Cisco Applications. Document 5127

Transcription

1

2 Notice Copyright Notice Copyright 2002-present by Aprisma Management Technologies, Inc. All rights reserved worldwide. Use, duplication, or disclosure by the United States government is subject to the restrictions set forth in DFARS (c)(1)(ii) and FAR Liability Disclaimer Aprisma Management Technologies, Inc. ( Aprisma ) reserves the right to make changes in specifications and other information contained in this document without prior notice. In all cases, the reader should contact Aprisma to inquire if any changes have been made. The hardware, firmware, or software described in this manual is subject to change without notice. IN NO EVENT SHALL APRISMA, ITS EMPLOYEES, OFFICERS, DIRECTORS, AGENTS, OR AFFILIATES BE LIABLE FOR ANY INCIDENTAL, INDIRECT, SPECIAL, OR CONSEQUENTIAL DAMAGES WHATSOEVER (INCLUDING BUT NOT LIMITED TO LOST PROFITS) ARISING OUT OF OR RELATED TO THIS MANUAL OR THE INFORMATION CONTAINED IN IT, EVEN IF APRISMA HAS BEEN ADVISED OF, HAS KNOWN, OR SHOULD HAVE KNOWN, THE POSSIBILITY OF SUCH DAMAGES. Trademark, Service Mark, and Logo Information SPECTRUM, IMT, and the SPECTRUM IMT/VNM logo are registered trademarks of Aprisma Management Technologies, Inc., or its affiliates. APRISMA, APRISMA MANAGEMENT TECHNOLOGIES, the APRISMA MANAGEMENT TECHNOLOGIES logo, MANAGE WHAT MATTERS, DCM, VNM, SpectroGRAPH, SpectroSERVER, Inductive Modeling Technology, Device Communications Manager, SPECTRUM Security Manager, and Virtual Network Machine are unregistered trademarks of Aprisma Management Technologies, Inc., or its affiliates. For a complete list of Aprisma trademarks, service marks, and trade names, go to: All referenced trademarks, service marks, and trade names identified in this document, whether registered or unregistered, are the intellectual property of their respective owners. No rights are granted by Aprisma Management Technologies, Inc., to use such marks, whether by implication, estoppel, or otherwise. If you have comments or concerns about trademark or copyright references, please send an to spectrum-docs@aprisma.com; we will do our best to help. Restricted Rights Notice (Applicable to licenses to the United States government only.) This software and/or user documentation is/are provided with RESTRICTED AND LIMITED RIGHTS. Use, duplication, or disclosure by the government is subject to restrictions as set forth in FAR (June 1987) Alternate III(g)(3) (June 1987), FAR (June 1987), or DFARS (c)(1)(ii) (June 1988), and/or in similar or successor clauses in the FAR or DFARS, or in the DOD or NASA FAR Supplement, as applicable. Contractor/manufacturer is Aprisma Management Technologies, Inc. In the event the government seeks to obtain the software pursuant to standard commercial practice, this software agreement, instead of the noted regulatory clauses, shall control the terms of the government's license. Virus Disclaimer Aprisma makes no representations or warranties to the effect that the licensed software is virus-free. Aprisma has tested its software with current virus-checking technologies. However, because no antivirus system is 100-percent effective, we strongly recommend that you write protect the licensed software and verify (with an antivirus system with which you have confidence) that the licensed software, prior to installation, is virus-free. Contact Information Aprisma Management Technologies, Inc., 273 Corporate Drive, Portsmouth, NH USA Phone: U.S. toll-free: Web site: Page 2

3 Contents Notice... 2 Preface Intended Audience...11 How to Use This Guide...11 Text Conventions...12 Document Feedback...12 Online Documents...12 Required Reading...13 Overview Purpose and Scope...14 Other Applications Documents...14 Interface Options...15 Sort...15 Find...15 Update...15 CiscIPSecApp IKE...16 Global Statistics Button...16 Peer Table...17 Tunnel Table...17 Phase II...17 Global Statistics Button...17 Tunnel Table...17 Security Protection Index Table...18 History...18 Table Size...18 Phase II History Information Button...18 Phase II Tunnel History Table...19 Endpoint History Table...20 Page 3

4 Check Point Selector Button...20 IKE Tunnel History Table...20 Failures...20 IKE Failure Table...20 Phase II Failure Table...21 Trap Control...21 IP Security Policy Map...21 IKE Policy Map Table...22 Phase II Policy Map Table...22 Trap, Event, and Alarm Support...22 CiscIPSecExtApp ISAKMP Configuration...23 IPSec Information...24 IPSec Global Configuration...24 Cryptomap Set Information...24 Static Cryptomap Set Information...24 Dynamic Cryptomap Set Information...24 Interface Cryptomap Set Information...25 Static Cryptomap Information...25 System Capacity...25 Trap Control...26 Tunnel Interface Modeling Options...26 Traps, Events, and Alarms for CiscIPSecApp and CiscIPSecExtApp...28 Default Trap Support...29 CiscIPSecApp Trap Support...29 CiscIPSecExtApp Trap Support...31 Processing Traps with Thresholds...32 Traps Using Threshold...33 Cisco Syslog Application Cisco Syslog Message Filter SpectroGRAPH View...35 Cisco SysLog Basic Configuration SpectroGRAPH View...36 Cisco SysLog History Table SpectroGRAPH View...37 Page 4

