...32 Calculating VPN Condition Using RTTMON Connectivity Tests (VRF Ping)...33 Calculating VPN Condition Using VPN Site Condition...34 Known Anomalies Index Page 4

5 Preface In This Section Intended Audience [page 5] Text Conventions [page 5] Document Feedback [page 6] Online Documents [page 6] Intended Audience This guide is intended for users and administrators of the SPECTRUM Network Console application. Text Conventions The following text conventions are used in this document: Element Convention Used Example Variables (The user supplies a value for the variable.) The directory where you installed SPECTRUM (The user supplies a value for the variable.) Courier and Italic in angle brackets (<>) <$SPECROOT> Type the following: DISPLAY=<workstation name>:0.0 export display Navigate to: <$SPECROOT>/app-defaults Solaris and Windows directory paths Unless otherwise noted, directory paths are common to both operating systems, with the exception that slashes (/) should be used in Solaris paths, and backslashes (\) should be used in Windows paths. <$SPECROOT>/app-defaults on Solaris is equivalent to <$SPECROOT>\app-defaults on Windows. On-screen text Courier The following line displays: path= /audit User-typed text Courier Type the following path name: C:\ABC\lib\db Page 5

6 Element Convention Used Example Cross-references References to SPECTRUM documents (title and number) Underlined and hypertextblue Italic See Document Feedback [page 6]. SPECTRUM Installation Guide (0675) Document Feedback Please send feedback regarding SPECTRUM documents to the following address: Thank you for helping us improve our documentation. Online Documents SPECTRUM documents are available online at: Check this site for the latest updates and additions. Page 6

7 Introduction This section provides an overview of Aprisma s VPN Manager and describes its management support of MPLS/ BGP Virtual Private Networks (VPNs). In This Section Overview [page 7] MPLS VPN Support [page 7] Network Requirements [page 8] Overview lets you discover, model, and monitor VPNs within the network environment. Specifically, provides VPN and Site discovery and modeling, VPN connectivity status, SNMP trap handling, monitoring of Virtual Routing and Forwarding (VRF) condition, and performs calculation of and alarming on VPN condition. MPLS VPN Support The currently supports the IETF draft MPLS/BGP VPN MIB (draft-ietf-ppvpn-mpls-vpn-mib-05) and Cisco s MPLS Virtual Private Networks MIB (MPLS-VPN-MIB). Cisco s MPLS-VPN-MIB is based on Draft 3 of the IETF draft MPLS/BGP VPN MIB. These MIBs provide access to the following configuration information for VPNs configured on Provider Edge Router (PE) interfaces: Virtual Routing/Forwarding Instance (VRF) Table This table contains the VPN name and the Route Descriptors (RD) for each VRF. VPN Interface Configuration Table This table (VpnInterfaceConfTable) associates entries in the iftable with a VRF. This information lets discover all of the PE routers and interfaces that are forwarding traffic for a particular VPN. Based on this discovery, SPECTRUM will create VPN models representing each unique Page 7

8 VPN. These VPN models can then be polled for their current operational status (Up or Down). provides searches that let you quickly find a particular VPN or conduct a search for all VPNs. Search results contain a list of the current VPNs configured within the environment and the current status. You can drill into a single VPN to see the current list of PE interfaces participating within that VPN as well as the VPN s current status. Network Requirements functionality is supported by Cisco GSR and 7500 Series routers running Cisco IOS 12.2(15) T8 or higher in networks with properly configured MPLS VPNs. Page 8

9 Licensing This section contains licensing and installation information for the product. In This Section Installation and Upgrades Entering a Activation Key and Expiration Date [page 10] License Expiration [page 11] Installation and Upgrades A installation is comprised of both SpectroSERVER and VPN Manager components. can be installed as part of a SPECTRUM install or by adding it later to an existing installation of SPECTRUM. Installing the product requires the installation of SPECTRUM 6.6 Service Pack 5 including SpectroSERVER, the Cisco Router management module (SM-CIS1000), and all components. See the OneClick Console Installation Guide (5142) and the SPECTRUM Installation Guide for your version of SPECTRUM for more information. For distributed SPECTRUM installations see the SPECTRUM Installation Guide for your version of SPECTRUM. Install During SPECTRUM Installation To install as part of an installation of SPECTRUM, follow the appropriate installation procedure in the SPECTRUM Installation Guide for your version of SPECTRUM. Then, see Entering a Activation Key and Expiration Date [page 10]. Your extraction key must include OneClick and. Page 9

