Cisco Applications. Document 5127

Transcription

1

2 Notice Copyright Notice Copyright 2002-present by Aprisma Management Technologies, Inc. All rights reserved worldwide. Use, duplication, or disclosure by the United States government is subject to the restrictions set forth in DFARS (c)(1)(ii) and FAR Liability Disclaimer Aprisma Management Technologies, Inc. ( Aprisma ) reserves the right to make changes in specifications and other information contained in this document without prior notice. In all cases, the reader should contact Aprisma to inquire if any changes have been made. The hardware, firmware, or software described in this manual is subject to change without notice. IN NO EVENT SHALL APRISMA, ITS EMPLOYEES, OFFICERS, DIRECTORS, AGENTS, OR AFFILIATES BE LIABLE FOR ANY INCIDENTAL, INDIRECT, SPECIAL, OR CONSEQUENTIAL DAMAGES WHATSOEVER (INCLUDING BUT NOT LIMITED TO LOST PROFITS) ARISING OUT OF OR RELATED TO THIS MANUAL OR THE INFORMATION CONTAINED IN IT, EVEN IF APRISMA HAS BEEN ADVISED OF, HAS KNOWN, OR SHOULD HAVE KNOWN, THE POSSIBILITY OF SUCH DAMAGES. Trademark, Service Mark, and Logo Information SPECTRUM, IMT, and the SPECTRUM IMT/VNM logo are registered trademarks of Aprisma Management Technologies, Inc., or its affiliates. APRISMA, APRISMA MANAGEMENT TECHNOLOGIES, the APRISMA MANAGEMENT TECHNOLOGIES logo, MANAGE WHAT MATTERS, DCM, VNM, SpectroGRAPH, SpectroSERVER, Inductive Modeling Technology, Device Communications Manager, SPECTRUM Security Manager, and Virtual Network Machine are unregistered trademarks of Aprisma Management Technologies, Inc., or its affiliates. For a complete list of Aprisma trademarks, service marks, and trade names, go to: All referenced trademarks, service marks, and trade names identified in this document, whether registered or unregistered, are the intellectual property of their respective owners. No rights are granted by Aprisma Management Technologies, Inc., to use such marks, whether by implication, estoppel, or otherwise. If you have comments or concerns about trademark or copyright references, please send an to spectrum-docs@aprisma.com; we will do our best to help. Restricted Rights Notice (Applicable to licenses to the United States government only.) This software and/or user documentation is/are provided with RESTRICTED AND LIMITED RIGHTS. Use, duplication, or disclosure by the government is subject to restrictions as set forth in FAR (June 1987) Alternate III(g)(3) (June 1987), FAR (June 1987), or DFARS (c)(1)(ii) (June 1988), and/or in similar or successor clauses in the FAR or DFARS, or in the DOD or NASA FAR Supplement, as applicable. Contractor/manufacturer is Aprisma Management Technologies, Inc. In the event the government seeks to obtain the software pursuant to standard commercial practice, this software agreement, instead of the noted regulatory clauses, shall control the terms of the government's license. Virus Disclaimer Aprisma makes no representations or warranties to the effect that the licensed software is virus-free. Aprisma has tested its software with current virus-checking technologies. However, because no antivirus system is 100-percent effective, we strongly recommend that you write protect the licensed software and verify (with an antivirus system with which you have confidence) that the licensed software, prior to installation, is virus-free. Contact Information Aprisma Management Technologies, Inc., 273 Corporate Drive, Portsmouth, NH USA Phone: U.S. toll-free: Web site: Page 2

3 Contents Notice... 2 Preface... 8 Intended Audience... 8 How to Use This Guide... 8 Text Conventions... 9 Document Feedback... 9 Online Documents... 9 Required Reading...10 Overview Purpose and Scope...11 Other Applications Documents...11 Interface Options...12 Sort...12 Find...12 Update...12 CiscIPSecApp IKE...13 Global Statistics Button...13 Peer Table...14 Tunnel Table...14 Phase II...14 Global Statistics Button...14 Tunnel Table...14 Security Protection Index Table...15 History...15 Table Size...15 Phase II History Information Button...15 Phase II Tunnel History Table...15 Endpoint History Table...16 Page 3