5 Cisco SysLog History Table...37 Syslog Trap Support...38 Adding Syslog Trap Mappings to SPECTRUM...41 Cisco IPM Routing Application IPM Route Table SpectroGRAPH View...43 IPM Route Table...43 IPM Route Next Hop Table SpectroGRAPH View...45 IPM Route Next Hop Table...45 IPM Route Interface Table SpectroGRAPH View...46 IPM Route Interface Table...46 IPM Route Boundary Table SpectroGRAPH View...47 IPM Route Boundary Table...48 Cisco IPM Route Table SpectroGRAPH View...48 Cisco IPM Route Table...48 Cisco IPM Route Next Hop Table SpectroGRAPH View...51 Cisco IPM Route Next Hop Table...51 Cisco IPM Route Heartbeat Table SpectroGRAPH View...52 Cisco IPM Route Heart Beat Table...52 Cisco PIM Application PIM Interface Table SpectroGRAPH View...54 PIM Interface Table...54 PIM Neighbor Table SpectroGRAPH View...56 PIM Neighbor Table...56 PIM IPM Route Table SpectroGRAPH View...56 PIM IPM Route Table...57 PIM Rendezvous Point Sets Table SpectroGRAPH View...57 Rendezvous Point Sets Table...58 PIM IPM Route Next Hop Table SpectroGRAPH View...58 PIM IPM Route Next Hop Table...59 PIM Candidate Rendezvous Point Table SpectroGRAPH View...59 PIM Candidate Rendezvous Point Table...60 PIM Component Table SpectroGRAPH View...60 Page 5

6 PIM Component Table...60 Cisco PIM Objects SpectroGRAPH View...61 Traps, Events, and Alarms for the RFC2934 PIM MIB...63 Cisco VPDN Application Cisco VPDN System Info SpectroGRAPH View...65 Cisco VPDN Tunnel Attribute SpectroGRAPH View...66 Cisco VPDN Tunnel Session SpectroGRAPH View...68 Cisco VPDN User Failure History SpectroGRAPH View...70 Cisco DLSW Ext Application Cisco DLSW Ext Node SpectroGRAPH View...73 Cisco DLSW Ext Transport Connection Config SpectroGRAPH View...79 Cisco DLSW Ext Transport Connection Operation SpectroGRAPH View. 82 Cisco DLSW Ext Transport Connection Specific SpectroGRAPH View.83 Cisco DLSW Ext Transport Connection Direct Config SpectroGRAPH View...84 Cisco DLSW Ext Interface SpectroGRAPH View...85 Cisco DLSW Ext Fast SpectroGRAPH View...86 Cisco DLSW Ext Circuit SpectroGRAPH View...87 Cisco DLSW Ext Trap Control SpectroGRAPH View...89 Cisco DLSW Application Cisco DLSW Node SpectroGRAPH View...90 Cisco DLSW Transport Connection Statistics SpectroGRAPH View...93 Cisco DLSW Transport Connection Config SpectroGRAPH View...94 Cisco DLSW Transport Connection Operation SpectroGRAPH View...97 Cisco DLSW Transport Connection TCP Config SpectroGRAPH View 102 Cisco DLSW Transport Connection TCP Operation SpectroGRAPH View 103 Cisco DLSW Interface SpectroGRAPH View Cisco DLSW Dir MAC Cache SpectroGRAPH View Dlsw Dir MAC Table Page 6

7 Cisco DLSW Dir NBIOS Cache SpectroGRAPH View Cisco DLSW Dir Location SpectroGRAPH View Dlsw Dir Locate Mac Table Dlsw Dir Locate NBIOS Table Cisco DLSW Circuit SpectroGRAPH View Dlsw Circuit Table Cisco DLSW SDLC SpectroGRAPH View Dlsw LS Table Cisco HSRP Application Cisco HSRP Group Table SpectroGRAPH View HSRP Group Table Cisco HSRP Group Tracked Interface Table SpectroGRAPH View Cisco Secondary HSRP IP Address Table SpectroGRAPH View Cisco HSRP Physical Interface Configuration Table SpectroGRAPH View 122 Cisco Entity Alarm Application Overview Traps, Events, and Alarms for the Cisco Entity Alarm Application IP Routing Application Cisco IP Accounting Table SpectroGRAPH View Novell Routing Application Novell Service Advertisement Protocol (SAP) SpectroGRAPH View..129 Novell Internet Packet Exchange (IPX) SpectroGRAPH View Check Point Information IPX Accounting Information Check Point Accounting Table Accounting Table Vines Routing Application Vines Routing Echo SpectroGRAPH View Vines Routing ICP SpectroGRAPH View Page 7

8 Vines Broadcast Detail SpectroGRAPH View Vines Rx SpectroGRAPH View Vines Tx SpectroGRAPH View XNS Routing Application Echos Cisco BSTUN Application BSTUN Groups SpectroGRAPH View BSTUN Ports SpectroGRAPH View BSTUN Routes SpectroGRAPH View Cisco STUN Application STUN Group SpectroGRAPH View STUN Port SpectroGRAPH View STUN Route SpectroGRAPH View Cisco Chassis Application Cisco Chassis Card SpectroGRAPH View Cisco Card Interface SpectroGRAPH View Cisco Chassis General Information SpectroGRAPH View Chassis Information ROM Information RAM Information Cisco Modem Application Modem System Information SpectroGRAPH View Modem Line Status Table SpectroGRAPH View Modem Line Configuration Table SpectroGRAPH View Modem Line Statistics Table SpectroGRAPH View Modem Line Speed Statistics Table SpectroGRAPH View Cisco Flash Application Cisco Flash Configuration SpectroGRAPH View Flash Directory Flash Device Chip Properties Table SpectroGRAPH View Page 8