10 Upgrade Existing SPECTRUM Installation to Include Adding to an existing SPECTRUM installation requires you to request a activation key from Aprisma support. To add to an existing installation of SPECTRUM, follow the Installing Additional Components procedure in the SPECTRUM Installation Guide (0675). To add during an in-place upgrade, select VPN Manager in the Components Available view as part of the upgrade. Then, see Entering a Activation Key and Expiration Date [page 10]. SPECTRUM Installation Including and Latest Patch To install the latest patch over an existing SPECTRUM installation including, skip to step 2, and pay special attention to the warning concerning upgrading an existing installation. 1. Install SPECTRUM. 2. Install the latest patch for your version of SPECTRUM. Note: will not be selectable in the Components Available view if it was not previously installed. 3. Install Web Applications. 4. Install the latest Web Applications patch. 5. Enter your activation key and expiration date in the.vnmrc file (see Entering a Activation Key and Expiration Date [page 10]). WARNING! Upgrading an existing installation of SPECTRUM with the latest patch overwrites any changes you have made to the.vnmrc file. You must manually re-enter your activation key and expiration date in the.vnmrc file after you install the patch, but before you start the SpectroSERVER. Failure to do this will result in the behavior described in License Expiration [page 11]. Entering a Activation Key and Expiration Date After you have installed, you must manually enter your VPN Manager activation key and expiration date in your.vnmrc file by following the procedure below. Page 10

11 Procedure To activate your license, you must edit your.vnmrc file to reflect your activation key (different from your SPECTRUM activation key) and expiration date. To do this, add the following values to the SpectroSERVER s.vnmrc file (located in <$SPECROOT>/SS/.vnmrc) after installing but prior to starting the SpectroSERVER: vpnpassword=< Activation Key> vpnexpdate=<mm/dd/yyyy> Changes to the.vnmrc file take effect either the next time the SpectroSERVER is started or, in cases where you do not wish to cycle the SpectroSERVER, a maximum of 10 minutes after adding a valid vpnpassword and vpnexpdate to the.vnmrc file. License Expiration The functionality will be disabled once the VPN license expires. You will still be able to click the Run button for discovery (see VPN Discovery [page 23]), but the discovery process will not run. In addition, a message indicating that the license has expired will appear in the event log. Page 11

12 Interface To view details, click an area on the image below when your cursor changes to. Note: For additional information about the OneClick interface, see the OneClick (5130) Figure 1: Page 12

13 Views This section describes the views available with VPN Manager. In This Section Access [page 13] VPN Searches [page 14] Component Detail [page 15] Access The Explorer tab of the Navigation panel includes container and device icons in its hierarchical view. The navigational hierarchy for is shown in Figure 2. This navigational hierarchy from the top level down is: (VpnManager) -> VPNs -> VPN Sites Figure 2: in Navigation Panel (Explorer Tab) VPN VPN Sites Page 13

14 VPN Searches Predefined VPN searches (Table 1) are available from the Locator tab in the Navigation panel (Figure 3). To conduct a VPN Search, select the type of search you want to run from the hierarchical VPN Searches list and click the Search button. For example, to search for all instances of, select All s and click Search. The search results appear in the Contents panel (Figure 7). Figure 3: Locator Tab Panel Search button VPN Searches list (expanded) Table 1: Available Types of VPN Searches All of a Type Searches Site Searches VPN Searches All Sites Site By Interface VPN By Interface All s Site By Name VPN By Name All VPNs Site By PE Router IP VPN By PE Router Name Page 14

15 All of a Type Searches Site Searches VPN Searches Site By PE Router Name VPN By Site Name Site By VPN Model Name Component Detail The Component Detail panel (Figure 4) contains tabs that let you view additional information based on the item selected in the Contents panel. Note: Alarm details are not shown when multiple alarms are selected. Figure 4: Component Detail Panel for a VPN Site This panel provides access to the following tabbed views for a selected Site or VPN in : Model Details [page 15] Performance [page 16] Model Details When invoked for a given VPN Site or VPN by selecting a single Site or VPN from the VPN Site/VPN list or from a search, this view provides detailed Page 15