4 Check Point Selector Button...16 IKE Tunnel History Table...16 Failures...16 IKE Failure Table...16 Phase II Failure Table...17 Trap Control...17 IP Security Policy Map...17 IKE Policy Map Table...18 Phase II Policy Map Table...18 CiscIPSecExtApp ISAKMP Configuration...19 IPSec Information...20 IPSec Global Configuration...20 Cryptomap Set Information...20 Static Cryptomap Set Information...20 Dynamic Cryptomap Set Information...20 Interface Cryptomap Set Information...20 Static Cryptomap Information...21 System Capacity...21 Trap Control...21 Traps, Events, and Alarms for the CiscIPSecApp and CiscIPSecExtApp Default Trap Support...24 CiscIPSecApp Trap Support...24 CiscIPSecExtApp Trap Support...26 Processing Traps with Thresholds...27 Traps Using Threshold...28 Cisco Syslog Application Cisco Syslog Message Filter View...30 Cisco SysLog Basic Configuration View...31 Cisco SysLog History Table View...32 Page 4

5 Cisco SysLog History Table...32 Syslog Trap Support Adding Syslog Trap Mappings to SPECTRUM...36 Cisco IPM Routing Application IPM Route Table View...39 IPM Route Table...39 IPM Route Next Hop Table View...41 IPM Route Next Hop Table...41 IPM Route Interface Table View...42 IPM Route Interface Table...42 IPM Route Boundary Table View...43 IPM Route Boundary Table...43 Cisco IPM Route Table View...44 Cisco IPM Route Table...44 Cisco IPM Route Next Hop Table View...46 Cisco IPM Route Next Hop Table...47 Cisco IPM Route Heartbeat Table View...47 Cisco IPM Route Heart Beat Table...48 Cisco PIM Application PIM Interface Table View...49 PIM Interface Table...49 PIM Neighbor Table View...50 PIM Neighbor Table...51 PIM IPM Route Table View...51 PIM IPM Route Table...51 PIM Rendezvous Point Sets Table View...52 Rendezvous Point Sets Table...52 PIM IPM Route Next Hop Table View...53 PIM IPM Route Next Hop Table...53 PIM Candidate Rendezvous Point Table View...54 PIM Candidate Rendezvous Point Table...54 Page 5

6 PIM Component Table View...55 PIM Component Table...55 Cisco PIM Objects View...56 Traps, Events, and Alarms for the RFC2934 PIM MIB Cisco VPDN Application Cisco VPDN System Info View...60 Cisco VPDN Tunnel Attribute View...61 Cisco VPDN Tunnel Session View...63 Cisco VPDN User Failure History View...66 Cisco DLSW Ext Application Cisco DLSW Ext Node View...68 Cisco DLSW Ext Transport Connection Config View...74 Cisco DLSW Ext Transport Connection Operation View...77 Cisco DLSW Ext Transport Connection Specific View...78 Cisco DLSW Ext Transport Connection Direct Config View...79 Cisco DLSW Ext Interface View...80 Cisco DLSW Ext Fast View...80 Cisco DLSW Ext Circuit View...82 Cisco DLSW Ext Trap Control View...83 Cisco DLSW Application Cisco DLSW Node View...84 Cisco DLSW Transport Connection Statistics View...87 Cisco DLSW Transport Connection Config View...88 Cisco DLSW Transport Connection Operation View...91 Cisco DLSW Transport Connection TCP Config View...96 Cisco DLSW Transport Connection TCP Operation View...97 Cisco DLSW Interface View...97 Cisco DLSW Dir MAC Cache View...98 Dlsw Dir MAC Table...99 Cisco DLSW Dir NBIOS Cache View Page 6