9 Flash Copy Operations Table SpectroGRAPH View Flash Device Properties Table SpectroGRAPH View Flash File Properties Table SpectroGRAPH View Flash Miscellaneous Operations Table SpectroGRAPH View Flash Device Partition Properties Table SpectroGRAPH View Flash Partitioning Operations Table SpectroGRAPH View Cisco Ping Application Ping Request Entry SpectroGRAPH View Ping Request Entries Saved Ping Requests Cisco Queue Application Queue Interface SpectroGRAPH View Queue Statistics SpectroGRAPH View Queue Rotation Interface SpectroGRAPH View ATM Client Application VCL Table ATM Link Modeling Options Creating VPL/VCL Models Destroying VPL/VCL Models EnvMon Application Enable Notifications Fan Status Power Supply Status Temperature Status Voltage Status Discovery Application Discovery Cache Table SpectroGRAPH View Interface Discovery Status Table Cisco Interface Application CiscoIfceApp Configuration Page 9

10 Cisco Terminal Server Application Line Configuration SpectroGRAPH View Cisco Terminal Server Line SpectroGRAPH View Cisco Terminal Server Session SpectroGRAPH View Cisco Memory Pool Application Cisco Memory Pool Monitor Table SpectroGRAPH View Additional Traps, Events, and Alarms CISCO-DDP-IAPP-MIB CISCO-IETF-DOT11-QOS-EXT-MIB CISCO-L2-DEV-MONITORING-MIB CISCO-WLAN-VLAN-MIB Index Page 10

11 Preface Welcome to the guide. Please take a moment to read through this short preface, which explains how the information in this guide is organized and presented and lets you know how to access information about other SPECTRUM products. In This Section Intended Audience How to Use This Guide Text Conventions [Page 12] Document Feedback [Page 12] Online Documents [Page 12] Required Reading [Page 13] Intended Audience This guide is intended to provide users of SPECTRUM s Cisco application models with a definition of the information presented in the SpectroGRAPH application model views. A description of trap, event and alarm support for each application is also provided. How to Use This Guide Use this document as a guide for managing the following Cisco application models: CiscIPSecApp [Page 16]: This section defines the SpectroGRAPH views that the application model uses to support the Cisco-IPSec-Flow-Monitor-MIB and the Cisco-IPSec-Policy-Map-MIB. CiscIPSecExtApp [Page 23]: This section defines the SpectroGRAPH views that the application model uses to support the Cisco-IPSec-MIB. Page 11

12 Traps, Events, and Alarms for CiscIPSecApp and CiscIPSecExtApp [Page 28]:This section defines the traps, events and alarms that these application models support. Text Conventions The following text conventions are used in this document: Element Convention Used Example User-supplied parameter names Courier and Italic in angle brackets <>. The user needs to type the password in place of <password>. On-screen text Courier The following line displays: path= /audit User-typed text Courier Type the following path name: C:\ABC\lib\db Cross-references References to SPECTRUM documents (title and number) Functionality enabled by SPECTRUM Alarm Notification Manager (SANM) Underlined and hypertextblue Italic SANM in brackets []. See Document Feedback [Page 12]. SPECTRUM Installation Guide (0675) [SANM] AGE_FIELD_ID Document Feedback Please send feedback regarding SPECTRUM documents to the following address: Thank you for helping us improve our documentation. Online Documents SPECTRUM documents are available online at: Page 12

13 Check this site for the latest updates and additions. Required Reading To use this documentation effectively, you must be familiar with the information covered by the SPECTRUM documents listed below. Getting Started with SPECTRUM for Operators (1763) Getting Started with SPECTRUM for Administrators (0985) How to Manage Your Network with SPECTRUM (1909) SPECTRUM Views (2517) SPECTRUM Menus (2519) SPECTRUM Icons (2518) Application View and MIBs (2560) SPECTRUM Software Release Notice (0743) Page 13

14 Overview This section summarizes this document, which is one of a set of documents describing SPECTRUM applications. This section also provides references to other applications documents. In This Section Purpose and Scope [Page 14] Other Applications Documents [Page 14] Purpose and Scope This document defines the fields displayed in the SpectroGRAPH views associated with SPECTRUM Cisco application models. In all cases, the SpectroGRAPH views and fields described in this document are accessed from the Icon Subviews menu of the application models displayed in the Main Applications view. This document also defines the traps, events, and alarms that each application model supports. Other Applications Documents The table below lists the documents that cover the other categories of SPECTRUM applications. In addition to the documents listed in the table, the document Application View and MIBs provides an introduction to the Application view and defines MIB functions in network management. Document Title Technology Applications Bridging Applications MIB-II Applications Routing Applications Digital Subscriber Line Applications Typical Applications APPN, ATM, DHCP Spanning Tree, PPP Bridging SNMP, ICMP, TCP OSPF, VRRP, BGP4 ADSL Page 14

15 Interface Options The following buttons are used throughout the SpectroGRAPH GIB views that support the Cisco application models. Sort The sort button arranges the values in the highlighted column in the table in ascending order. To highlight a column, click on the column title, then click the Sort button to sort the column. Find The Find button activates a dialog box that allows you to do a string search on the highlighted column in the table. To highlight a column, click on the column title. Click Find and type the search criteria into the box provided. Click the Find button in this dialog box to find the first instance of the search criteria. Click Find again to move to the next instance. Update The update button refreshes all of the values in the table with the latest values from the device. Values are only updated when this button is used or when the SpectroGRAPH view is launched. Page 15