16 information for that particular VPN or Site. This view contains the following information: VPN Site Details Model Information - Condition - Priority - Model Class - Model Creation Time - Site Name - Description - Site Creation Time - Landscape - Notes VPN Details VPN details adds a Composite Traffic Rate in units per second to the Model Information section of the Model Details view described in VPN Site Details. This summarizes the traffic rate information available in the Performance tab for the selected VPN. Performance The Performance tab displays performance information for a selected VPN Site or VPN. Figure 5 displays a real-time graph for a VPN Site. Page 16

17 Figure 5: Real-Time Performance Graph VPN Site Performance The Performance tab for a selected VPN Site displays performance information specific to the selected Site. Performance statistics are based only on the traffic across the single interface that the VPN Site is connected to. VPN Site performance is a real-time value resulting from the polling of the following interface statistics: Octets In Rate Octets Out Rate Out/In Unicast Packet Rate Out/In Broadcast Rate Out/In Multicast Rate VPN Performance VPN performance data for a selected VPN is an aggregation of the performance data of the component VPN sites in a VPN. This is not a realtime value. Page 17

18 Discovery and Modeling This section provides information about s MPLS VPN discovery and modeling capabilities. In This Section Note: VPN discovery and modeling require that the managed devices must be modeled in SPECTRUM, must have MPLS-VPN properly configured, and must support the correct MPLS-VPN MIBS (see VPN Manager Network Requirements [page 8]). Performing Discoveries [page 18] Device Reconfiguration Discovery [page 24] VPN Site Naming During Discovery [page 18] Performing Discoveries Devices which support must be modeled in the SPECTRUM database. provides the Device Reconfiguration Discovery migration tool to find all existing device models that support and remodel them with the MIB information required for MPLS. See Device Reconfiguration Discovery [page 24] for more information. For a new SPECTRUM installation, the network must be modeled with AutoDiscovery or manually modeled prior to performing the VPN Discovery. See the AutoDiscovery (0727) and How to Manage Your Network with SPECTRUM (1909) for more information. Procedure 1. Ensure that the VPN devices on the network are modeled in SPECTRUM. 2. Discover and model the VPNs on the network. VPN Site Naming During Discovery Unique names are automatically generated for VPN Sites during discovery using the following convention (example in Figure 6): Page 18

19 Figure 6: Generated VPN Site Name Example _vpn-blue-1 IP of the PE Router VPN Name IF Index of the interface the VPN Site is connected to VPN Model Creation During discovery, several SPECTRUM models are created to represent different aspects of the MPLS/BGP VPN MIB in. A discovery of the VPN network can be initiated manually either by running a VPN Discovery (see VPN Discovery [page 23]) or by using Spectrum CLI. Model The SPECTRUM model type for is VpnManager. This is the default model that is created when is installed. This model cannot be destroyed. VPN Site Model A VPN Site model is created during VPN discovery to represent each unique VPN Site. The Model Class attribute for the VPN Site model will be set to Transport Service. The SPECTRUM model type is VpnSite. Note: Currently, assumes that each VPN Site is connected to a given PE by a single interface. VPN Application Model A VPN Application model will be created in the Application view of a device that supports the MPLS-VPN MIB. This application model needs to be modeled in the database in order for the MPLS VPN Discovery to work properly. The Model Class attribute for the VPN application model will be set to Application. The Spectrum model type is MplsVpnApp. VPN Model A SPECTRUM model will be created to represent each unique VPN. The Model Class attribute for the VPN model will be set to Transport Services. The Spectrum model type is MplsVpn. Page 19

20 VPN Site Model Deletion VPN Site models (VpnSite) models will be removed from the SPECTRUM database if: You delete a router model that is being used as a Provider Edge (PE), all of the associated VpnSite models will be deleted. When the last VpnSite is deleted the MplsVpn model associated with those VpnSite models will be deleted. or An mplsvrfifdown SNMP trap is received from the router model and the same VRF entry has been removed from the device's VRF Table. VPN Site models can also be disabled using Application Configuration [page 21] in. Page 20