7 Cisco DLSW Dir Location View Dlsw Dir Locate Mac Table Dlsw Dir Locate NBIOS Table Cisco DLSW Circuit View Dlsw Circuit Table Cisco DLSW SDLC View Dlsw LS Table Cisco HSRP Application Cisco HSRP Group Table View HSRP Group Table Cisco HSRP Group Tracked Interface Table View Cisco Secondary HSRP IP Address Table View Cisco HSRP Physical Interface Configuration Table View Cisco Entity Alarm Application Traps, Events, and Alarms for the Cisco Entity Alarm Application Additional Traps, Events, and Alarms CISCO-DDP-IAPP-MIB CISCO-IETF-DOT11-QOS-EXT-MIB CISCO-L2-DEV-MONITORING-MIB CISCO-WLAN-VLAN-MIB Index Page 7

8 Preface Welcome to the guide. Please take a moment to read through this short preface, which explains how the information in this guide is organized and presented and lets you know how to access information about other SPECTRUM products. In This Section Intended Audience How to Use This Guide Text Conventions [Page 9] Document Feedback [Page 9] Online Documents [Page 9] Required Reading [Page 10] Intended Audience This guide is intended to provide users of SPECTRUM s Cisco application models with a definition of the information presented in the application model views. A description of trap, event and alarm support for each application is also provided. How to Use This Guide Use this document as a guide for managing the following Cisco application models: CiscIPSecApp [Page 13]: This section defines the views that the application model uses to support the Cisco-IPSec-Flow-Monitor-MIB and the Cisco- IPSec-Policy-Map-MIB. CiscIPSecExtApp [Page 19]: This section defines the views that the application model uses to support the Cisco-IPSec-MIB. Page 8

9 Traps, Events, and Alarms for the CiscIPSecApp and CiscIPSecExtApp [Page 23]:This section defines the traps, events and alarms that these application models support. Text Conventions The following text conventions are used in this document: Element Convention Used Example User-supplied parameter names Courier and Italic in angle brackets <>. The user needs to type the password in place of <password>. On-screen text Courier The following line displays: path= /audit User-typed text Courier Type the following path name: C:\ABC\lib\db Cross-references References to SPECTRUM documents (title and number) Functionality enabled by SPECTRUM Alarm Notification Manager (SANM) Underlined and hypertextblue Italic SANM in brackets []. See Document Feedback [Page 9]. SPECTRUM Installation Guide (0675) [SANM] AGE_FIELD_ID Document Feedback Please send feedback regarding SPECTRUM documents to the following address: Thank you for helping us improve our documentation. Online Documents SPECTRUM documents are available online at: Page 9

10 Check this site for the latest updates and additions. Required Reading To use this documentation effectively, you must be familiar with the information covered by the SPECTRUM documents listed below. Getting Started with SPECTRUM for Operators (1763) Getting Started with SPECTRUM for Administrators (0985) How to Manage Your Network with SPECTRUM (1909) SPECTRUM Views (2517) SPECTRUM Menus (2519) SPECTRUM Icons (2518) Application View and MIBs (2560) SPECTRUM Software Release Notice (0743) Page 10

11 Overview This section summarizes this document, which is one of a set of documents describing SPECTRUM applications. This section also provides references to other applications documents. In This Section Purpose and Scope [Page 11] Other Applications Documents [Page 11] Purpose and Scope This document defines the fields displayed in the views associated with SPECTRUM Cisco application models. In all cases, the views and fields described in this document are accessed from the Icon Subviews menu of the application models displayed in the Main Applications view. This document also defines the traps, events, and alarms that each application model supports. Other Applications Documents The table below lists the documents that cover the other categories of SPECTRUM applications. In addition to the documents listed in the table, the document Application View and MIBs provides an introduction to the Application view and defines MIB functions in network management. Document Title Technology Applications Bridging Applications MIB-II Applications Routing Applications Digital Subscriber Line Applications Typical Applications APPN, ATM, DHCP Spanning Tree, PPP Bridging SNMP, ICMP, TCP OSPF, VRRP, BGP4 ADSL Page 11