16 CiscIPSecApp This section describes the CiscoIPSecApp application which provides support for two Cisco MIBs: the Cisco- IPSec-Flow-Monitor-MIB, used for monitoring the structures in Secure IP Protocol (IPSec) based Virtual Private Networks, and the Cisco-IPSec-Policy-Map-MIB, used to map the dynamically instantiated protocol structures to policy entities that gave rise to them. Each of the SpectroGRAPH views used to support these MIBs are listed below. The first five show information from the Cisco-IPSec-Flow-MIB, and the last shows information from the Cisco-IPSec-Policy-Map-MIB. In This Section IKE [Page 16] Phase II [Page 17] History [Page 18] Failures [Page 20] Trap Control [Page 21] IP Security Policy Map [Page 21] Trap, Event, and Alarm Support [Page 22] IKE Note: From the Icon Subviews menu for the CiscIPSecApp Application icon, select IKE. This SpectroGRAPH view provides information in the following tables and buttons: Global Statistics Button This button activates the SpectroGRAPH Global Statistics view, which lists the IPSec Phase-1 Global Statistics. These values pertain to the IPSec Phase-1 IKE tunnels available to the device. Page 16

17 All of these statistics are read-only. Peer Table This table shows each peer that is currently associated with an active IPSec Phase-1 tunnel. The IPSec tunnel itself may or may not be active. All of the values in the table are read-only. Tunnel Table The Tunnel Table shows an entry for each active IPSec Phase-1 IKE tunnel available to the device. Double clicking on any column in the table activates the Tunnel Table Detail SpectroGRAPH view. This SpectroGRAPH view shows all of the data for a specific entry in the table. The only value in this table that can be modified is the Status field. To modify this value, double click on it to go to the Tunnel Table Detail SpectroGRAPH view. In this SpectroGRAPH view, choose either active or destroy from the list box next to the Status field. Setting the value to destroy will bring the tunnel down. The Status value cannot be used to create a table row. Phase II Note: From the Icon Subviews menu for the CiscIPSecApp Application icon, select Phase II. This SpectroGRAPH view provides information in the following tables and buttons: Global Statistics Button This button activates the Global Statistics SpectroGRAPH view, which lists the IPSec Phase-2 Global Statistics. These values pertain to the IPSec Phase-2 tunnels available to the device. All of these statistics are read-only. Tunnel Table The Tunnel Table shows an entry for each active IPSec Phase-2 tunnel available to the device. Page 17

18 Double clicking on any column in the table activates the Tunnel Table Detail SpectroGRAPH view. This SpectroGRAPH view shows all of data for a specific entry in the table. The only value in this table that can be modified is the Status field. To modify this value, double click on it to go to the Tunnel Table Detail SpectroGRAPH view. In this SpectroGRAPH view, choose either active or destroy from the list box next to the Status field. Setting the value to destroy will bring the tunnel down, destroy the Security Association bundle and delete this row from the table. The Status value cannot be used to create a table row. Endpoint Table This table contains an entry for each active endpoint associated with an IPSec Phase-2 tunnel. All of the values in this table are read-only. Security Protection Index Table This table contains an entry for each active and expiring security association. All of the values in this table are read-only. History Note: From the Icon Subviews menu for the CiscIPSecApp Application icon, select History. This SpectroGRAPH view provides information in the following tables, fields and buttons: Table Size This field allows you to specify how many historical entries are maintained in the IPSec Phase-1 and Phase-2 History tables. You can change this value by editing the value currently displayed in this field and saving this change using the File > Save All Changes option. Phase II History Information Button This button activates the Phase II History Information SpectroGRAPH view, which shows the Phase II Tunnel History table and the Endpoint History table. Page 18

19 Phase II Tunnel History Table The Phase II Tunnel History table shows one entry for each previously active IPSec Phase-2 tunnel. The values in this table are read-only. Page 19

20 Endpoint History Table The Endpoint History table shows one entry for each previously active IPSec Phase-2 endpoint. The values in this table are read-only. Check Point Selector Button The check point button allows you to select the check point processing state. This value will be set to ready when the agent is ready to create ondemand history entries for active IPSec Tunnels. If you set the value to checkpoint, the agent will create an entry in the IPSec Phase -1 Tunnel History for each active IPSec Phase-1 tunnel, and an entry in the IPSec Phase-2 Tunnel History table and the IPSec Phase-2 Tunnel Endpoint History Table for each active IPSec Phase-2 tunnel. While the agent is creating these entries, the value of the check point button is set to checkpoint. IKE Tunnel History Table This table shows one entry for each previously active IPSec Phase-1 IKE tunnel. All of the values in this table are read-only. Failures Note: From the Icon Subviews menu for the CiscIPSecApp Application icon, select Failures. This SpectroGRAPH view provides information in the following tables and fields: IP Security Failure Table Size This field allows you to specify the maximum number of entries which will be maintained in the IPSec Phase-1 and Phase-2 Failure tables. You can change this value by editing the value currently displayed in this field and saving this change using the File > Save All Changes option. IKE Failure Table This table shows one entry for each IPSec Phase-1 failure. All of the values in this table are read-only. Page 20

21 Phase II Failure Table This table shows one entry for each IPSec Phase-2 failure. All of the values in this table are read-only. Trap Control Note: From the Icon Subviews menu for the CiscIPSecApp Application icon, select Trap Control. This SpectroGRAPH view provides buttons to enable and disable the following IKE and Phase II traps for the current model. For more information on each of these traps, see Traps, Events, and Alarms for CiscIPSecApp and CiscIPSecExtApp [Page 28]. IKE Tunnel Start IKE Tunnel Stop IKE System Failure IKE Certificate Control Failure IKE Protocol Failure IKE No Security Association Phase II Tunnel Start Phase II Tunnel Stop Phase II System Failure Phase II Set Up Failure Phase II Early Tunnel Termination Phase II Protocol Failure Phase II No Security Association IP Security Policy Map Note: From the Icon Subviews menu for the CiscIPSecApp Application icon, select IP Security Policy Map. This SpectroGRAPH view contains the following tables: Page 21