21 Application Configuration This section describes the configuration options available for. In This Section Configuration Access [page 21] Configuration Options [page 23] Configuration Access To access configuration options: 1. Perform an All s search as described in VPN Searches [page 14]. 2. In the Contents panel, select the instance you want to configure from the Results list. 3. The resulting Component Detail panel s Model Details tab (Figure 7) provides the following Configuration Options [page 23] for this : VPN Discovery Options [page 23] Model Information [page 25] VRF Ping Options [page 25] VPN Configuration Information [page 26] Provisioned VPNs [page 28] Page 21

22 Figure 7: Search Results for All s Page 22

23 Configuration Options See Application Configuration [page 21] for information on how to access these configuration options: VPN Discovery [page 23] Model Information [page 24] VRF Ping [page 25] Configuration Information [page 26] Provisioned VPNs [page 28] VPN Discovery Note: To change a configuration value, click the value s set link, change the value, and press Enter. This section of the Model Details tab for a selected (Figure 8) contains the following information and configuration options for discovery and modeling of VPNs. Figure 8: VPN Discovery Options Running VPN Discovery By running a VPN Discovery, you can discover each VPN and Site currently configured on the devices modeled in SPECRTRUM. To run a VPN discovery, click Run in the VPN Discovery view. Read-only status of the discovery is reported by VPN Discovery Status. Discovery Progress displays the percentage complete as well as the total number of VPNs discovered. Page 23

24 Model Inactive VPNs This setting determines whether or not inactive VPNs in your network environment will be discovered and modeled by a discovery. This is set to false by default. Device Reconfiguration Discovery Device Reconfiguration Discovery is a migration tool. It is used to find all existing device models in the current landscape that support and remodel them with the correct MIB information for. Modeling is done using the MplsVpnApp model. This typically only needs to be done once during the initial setup of. Landscape The landscape containing the current. Create on Trap This value determines whether or not the receipt of a mplsvrfifup trap will result in a new VPN Site or VPN being discovered and modeled by VPN Manager. This is set to true by default. Delete on Trap This value determines whether or not the receipt of a mplsvrfifdown trap will result in a VPN Site or VPN that is down being deleted from VPN Manager. This is set to true by default. Default VPN Priority This value is the default priority assigned to newly created VPNs in VPN Manager. This lets you sort VPNs by order of their priority to your work. This value is set to 10 by default. Default Site Priority This value is the default priority assigned to newly created VPN Sites in. This lets you sort VPN Sites by order of their priority to your work. This value is set to 10 by default. Model Information This section of the Model Details tab for a selected (Figure 9) contains model information and lets you create and save model notes. Page 24

25 Figure 9: Model Information VRF Ping This section of the Model Details tab for a selected (Figure 10) contains the following VRF Ping configuration options. Figure 10: VRF Ping Options Enable VRF Ping When this value is set to true, will use RTTMON to send VRF pings to monitor VPN connectivity. See Calculating VPN Condition Using RTTMON Connectivity Tests (VRF Ping) [page 33] for more information. This is set to true by default. Setting this attribute to false configures to infer VPN condition from VPN Site condition. See Calculating VPN Condition Using VPN Site Condition [page 34] for more information. VRF Ping Interval This value determines how often VRF pings will be sent using RTTMON. To reduce network traffic, set this to a higher value. This is set to 60 by default. Before changing this setting, you must first set the Enable VRF Ping option to false. Page 25

26 VRF Ping Timeout This sets the RTTMON time-out value for VRF Pings. It is set to 5000 by default. Before changing this setting, you must first set the Enable VRF Ping option to false. Delete Completed VRF Ping Tests To reduce router memory usage, can be configured to delete completed VRF ping tests upon their completion. Set this value to true to do this. This value is false by default. Before changing this setting, you must first set the Enable VRF Ping option to false. Note: Setting this value to true will require additional network usage to set up subsequent tests. Collapse BiDirectional Ping If this value is set to true, network traffic will be reduced by eliminating potentially redundant ping tests. This is based on the assumption that if one site can successfully receive a response from another then the network between them is functioning properly. This value is set to false by default. Before changing this setting, you must first set the Enable VRF Ping option to false. Note: Changing this option requires that you stop and restart VRF pings using Enable VRF Ping [page 25]. Configuration Information This section of the Model Details tab for a selected (Figure 11) contains the following information and configuration options. Figure 11: VPN Configuration Information Page 26