12 Interface Options The following buttons are used throughout the GIB views that support the Cisco application models. Sort The sort button arranges the values in the highlighted column in the table in ascending order. To highlight a column, click on the column title, then click the Sort button to sort the column. Find The Find button activates a dialog box that allows you to do a string search on the highlighted column in the table. To highlight a column, click on the column title. Click Find and type the search criteria into the box provided. Click the Find button in this dialog box to find the first instance of the search criteria. Click Find again to move to the next instance. Update The update button refreshes all of the values in the table with the latest values from the device. Values are only updated when this button is used or when the view is launched. Page 12

13 CiscIPSecApp This section describes the CiscoIPSecApp application which provides support for two Cisco MIBs: the Cisco- IPSec-Flow-Monitor-MIB, used for monitoring the structures in Secure IP Protocol (IPSec) based Virtual Private Networks, and the Cisco-IPSec-Policy-Map-MIB, used to map the dynamically instantiated protocol structures to policy entities that gave rise to them. Each of the views used to support these MIBs are listed below. The first five show information from the Cisco- IPSec-Flow-MIB, and the last shows information from the Cisco-IPSec-Policy-Map-MIB. In This Section IKE [Page 13] Phase II [Page 14] History [Page 15] Failures [Page 16] Trap Control [Page 17] IP Security Policy Map [Page 17] IKE Note: From the Icon Subviews menu for the CiscIPSecApp Application icon, select IKE. This view provides information in the following tables and buttons: Global Statistics Button This button activates the Global Statistics view, which lists the IPSec Phase-1 Global Statistics. These values pertain to the IPSec Phase-1 IKE tunnels available to the device. All of these statistics are read-only. Page 13

14 Peer Table This table shows each peer that is currently associated with an active IPSec Phase-1 tunnel. The IPSec tunnel itself may or may not be active. All of the values in the table are read-only. Tunnel Table The Tunnel Table shows an entry for each active IPSec Phase-1 IKE tunnel available to the device. Double clicking on any column in the table activates the Tunnel Table Detail view. This view shows all of the data for a specific entry in the table. The only value in this table that can be modified is the Status field. To modify this value, double click on it to go to the Tunnel Table Detail view. In this view, choose either active or destroy from the list box next to the Status field. Setting the value to destroy will bring the tunnel down. The Status value cannot be used to create a table row. Phase II Note: From the Icon Subviews menu for the CiscIPSecApp Application icon, select Phase II. This view provides information in the following tables and buttons: Global Statistics Button This button activates the Global Statistics view, which lists the IPSec Phase-2 Global Statistics. These values pertain to the IPSec Phase-2 tunnels available to the device. All of these statistics are read-only. Tunnel Table The Tunnel Table shows an entry for each active IPSec Phase-2 tunnel available to the device. Double clicking on any column in the table activates the Tunnel Table Detail view. This view shows all of data for a specific entry in the table. The only value in this table that can be modified is the Status field. To modify this value, double click on it to go to the Tunnel Table Detail view. In this view, choose either active or destroy from the list box next to the Page 14

15 Status field. Setting the value to destroy will bring the tunnel down, destroy the Security Association bundle and delete this row from the table. The Status value cannot be used to create a table row. Endpoint Table This table contains an entry for each active endpoint associated with an IPSec Phase-2 tunnel. All of the values in this table are read-only. Security Protection Index Table This table contains an entry for each active and expiring security association. All of the values in this table are read-only. History Note: From the Icon Subviews menu for the CiscIPSecApp Application icon, select History. This view provides information in the following tables, fields and buttons: Table Size This field allows you to specify how many historical entries are maintained in the IPSec Phase-1 and Phase-2 History tables. You can change this value by editing the value currently displayed in this field and saving this change using the File > Save All Changes option. Phase II History Information Button This button activates the Phase II History Information view, which shows the Phase II Tunnel History table and the Endpoint History table. Phase II Tunnel History Table The Phase II Tunnel History table shows one entry for each previously active IPSec Phase-2 tunnel. The values in this table are read-only. Page 15