22 IKE Policy Map Table This table maps an IPSec Phase-1 tunnel to the Internet Security Association and Key Exchange (ISAKMP) Policy. There is one entry for each active IPSec Phase-1 tunnel. All values in this table are read-only. Phase II Policy Map Table This table maps an IPSec Phase-2 tunnel to the corresponding IPSec Policy element (called a cryptomap).there is one entry for each active IPSec Phase-2 tunnel. All values in this table are read-only. Trap, Event, and Alarm Support See Traps, Events, and Alarms for CiscIPSecApp and CiscIPSecExtApp [Page 28]. Page 22

23 CiscIPSecExtApp This section describes the CiscoIPSecExtApp application which provides support for the Cisco-IPSec-MIB using the SpectroGRAPH views outlined in this chapter. In This Section ISAKMP Configuration [Page 23] IPSec Information [Page 24] System Capacity [Page 25] Trap Control [Page 26] Tunnel Interface Modeling Options [Page 26] Traps, Events, and Alarms for CiscIPSecApp and CiscIPSecExtApp [Page 28] ISAKMP Configuration Note: From the Icon Subviews menu for the CiscIPSecExtApp Application icon, select ISAKMP Configuration. This SpectroGRAPH view provides information about ISAKMP Configuration in the following tables and fields: Enabled The value in this field is set to TRUE if ISAKMP has been enabled on the managed element. If ISAKMP is not enabled, this value is set to FALSE. This is a read-only field. Identity The value in this field shows the type of identity used by the managed element in ISAKMP negotiations with another peer. This is a read-only field. Keepalive Interval The value in this field shows the time interval in seconds between successive ISAKMP keepalive heartbeats issued to the peers to which IKE tunnels have been set up. This is a read-only field. Page 23

24 Policies The value in this field shows the number of ISAKMP policies that have been configured on the managed element. This is a read-only field. Policy Table This table contains a list of all ISAKMP policy entries configured by the operator. All of the values in this table are read-only. IPSec Information The following SpectroGRAPH subviews are available under the IPSec Information menu: IPSec Global Configuration Note: From the Icon Subviews menu for the CiscIPSecExtApp Application icon, select IPSec Information -> IPSec Global Configuration. This SpectroGRAPH view provides IPSec global configuration information. All of these values are read-only. Cryptomap Set Information Note: From the Icon Subviews menu for the CiscIPSecExtApp Application icon, select IPSec Information -> Cryptomap Set Information. This SpectroGRAPH view provides three tables: Static Cryptomap Set Information This table shows a list of all cryptomap sets that are fully specified and do not contain wild-cards. Each entry in the table contains the attributes associated with a single static cryptomap set. All values in this table are read-only. Dynamic Cryptomap Set Information This table shows a list of all dynamic cryptomaps that use IKE defined on the managed element. Each entry in the table contains the attributes associated with a single dynamic cryptomap template. Page 24

25 All values in this table are read-only. Interface Cryptomap Set Information This table shows the binding of cryptomap sets to the interfaces of the managed entity. Each entry in the table shows the association between an interface and a cryptomap set that is defined on the managed element. The cryptomap set identified in this binding must be static. Dynamic cryptomaps cannot be bound to interfaces. All values in this table are read-only. Static Cryptomap Information Note: From the Icon Subviews menu for the CiscIPSecExtApp Application icon, select IPSec Information -> Static Cryptomap Information. This table lists the members of the cryptomap sets that are configured on the managed element. Each entry contains the attributes associated with a single static cryptomap entry. This table does not include the members of dynamic cryptomap sets that may be linked with the parent static cryptomap set. All values in this table are read-only. System Capacity Note: From the Icon Subviews menu for the CiscIPSecExtApp Application icon, select System Capacity. This SpectroGRAPH view provides information in the following fields: Max Security Assoc Field This field contains the maximum number of IPSec security associations that can be established on this managed element. If no theoretical limit exists, the value shown is 0. This value is read-only. 3DES Capable Field This field shows if the managed element is capable of supporting the 3DES encryption algorithm. A value of TRUE indicates that it is supported, a value of FALSE indicates that it is not. This value is read-only. Page 25

26 Trap Control Note: From the Icon Subviews menu for the CiscIPSecExtApp Application icon, select Trap Control. This SpectroGRAPH view provides buttons to enable and disable the following ISAKMP and Cryptomap traps for the current model. For more information on each of these traps, see Traps, Events, and Alarms for CiscIPSecApp and CiscIPSecExtApp [Page 28]. ISAKMP Policy Added ISAKMP Policy Deleted Cryptomap Added Cryptomap Deleted Cryptomap Set Attached Cryptomap Set Detached Too Many Security Associations Tunnel Interface Modeling Options Note: From the Icon Subviews menu for the CiscIPSecExtApp Application icon, select Tunnel IF Modeling Options. This view provides configuration options for Cisco IPSec tunnel interface management in SPECTRUM and lets you configure the creation of Tunnel Interface models. Cisco IPSec tunnel interface management is available in SPECTRUM for Cisco devices that support the CISCO-IPSEC-FLOW-MONITOR-MIB and CISCO-IPSEC-MIB. These MIBs are available with Cisco firmware versions 12.1 (4) or newer. The following IPSEC VPN Management features are available in SPECTRUM for supported Cisco devices: Modeling of Tunnel Interfaces (Site-To-Site) Automatic Connectivity Mapping Interface Model Identification Interface Model Aging Page 26