27 Critical Threshold This value is the percentage of down (unreachable) VPN Sites that will result in the generation of a critical alarm. This value is 30 percent by default. Major Threshold This value is the percentage of down (unreachable) VPN Sites that will result in the generation of a major alarm. This value is 20 percent by default. Minor Threshold This value is the percentage of down (unreachable) VPN Sites that will result in the generation of a minor alarm. This value is 10 percent by default. Enable Port Polling This value controls whether or not polls ports. This is set to true by default. Important: Port polling must be enabled in order for the condition of VPN Site models to be updated correctly. Enable VPN Alarms Alarms can be generated when contact to a VPN is lost. When this is set to true and contact is lost to a VPN (with traps properly configured), there will be an event created that triggers an alarm to be asserted against the VPN Model [page 19] (MplsVpn). When this is set to false and contact is lost to a VPN, the VPN model will turn red, but no alarm will be created. Enable Site Alarms This value (true by default) enables and disables VPN Site alarming. Page 27

28 Provisioned VPNs This section of the Model Details tab for a selected (Figure 12) displays the currently provisioned VPNs known to VPN Manager. Figure 12: Provisioned VPNs Page 28

29 Traps, Events, and Alarms This section describes the traps, events, and alarms supported by the. In This Section Trap Support [page 29] Automatically Creating and Deleting VPN Sites [page 30] Threshold Traps [page 30] Trap Support Table 2 lists the MPLS-VPN MIB SNMP traps supported by. Note: Each device must be configured to send SNMP traps to the SPECTRUM VNM machine. Table 2: MPLS VPN MIB Traps SNMP Traps mplsvrfifup mplsvrfifdown mplsnumvrfroutemidthreshexceeded mplsnumvrfroutemaxthreshexceeded mplsnumvrfsecillegallabelthreshexceeded Result of Receiving Trap If the VPN Site model already exists, a change in status will be reported. Otherwise, a new VPN Site model will be created. If both the VPN Site model and the VPN Site on the device sending this trap exist, a change in status will be reported. Otherwise, the VPN Site model will be deleted. Event/Alarm Event/Alarm Event/Alarm Page 29

30 Automatically Creating and Deleting VPN Sites Currently, will create a new VPN Site model if the mplsvrfifup trap is received from a device and a VPN Site model does not already exist for that VPN Site. If a VPN Site model does exist for that VPN Site, will report a change in its status. Conversely, if receives a mplsvrfifdown trap from a device and the VPN Site is both already modeled and it exists on the device sending the trap, will report a change in the status of that VPN Site. Otherwise, will delete the applicable VPN Site model. Note: These actions also depend on the configuration settings in the Application Configuration [page 21] view. Threshold Traps supports threshold traps by creating events and alarms. These traps can be used to monitor the utilization of a PE router: mplsnumvrfroutemidthreshexceeded mplsnumvrfroutemaxthreshexceeded mplsnumvrfsecillegallabelthreshexceeded As the number of VPN Sites increases, these traps indicate that the PE router is approaching its capacity. You can set this capacity in VPN Manager Application Configuration [page 21]). The mplsnumvrfsecillegallabelthreshexceeded threshold trap is used to detect configuration or security violations, such as a PE-CE interface misconfiguration or an attempted VPN break-in using spoofed labels. Page 30

31 The alarms in Table 3 will be created when a VPN or VPN Site has the applicable attribute set to true (see Application Configuration [page 21]). Table 3: VPN and VPN Site Alarms Model Attribute Alarms MplsVpn EnableVpnAlarms (Minor) (Major) (Critical) MplsSite EnableSiteAlarms (Critical) Table 4: VPN and VPN Site Events Model MplsVpn MplsSite Event Conditions Initial, Minor, Major, Critical, Good Initial, Down, Good Page 31