16 Endpoint History Table The Endpoint History table shows one entry for each previously active IPSec Phase-2 endpoint. The values in this table are read-only. Check Point Selector Button The check point button allows you to select the check point processing state. This value will be set to ready when the agent is ready to create ondemand history entries for active IPSec Tunnels. If you set the value to checkpoint, the agent will create an entry in the IPSec Phase -1 Tunnel History for each active IPSec Phase-1 tunnel, and an entry in the IPSec Phase-2 Tunnel History table and the IPSec Phase-2 Tunnel Endpoint History Table for each active IPSec Phase-2 tunnel. While the agent is creating these entries, the value of the check point button is set to checkpoint. IKE Tunnel History Table This table shows one entry for each previously active IPSec Phase-1 IKE tunnel. All of the values in this table are read-only. Failures Note: From the Icon Subviews menu for the CiscIPSecApp Application icon, select Failures. This view provides information in the following tables and fields: IP Security Failure Table Size This field allows you to specify the maximum number of entries which will be maintained in the IPSec Phase-1 and Phase-2 Failure tables. You can change this value by editing the value currently displayed in this field and saving this change using the File > Save All Changes option. IKE Failure Table This table shows one entry for each IPSec Phase-1 failure. All of the values in this table are read-only. Page 16

17 Phase II Failure Table This table shows one entry for each IPSec Phase-2 failure. All of the values in this table are read-only. Trap Control Note: From the Icon Subviews menu for the CiscIPSecApp Application icon, select Trap Control. This view provides buttons to enable and disable the following IKE and Phase II traps for the current model. For more information on each of these traps, see Traps, Events, and Alarms for the CiscIPSecApp and CiscIPSecExtApp [Page 23]. IKE Tunnel Start IKE Tunnel Stop IKE System Failure IKE Certificate Control Failure IKE Protocol Failure IKE No Security Association Phase II Tunnel Start Phase II Tunnel Stop Phase II System Failure Phase II Set Up Failure Phase II Early Tunnel Termination Phase II Protocol Failure Phase II No Security Association IP Security Policy Map Note: From the Icon Subviews menu for the CiscIPSecApp Application icon, select IP Security Policy Map. This view contains the following tables: Page 17

18 IKE Policy Map Table This table maps an IPSec Phase-1 tunnel to the Internet Security Association and Key Exchange (ISAKMP) Policy. There is one entry for each active IPSec Phase-1 tunnel. All values in this table are read-only. Phase II Policy Map Table This table maps an IPSec Phase-2 tunnel to the corresponding IPSec Policy element (called a cryptomap).there is one entry for each active IPSec Phase-2 tunnel. All values in this table are read-only. Page 18

19 CiscIPSecExtApp This section describes the CiscoIPSecExtApp application which provides support for the Cisco-IPSec-MIB using the views outlined in this chapter. In This Section ISAKMP Configuration [Page 19] IPSec Information [Page 20] System Capacity [Page 21] Trap Control [Page 21] ISAKMP Configuration Note: From the Icon Subviews menu for the CiscIPSecExtApp Application icon, select ISAKMP Configuration. This view provides information about ISAKMP Configuration in the following tables and fields: Enabled The value in this field is set to TRUE if ISAKMP has been enabled on the managed element. If ISAKMP is not enabled, this value is set to FALSE. This is a read-only field. Identity The value in this field shows the type of identity used by the managed element in ISAKMP negotiations with another peer. This is a read-only field. Keepalive Interval The value in this field shows the time interval in seconds between successive ISAKMP keepalive heartbeats issued to the peers to which IKE tunnels have been set up. This is a read-only field. Policies The value in this field shows the number of ISAKMP policies that have been configured on the managed element. This is a read-only field. Page 19