27 Link Down Trap Correlation Status Monitoring of Tunnel Interfaces The Tunnel Interface Modeling Options view provides the following configuration options: Create Tunnel IFs This True/False value specifies whether or not tunnel interface models should be created for each IPSec tunnel defined on the device. Setting this option to TRUE specifies that SPECTRUM, during interface reconfiguration, reads the external tables that define the tunnel interfaces present and then creates the appropriate tunnel interface models as a sub-inteface of the related physical interface. Poll Enable This True/False value specifies whether or not SPECTRUM will regularly monitor the MIB associated with the tunnel interface models to keep the modeling up to date. To automate the reconfiguration of all interfaces (as described in Manually Poll Device [Page 27]), set Poll Enable to true. By default, Poll Enable is set to false (polling is disabled) for performance reasons. Polling Interval (sec) The polling interval, defined in seconds. This should never be set to less than 3600 seconds. Manually Poll Device Clicking the Manually Poll Device button reconfigures all interfaces. If the Create Tunnel IFs [Page 27] option is set to TRUE when this button is clicked, tunnel interface modeling is also updated. If you know that the configuration information displayed by SPECTRUM is out of date, you can click the Manually Poll Device button to update it. Page 27

28 Traps, Events, and Alarms for CiscIPSecApp and CiscIPSecExtApp There are two possible trap support configurations that you can use for the CiscIPSecApp and the CiscIPSecExtApp. The default configuration generates an event and sometimes an alarm when one of the supported traps is received. The alternative configuration tracks the rate at which some traps are received, and only generates an alarm if the number of traps exceeds a specified threshold within a certain time frame. The default trap support configuration is explained in Default Trap Support [Page 29]. The trap support that is based on the rate at which certain traps are received is explained in Processing Traps with Thresholds [Page 32]. Page 28

29 Default Trap Support CiscIPSecApp Trap Support The following table shows the events and alarms created by traps defined in the Cisco IPSec-Flow-Monitor-MIB. To enable or disable any of these traps on a per model basis, see Trap Control [Page 21]. Trap OID Event Generated Alarm Generated Default Alarm Severity IKE Tunnel Start x None None IKE Tunnel Stop x None None IKE System Failure x x Orange IKE Certificate Control Failure x x Orange IKE Protocol Failure x x Orange IKE No Security Association x x Orange Phase II Tunnel Start x None None Phase II Tunnel Stop x None None Phase II System Failure x x Orange Phase II Set Up Failure x a 0x a Orange Phase II Early Tunnel Termination x b 0x b Yellow Phase II Protocol Failure x c 0x c Orange Phase II No Security Association x d 0x d Orange IKE Tunnel Start This trap is generated when an IPSec Phase-1 IKE tunnel becomes active. IKE Tunnel Stop This trap is generated when an IPSec Phase-1 tunnel becomes inactive. IKE System Failure This trap is generated when the processing for an IPSec Phase-1 IKE tunnel experiences an internal or system capacity error. Page 29

30 IKE Certificate Control Failure This trap is generated when the processing for an IPSec Phase-1 IKE tunnel experiences a Certificate or a Certificate Revoke List (CRL) related error. IKE Protocol Failure This trap is generated when the processing for an IPSec Phase-1 IKE tunnel experiences a protocol related error. IKE No Security Association This trap is generated when the processing for an IPSec Phase-1 tunnel experiences a non-existent security association error. Phase II Tunnel Start This trap is generated when an IPSec Phase-2 tunnel becomes active. Phase II Tunnel Stop This trap is generated when an IPSec Phase-2 tunnel becomes inactive. Phase II System Failure This trap is generated when the processing for an IPSec Phase-2 tunnel experiences an internal or system capacity error. Phase II Set Up Failure This trap is generated when the setup for an IPSec Phase-2 tunnel fails. Phase II Early Tunnel Termination This trap is generated when an IPSec Phase-2 tunnel is terminated early or before expected. Phase II Protocol Failure This trap is generated when the processing of an IPSec Phase-2 tunnel experiences a protocol related error. Phase II No Security Association This trap is generated when the processing for an IPSec Phase-2 tunnel experiences a non-existent security association error. Page 30

31 CiscIPSecExtApp Trap Support The following table shows the events and alarms created by traps defined in the Cisco-IPSec-MIB. To enable or disable any of these traps on a per model basis, see Trap Control [Page 26]. Trap OID Event Generated Alarm Generated Default Alarm Severity ISAKMP Policy Added x e None None ISAKMP Policy Deleted x f 0x f Yellow Cryptomap Added x None None Cryptomap Deleted x x Yellow Cryptomap Set Attached x None None Cryptomap Set Detached x x Yellow Too Many Security Associations x x Orange ISAKMP Policy Added This trap is generated when a new ISAKMP policy element is defined on the managed element. The context of the trap includes the updated number of ISAKMP policy elements currently available. ISAKMP Policy Deleted This trap is generated when an existing ISAKMP policy element is deleted on the managed element. The context of the trap includes the updated number of ISAKMP policy elements currently available. Cryptomap Added This trap is generated when a new cryptomap is added to the specified cryptomap set. Cryptomap Deleted This trap is generated when a cryptomap is removed from the specified cryptomap set. Page 31