32 Condition Calculations This section describes the ways VPN conditions are calculated by the. In This Section VPN Condition Calculations [page 32] Calculating VPN Condition Using RTTMON Connectivity Tests (VRF Ping) [page 33] Calculating VPN Condition Using VPN Site Condition [page 34] VPN Condition Calculations The overall condition of a VPN is of critical importance to providers of VPN services. The condition of a VPN is computed from the condition of the individual Sites as well as the Site to Site connectivity. The thresholds set in the Configuration Information [page 26] section of the Configuration View are used to determine what if any VPN Condition alarms are generated. provides a choice of two mechanisms by which VPN condition can be calculated. VPN condition is computed based on either the condition value of a VPN Site or the state of connectivity between two VPN Sites. RTTMON is used by to send VRF pings to determine site-tosite connectivity (see Calculating VPN Condition Using RTTMON Connectivity Tests (VRF Ping) [page 33] for more information). If all Sites for a VPN can reach each other, or the Condition value for every Site is Up, then the VPN condition will be Up. Alarm thresholds can be set to generate an alarm on a VPN based on the status of the VPN. Each threshold is based on the percentage of Sites that are Down or the number of VRF ping failures (see Table 5). The percentage of Sites that are Down is determined from site rollup condition. In the case of VRF ping connectivity tests, condition is determined from the number of site-to-site VRF ping test failures. See Configuration Information [page 26] for more information. Alarms can be generated when contact to a VPN Site is lost by setting Enable Site Alarms to true (see Configuration Information [page 26]). By default this is set to false. When this attribute set to true and contact is lost to a Site (for which traps are configured), an alarm will be asserted Page 32

33 against the VpnSite model. In the default setting, when contact is lost to a Site, the VpnSite model will turn red, but no alarm will be created. You can set to use either method to calculate VPN condition (see Application Configuration [page 21]). RTTMON is used by default. SPECTRUM cannot use both options at the same time to determine the VPN condition value. Note: For more information about SPECTRUM s Cisco RTTMON Management Module, see the Cisco RTT- Mon Application (5061) documentation. If all Sites for a VPN can reach each other, or the Condition value for every Site is Up, then the VPN condition will be Up. Alarm thresholds can be set to generate an alarm on a VPN based on the status of the VPN. Each level is based on the percentage of Sites that are Down or the number of VRF ping failures (see Table 5). The percentage of Sites that are Down is determined from site rollup condition, while the latter determines Down from the number of site-to-site VRF ping test failures. See Configuration Information [page 26] for more information. Calculating VPN Condition Using RTTMON Connectivity Tests (VRF Ping) Important: You must use a read/write community name when modeling devices in SPECTRUM for RTTMON to function properly. RTTMON connectivity tests calculate condition for a VPN Site from information obtained from the VRF Table. Using Cisco's VRF Aware Ping (configured through the RTTMON-MIB), the PE Router can initiate and send pings to any VPN Site on the network. Each entry in the VRF table has information pertaining to one unique Site. To ensure that is able to use RTTMON to test for connectivity and that it updates VPN condition based on the RTTMON test results, follow these guidelines: 1. Verify that you have modeled in SPECTRUM the devices that are part of the VPN network. 2. Verify that the Enable VRF Ping [page 25] option is set to true (enabled). 3. Verify that VRF Ping [page 25] pings are being run on the device by examining the RTTMON MIB on the VPN device. Page 33

34 4. Verify that the condition of the VPN and VPN Site models is updated correctly and that VRF pings are successful. Calculating VPN Condition Using VPN Site Condition VPN condition can also be inferred from the aggregate of VPN Site condition, per Table 5, by setting Enable VRF Ping [page 25] to false. The following items are used to compute the Condition value for a Site: Value of mplsvpnvrfoperstatus Value of ifoperstatus for the physical interface Contact status of the PE Router Receipt of an mplsvrfifup or mplsvrfifdown trap Note: Receipt of either an mplsvrfifup [page 29] trap or an mplsvrfifdown [page 29] trap typically results in a change of VPN Site condition. Events are created based on changes in condition. Table 5: VPN Site Condition VPN Site Condition Initial Down Good Calculation No associated IF or IF is initial Either IFOperStatus is Down or VrfOperStatus is Down All associated IFs are up and VrfOperStatus is Up Page 34

35 Table 6: VPN Condition VPN Condition Initial Initial Minor Major Critical Good Calculation No VPN Sites are modeled or all VPN Site models are Initial. Percentage of VPN Sites that are Initial is greater than the Down Minor Threshold. The percentage of VPN Sites down (Site Rollup condition) is greater than the Minor threshold and less than the Major threshold. The percentage of VPN Sites down is greater than the Major threshold and less than the Critical threshold. The percentage of VPN Sites down is greater than the Critical threshold. The percentage of VPN Sites down is less than the Minor threshold. Note: When VRF ping connectivity tests are used instead of VPN Site condition to determine VPN condition, the number of site-to-site VRF ping test failures is used in place of the percentage of VPN Sites down (Table 6) to define threshold violations. For example, when using VRF ping, a Good VPN condition is reported when the number of site-tosite VRF ping test failures is less than the Minor threshold. Page 35