20 Policy Table This table contains a list of all ISAKMP policy entries configured by the operator. All of the values in this table are read-only. IPSec Information The following subviews are available under the IPSec Information menu: IPSec Global Configuration Note: From the Icon Subviews menu for the CiscIPSecExtApp Application icon, select IPSec Information -> IPSec Global Configuration. This view provides IPSec global configuration information. All of these values are read-only. Cryptomap Set Information Note: From the Icon Subviews menu for the CiscIPSecExtApp Application icon, select IPSec Information -> Cryptomap Set Information. This view provides three tables: Static Cryptomap Set Information This table shows a list of all cryptomap sets that are fully specified and do not contain wild-cards. Each entry in the table contains the attributes associated with a single static cryptomap set. All values in this table are read-only. Dynamic Cryptomap Set Information This table shows a list of all dynamic cryptomaps that use IKE defined on the managed element. Each entry in the table contains the attributes associated with a single dynamic cryptomap template. All values in this table are read-only. Interface Cryptomap Set Information This table shows the binding of cryptomap sets to the interfaces of the managed entity. Each entry in the table shows the association between an Page 20

21 interface and a cryptomap set that is defined on the managed element. The cryptomap set identified in this binding must be static. Dynamic cryptomaps cannot be bound to interfaces. All values in this table are read-only. Static Cryptomap Information Note: From the Icon Subviews menu for the CiscIPSecExtApp Application icon, select IPSec Information -> Static Cryptomap Information. This table lists the members of the cryptomap sets that are configured on the managed element. Each entry contains the attributes associated with a single static cryptomap entry. This table does not include the members of dynamic cryptomap sets that may be linked with the parent static cryptomap set. All values in this table are read-only. System Capacity Note: From the Icon Subviews menu for the CiscIPSecExtApp Application icon, select System Capacity. This view provides information in the following fields: Max Security Assoc Field This field contains the maximum number of IPSec security associations that can be established on this managed element. If no theoretical limit exists, the value shown is 0. This value is read-only. 3DES Capable Field This field shows if the managed element is capable of supporting the 3DES encryption algorithm. A value of TRUE indicates that it is supported, a value of FALSE indicates that it is not. This value is read-only. Trap Control Note: From the Icon Subviews menu for the CiscIPSecExtApp Application icon, select Trap Control. Page 21

22 This view provides buttons to enable and disable the following ISAKMP and Cryptomap traps for the current model. For more information on each of these traps, see Traps, Events, and Alarms for the CiscIPSecApp and CiscIPSecExtApp [Page 23]. ISAKMP Policy Added ISAKMP Policy Deleted Cryptomap Added Cryptomap Deleted Cryptomap Set Attached Cryptomap Set Detached Too Many Security Associations Page 22

23 Traps, Events, and Alarms for the CiscIPSecApp and CiscIPSecExtApp This section specifies the supported traps for each application and describes how the trap is processed using SPECTRUM events and alarms. There are two possible trap support configurations that you can use for the CiscIPSecApp and the CiscIPSecExtApp. The default configuration generates an event and sometimes an alarm when one of the supported traps is received. The alternative configuration tracks the rate at which some traps are received, and only generates an alarm if the number of traps exceeds a specified threshold within a certain time frame. The default trap support configuration is explained in: Default Trap Support [Page 24] The trap support that is based on the rate at which certain traps are received is explained in: Processing Traps with Thresholds [Page 27] Page 23