32 Cryptomap Set Attached A cryptomap set must be attached to an interface of the device in order for it to be operational. This trap is generated when the cryptomap set is attached to an active interface of the managed element. Cryptomap Set Detached This trap is generated when a Cryptomap set is detached from an interface to which it was bound. The context of the trap identifies the size of the cryptomap set. Too Many Security Associations This trap is generated when an attempt is made to set up a new SA while the number of currently active SAs equals the maximum configurable. Processing Traps with Thresholds When you configure trap support to use thresholds, each of the traps listed in the Traps Using Threshold [Page 33] section has an Event Rule applied to it. By default, SPECTRUM will watch to see if one of these traps has been generated three times in any fifteen minute interval. If so, SPECTRUM will generate another event, which generates a single alarm. Notice that an Event Rule has not been applied to every event. To configure SPECTRUM to do this: 1. Navigate to the <$SPECROOT>/SS/CsVendor/Cisco_Router directory. 2. Find the file named EventDisp and make a copy of it called EventDisp.norules. 3. Open the EventDisp.rules file located in the <$SPECROOT>/SS/ CsVendor/Cisco_Router/Rules directory. Select and copy all of the entries in this file. 4. Go back to the <$SPECROOT>/SS/CsVendor/Cisco_Router directory and open the EventDisp file. Find the entries from 0x through 0x and replace them with the entries you have copied from the EventDisp.rules file. Page 32

33 Traps Using Threshold Trap Name Trap OID Event Generated Condition Event Generated if Condition is Met Alarm Generated by Second Event Alarm Severity IKE System Failure x Event occurs three times on one model within any 15 minute interval. IKE Certificate Control Failure x Event occurs three times on one model within any 15 minute interval. IKE Protocol Failure x Event occurs three times on one model within any 15 minute interval. IKE No Security Association x Event occurs three times on one model within any 15 minute interval. Phase II System Failure x Event occurs three times on one model within any 15 minute interval. Phase II Set Up Failure x a Event occurs three times on one model within any 15 minute interval. 0x x Orange 0x x Orange 0x x Orange 0x x Orange 0x x Orange 0x a 0x a Orange Phase II Early Tunnel Termination x b Event occurs three times on one model within any 15 minute interval. 0x b 0x b Yellow Phase II Protocol Failure x c Event occurs three times on one model within any 15 minute interval. 0x c 0x c Orange 5127 Page 33

34 Trap Name Trap OID Event Generated Condition Event Generated if Condition is Met Alarm Generated by Second Event Alarm Severity Phase II No Security Association x d Event occurs three times on one model within any 15 minute interval. Too Many Security Associations x Event occurs three times on one model within any 15 minute interval. 0x d 0x d Orange 0x e 0x Orange 5127 Page 34

35 Cisco Syslog Application The Cisco Syslog Application provides access to the following SpectroGRAPH views: Cisco Syslog Message Filter SpectroGRAPH View [Page 35] Cisco SysLog Basic Configuration SpectroGRAPH View [Page 36] Cisco SysLog History Table SpectroGRAPH View [Page 37] Syslog Trap Support [Page 38] Cisco Syslog Message Filter SpectroGRAPH View Note: From the Icon Subviews menu of the CiscSysLogApp icon, select Syslog Message Filters. This SpectroGRAPH view allows you to filter out unwanted syslog messages and prevent the creation of alarms or events from unwanted messages. Filters can be set to true or false. System_Filter Set this button to true to filter out all syslog messages whose facilities deal with the system, e.g. CBUS, MEMSCAN, etc. Protocol_Filter Set this button to true to filter out all syslog messages whose facilities deal with protocols such as BGP, OSPF, SNMP, SPANTREE, etc. Software_Filter Set this button to true to filter out all syslog messages that deal with internal software such as PARSER, RSP, GRPGE, etc. Hardware_Configuration_Filter Set this button to true to filter out all syslog messages that deal with the hardware configuration of the device such as IOCARD, MODEM, DIALSHELF, etc. Page 35

36 Security_Filter Set this button to true to filter out all syslog messages that deal with the security of the system such as RADIUS, SECURITY, etc. Environment_Filter Set this button to true to filter out all syslog messages that deal with environment variables such as LCFE, LCGE, etc. Connection_Configuration_Filter Set this button to true to filter out all syslog messages that deal with connection configuration of the device such as MROUTE, ISDN, X25, etc. Pix_Firewall_Filter Set this button to true to filter out all syslog messages that deal with the Cisco PIX Firewall device. Cisco SysLog Basic Configuration SpectroGRAPH View Note: From the Icon Subviews of the CiscSysLogApp Application icon, select Basic. This SpectroGRAPH view displays the following information. Notifications Sent The number of syslog message generated notifications that have been sent. This number may include notifications that were prevented from being transmitted due to reasons such as resource limitations and/or nonconnectivity. Notifications Enabled This button determines whether notifications will or will not be sent when a syslog message is generated by the device. Disabling notifications does not prevent syslog messages from being added to the Cisco SysLog History Table [Page 37]. Messages Ignored Indicates the number syslog messages which were ignored. A message will be ignored if it has a severity value greater then Max Severity Level [Page 37]. Page 36

37 Messages Dropped The number of messages which could not be processed due to a lack of system resources. A message that is dropped will not appear in the Cisco SysLog History Table. Max Severity Level Indicates which syslog severity levels will be processed. Any syslog message with a severity value greater than this value will be ignored by the agent. Severity numeric values increase as their severity decreases, e.g. error (4) is more severe than debug (8). Severity values are (1) emergency, (2) alert, (3) critical, (4) error, (5) warning, (6) notice, (7) info, and (8) debug. Cisco SysLog History Table SpectroGRAPH View Note: From the Icon Subviews of the CiscSysLogApp Application icon, select History. This SpectroGRAPH view displays Max Table Length and Messages Flushed fields as well as the Cisco SysLog History Table which displays the syslog messages generated by the device. Max Table Length The limit on the number of entries that the Cisco SysLog History Table may contain. A value of 0 will prevent any history from being retained. When this table is full, the oldest entry will be deleted and a new one will be created. Messages Flushed The number of entries that have been removed from the Cisco SysLog History Table in order to make room for new entries. This object can be used to determine whether your polling frequency is fast enough. Cisco SysLog History Table Index An increasing integer that indexes messages. When it reaches the maximum value, the agent flushes the table and returns this value to 1. Facility The name of the facility that generated this message. Page 37