36 Known Anomalies This section describes known anomalies of. Table 7: Known Anomalies Description Site membership is supported for a single VPN only. Site connectivity is supported through a single Interface. does not support the gathering or display of VPN Route Performance counters. does not currently support the creation of a customer model or the entering of customer VPN information. The condition of the VPN Site model may not be updated correctly. A VPN Site alarm is not cleared in cases where the network cable is unplugged and then plugged back in, even though traps are enabled. The mplsvrfifup trap is not being sent when the cable is plugged back into the router. Currently, the Device Reconfiguration Discovery [page 24] operation cannot be interrupted using the Stop button once it has been initiated. Solution N/A N/A N/A You can name a VPN with an associated customer name. This will then be displayed in the VPN Site name. Ensure that Port Polling (see Configuration Information [page 26]) is enabled in and that the connections between ports have been resolved by SPECTRUM. Additionally, traps may be used to determine the condition of a VPN Site. The device must be configured to send traps to SPECTRUM on behalf of interfaces and VPNs. This appears to be a Cisco IOS firmware issue. The mplsvrfifup trap is sent in other cases when a VPN Site goes back online (as when the interface is Administratively set to down and then back to up or when the interface is turned off and then on using Cisco IOS). N/A Page 36

37 Description A description is added to the VRF configuration on a router after its associated VPN Site has been modeled by. When you view information for the site in VPN Manager, the new description is not displayed in either the Description column of a site search Results list or in the Description field of the Component Detail panel s Model Information section (see Figure 4). Solution Destroy the VpnSite model, then run a new VPN Discovery that models the site. will then display the VRF description where appropriate. Page 37

38 Index C Cisco 7500 [8] GSR [8] IOS [8] Cisco Router Management Module (SM-CIS1000) [9] Component Details [15] Composite Traffic Rate [16] Condition VPN [32] Configuration Information [26] Options [21] Using "set" links [23] [21] Create on Trap [24] D Delete on Trap [24] Device Reconfiguration Discovery [24] Discovery Progress [23] draft-ietf-ppvpn-mpls-vpn-mib-05 [7] I ifoperstatus [34] L Landscape [24] Locator tab [14] M Model Inactive VPNs [24] Model Information [24] MPLS VPN Support [7] MplsVpn [19], [27] Page 38

39 MplsVpnApp [19], [24] MPLS-VPN-MIB [7] mplsvpnvrfoperstatus [34] N Navigation panel [14] Notes [24] O OneClick Console Installation Guide (5142) [9] OneClick (5130) [12] Operational Status [8] P Priority Site [24] VPN [24] Provider Edge Router (PE) [7] Thresholds [30] Provisioned VPNs [28] R Route Descriptors (RD) [7] RTTMON Documentation [33] and [33] Running VPN Discovery [23] S Searches [14] Available Types [14] SPECTRUM Installation Guide [9] T Traps [29] mplsnumvrfroutemaxthreshexceeded [30] mplsnumvrfroutemidthreshexceeded [30] Page 39

40 mplsnumvrfsecillegallabelthreshexceeded [30] mplsvrfifdown [20], [24], [34] mplsvrfifup [24], [34], [36] U Utilization of PE Routers How to Monitor [30] V Virtual Private Networks (VPNs) [7] Virtual Routing and Forwarding (VRF) [7] VPN Alarms Enable [27] Performance [17] VPN Discovery [18], [23] Running [23] Status of [23] VPN Interface Configuration Table [7] [7] Application Configuration [21] Application Model [19] Model Types [19] Navigational Hierarchy [13] VPN MIB (draft-ietf-ppvpn-mpls-vpn-mib-05) [7] VPN Model [7], [27] Model Class [19] VPN Searches [14] VPN Site Alarms Enable [27] Creating and Deleting [30] Details [16] Discovery [24] Model Condition [36] Deletion [20] Naming During Discovery [18] Type [19] Performance [17] VpnInterfaceConfTable [7] VRF Aware Ping [25], [33] Interval [25] Page 40

41 Timeout [26] Page 41