24 Default Trap Support CiscIPSecApp Trap Support The following table shows the events and alarms created by traps defined in the Cisco IPSec-Flow-Monitor-MIB. To enable or disable any of these traps on a per model basis, see Trap Control [Page 17]. Trap OID Event Generated Alarm Generated Default Alarm Severity IKE Tunnel Start x None None IKE Tunnel Stop x None None IKE System Failure x x Orange IKE Certificate Control Failure x x Orange IKE Protocol Failure x x Orange IKE No Security Association x x Orange Phase II Tunnel Start x None None Phase II Tunnel Stop x None None Phase II System Failure x x Orange Phase II Set Up Failure x a 0x a Orange Phase II Early Tunnel Termination x b 0x b Yellow Phase II Protocol Failure x c 0x c Orange Phase II No Security Association x d 0x d Orange IKE Tunnel Start This trap is generated when an IPSec Phase-1 IKE tunnel becomes active. IKE Tunnel Stop This trap is generated when an IPSec Phase-1 tunnel becomes inactive. IKE System Failure This trap is generated when the processing for an IPSec Phase-1 IKE tunnel experiences an internal or system capacity error. Page 24

25 IKE Certificate Control Failure This trap is generated when the processing for an IPSec Phase-1 IKE tunnel experiences a Certificate or a Certificate Revoke List (CRL) related error. IKE Protocol Failure This trap is generated when the processing for an IPSec Phase-1 IKE tunnel experiences a protocol related error. IKE No Security Association This trap is generated when the processing for an IPSec Phase-1 tunnel experiences a non-existent security association error. Phase II Tunnel Start This trap is generated when an IPSec Phase-2 tunnel becomes active. Phase II Tunnel Stop This trap is generated when an IPSec Phase-2 tunnel becomes inactive. Phase II System Failure This trap is generated when the processing for an IPSec Phase-2 tunnel experiences an internal or system capacity error. Phase II Set Up Failure This trap is generated when the setup for an IPSec Phase-2 tunnel fails. Phase II Early Tunnel Termination This trap is generated when an IPSec Phase-2 tunnel is terminated early or before expected. Phase II Protocol Failure This trap is generated when the processing of an IPSec Phase-2 tunnel experiences a protocol related error. Phase II No Security Association This trap is generated when the processing for an IPSec Phase-2 tunnel experiences a non-existent security association error. Page 25

26 CiscIPSecExtApp Trap Support The following table shows the events and alarms created by traps defined in the Cisco-IPSec-MIB. To enable or disable any of these traps on a per model basis, see Trap Control [Page 21]. Trap OID Event Generated Alarm Generated Default Alarm Severity ISAKMP Policy Added x e None None ISAKMP Policy Deleted x f 0x f Yellow Cryptomap Added x None None Cryptomap Deleted x x Yellow Cryptomap Set Attached x None None Cryptomap Set Detached x x Yellow Too Many Security Associations x x Orange ISAKMP Policy Added This trap is generated when a new ISAKMP policy element is defined on the managed element. The context of the trap includes the updated number of ISAKMP policy elements currently available. ISAKMP Policy Deleted This trap is generated when an existing ISAKMP policy element is deleted on the managed element. The context of the trap includes the updated number of ISAKMP policy elements currently available. Cryptomap Added This trap is generated when a new cryptomap is added to the specified cryptomap set. Cryptomap Deleted This trap is generated when a cryptomap is removed from the specified cryptomap set. Page 26

27 Cryptomap Set Attached A cryptomap set must be attached to an interface of the device in order for it to be operational. This trap is generated when the cryptomap set is attached to an active interface of the managed element. Cryptomap Set Detached This trap is generated when a Cryptomap set is detached from an interface to which it was bound. The context of the trap identifies the size of the cryptomap set. Too Many Security Associations This trap is generated when an attempt is made to set up a new SA while the number of currently active SAs equals the maximum configurable. Processing Traps with Thresholds When you configure trap support to use thresholds, each of the traps listed in the Traps Using Threshold [Page 28] section has an Event Rule applied to it. By default, SPECTRUM will watch to see if one of these traps has been generated three times in any fifteen minute interval. If so, SPECTRUM will generate another event, which generates a single alarm. Notice that an Event Rule has not been applied to every event. To configure SPECTRUM to do this: 1. Navigate to the <$SPECROOT>/SS/CsVendor/Cisco_Router directory. 2. Find the file named EventDisp and make a copy of it called EventDisp.norules. 3. Open the EventDisp.rules file located in the <$SPECROOT>/SS/ CsVendor/Cisco_Router/Rules directory. Select and copy all of the entries in this file. 4. Go back to the <$SPECROOT>/SS/CsVendor/Cisco_Router directory and open the EventDisp file. Find the entries from 0x through 0x and replace them with the entries you have copied from the EventDisp.rules file. Page 27