38 Severity The severity of the message. Message Name A textual name for the message type. A facility name in conjunction with a message name uniquely identifies a message type. Message Text The text of the message. If the text of the message exceeds 255 bytes, the message will be truncated to 254 bytes and a * character will be appended to indicate this. Time Stamp The value of sysuptime when this message was generated. Syslog Trap Support The System Message Log (syslog) protocol is used to send text messages from a Cisco Router to the Network Management Software. These messages are sent to the SPECTRUM Event Manager as SNMP traps. Syslog trap support allows the router device to identify these messages and escalate them to alarms as necessary. Syslog trap support also provides the Cisco Router model icon the capability to communicate model alarm severity information. When an alarm occurs, as indicated by the Cisco Router device icon, you will be able to observe the SPECTRUM Alarm Severity and a syslog message will appear in the Alarm log (which can be found in the Alarm Manager SpectroGRAPH view). These syslog messages are classified by severities that range from 0 to 7 (most severe to least severe). These messages are described in Table 1 The alarms are displayed in the Alarm Log. As these alarms are associated with the Cisco Router device model, the model icon will change color and flash depending on the severity of the alarm that it receives. Page 38

39 Table 1: Severity Level Code Severity Level Description 0 emergency-system is unusable. 1 alert- Immediate action required. 2 critical -Critical condition. 3 error- Error condition. 4 warning- Warning condition. 5 notification- normal but significant condition 6 informational- informational message only. 7 debugging- message that appears during debugging only. The syslog message severity is mapped to the SPECTRUM alarm severity as listed in Table 2. Table 2: Syslog Message Severity Alarm Severity Color 0-1 Red 2-3 Orange 4 Yellow Messages with an Alarm Severity of 5 through 7 typically do not generate an alarm, as they are of minor importance. Messages are listed by the facility (hardware device, protocol, or a module or system software) that produces the messages. A facility code is an abbreviation of the facility to which the message refers. A facility could be a specific hardware device, a protocol, or a portion of software. Within each facility, messages are listed by the severity level, from highest (0) to lowest (7). A mnemonic is a code which uniquely identifies the message. Page 39

40 Each message is followed by an explanation and a recommended action. Messages appear only when the system remains operational. The following is an example of a syslog message: 01/01/2001,18:31:15:SYS-5-MOD_INSERT:Module 5 has been inserted The meaning of this message is as follows: 01/01/2001,18:31:15 is the date and time of the error (this appears if set for system log messaging). SYS is the facility type. 5 is the severity level, indicating that it is a normal but significant condition. MOD_INSERT is the mnemonic code that uniquely identifies the message. All mnemonics are uppercase character strings. Module 5 has been inserted is the message text which describes the condition and may contain detailed information which varies from message to message. The System Message Log (syslog) software can save the system messages in a log file or direct them to other devices. Syslog software allows you to do the following: save logging information for monitoring and troubleshooting. select the types of logging information captured. select the destination of captured logging information. By default the switch logs normal but significant system messages to its internal buffer and sends these messages to the system console. You can specify which system messages should be saved based on the type of facility and the severity level. Messages can be time-stamped to enhance real-time debugging and management. Refer to the Enterprise Alarm Manager User Guide (2065) documentation for more information about SPECTRUM Alarm Manager. Note: The URL product/software/ios121/121newft/121t/ sem121t.htm is a link to more information about Cisco syslog messages including a list of facility codes and of error messages with their corresponding recommended actions. Page 40

41 Adding Syslog Trap Mappings to SPECTRUM SPECTRUM includes three text files which contain information that the SpectroSERVER uses to map Cisco syslog traps to Spectrum events (Table 3): Table 3:.Syslog Text Files Device Syslog Message Cisco Router Catalyst Switch Cisco PIX Text File <$SPECROOT>/SS/CsVendor/Cisco_Router/Rtr.txt <$SPECROOT>/SS/CsVendor/Ctron_CAT/Switch.txt <$SPECROOT>/SS/CsVendor/CiscoPIX/Pix.txt Each line in these text files contains information to map a specific syslog message to a specific SPECRTRUM event. The lines have the following format (each field is separated by a single space): <facility> <severity> <mnemonic> <event code> To add support for a new syslog message follow this procedure: Procedure 1. Add a new line to the appropriate file that contains the above information. For example, to add support for the following syslog message for Cisco Routers: %SPE-3-SM_DOWNLOAD_FAILED add the following line to the Rtr.txt file: SPE 3 SM_DOWNLOAD_FAILED 0xffff0001 where 0xffff0001 is an arbitrary code you choose. 2. Create Event Format and Probable Cause files for the event and alarm. For more information on creating these files, see the Event Configuration Files Guide (5070). In this case you would need to create Eventffff0001 and Probffff0001. You can enter any text in these files. The following variable data can be read from the Event Message and displayed in the Event Format file: {S 1}- Facility {T T1_ }- Severity {S 3}- Mnemonic {S 4} - Message Page 41

42 3. Finally, in the same directory as the Rtr.txt file there should be an EventDisp file. You need to add the event to alarm mapping to this. Using the above example you would need to add the following line: 0xffff0001 E 50 A 2,0xffff0001 This will cause an orange alarm to be generated whenever this syslog trap is received by the SpectroSERVER. Note: All of this configuration can be done while the SpectroSERVER is running. The server will check for changes to the *.txt files once a minute. Page 42