28 Traps Using Threshold Trap OID Event Generated Condition Event generated if condition is met. Alarm generated by second event Default Alarm Severity IKE System Failure x Event occurs three times on one model within any 15 minute interval. IKE Certificate Control Failure x Event occurs three times on one model within any 15 minute interval. IKE Protocol Failure x Event occurs three times on one model within any 15 minute interval. IKE No Security Association x Event occurs three times on one model within any 15 minute interval. Phase II System Failure x Event occurs three times on one model within any 15 minute interval. Phase II Set Up Failure x a Event occurs three times on one model within any 15 minute interval. 0x x Orange 0x x Orange 0x x Orange 0x x Orange 0x x Orange 0x a 0x a Orange Phase II Early Tunnel Termination x b Event occurs three times on one model within any 15 minute interval. 0x b 0x b Yellow Phase II Protocol Failure x c Event occurs three times on one model within any 15 minute interval. 0x c 0x c Orange 5127 Page 28

29 Trap OID Event Generated Condition Event generated if condition is met. Alarm generated by second event Default Alarm Severity Phase II No Security Association x d Event occurs three times on one model within any 15 minute interval. Too Many Security Associations x Event occurs three times on one model within any 15 minute interval. 0x d 0x d Orange 0x e 0x Orange 5127 Page 29

30 Cisco Syslog Application The Cisco Syslog Application provides access to the following views: Cisco Syslog Message Filter View [Page 30] Cisco SysLog Basic Configuration View [Page 31] Cisco SysLog History Table View [Page 32] Note: See Syslog Trap Support [Page 34] and Adding Syslog Trap Mappings to SPECTRUM [Page 36] for more information. Cisco Syslog Message Filter View Note: From the Icon Subviews menu of the CiscSysLogApp icon, select Syslog Message Filters. This view allows you to filter out unwanted syslog messages and prevent the creation of alarms or events from unwanted messages. Filters can be set to true or false. System_Filter Set this button to true to filter out all syslog messages whose facilities deal with the system, e.g. CBUS, MEMSCAN, etc. Protocol_Filter Set this button to true to filter out all syslog messages whose facilities deal with protocols such as BGP, OSPF, SNMP, SPANTREE, etc. Software_Filter Set this button to true to filter out all syslog messages that deal with internal software such as PARSER, RSP, GRPGE, etc. Hardware_Configuration_Filter Set this button to true to filter out all syslog messages that deal with the hardware configuration of the device such as IOCARD, MODEM, DIALSHELF, etc. Page 30

31 Security_Filter Set this button to true to filter out all syslog messages that deal with the security of the system such as RADIUS, SECURITY, etc. Environment_Filter Set this button to true to filter out all syslog messages that deal with environment variables such as LCFE, LCGE, etc. Connection_Configuration_Filter Set this button to true to filter out all syslog messages that deal with connection configuration of the device such as MROUTE, ISDN, X25, etc. Pix_Firewall_Filter Set this button to true to filter out all syslog messages that deal with the Cisco PIX Firewall device. Cisco SysLog Basic Configuration View Note: From the Icon Subviews of the CiscSysLogApp Application icon, select Basic. This view displays the following information. Notifications Sent The number of syslog message generated notifications that have been sent. This number may include notifications that were prevented from being transmitted due to reasons such as resource limitations and/or nonconnectivity. Notifications Enabled This button determines whether notifications will or will not be sent when a syslog message is generated by the device. Disabling notifications does not prevent syslog messages from being added to the Cisco SysLog History Table [Page 32]. Messages Ignored Indicates the number syslog messages which were ignored. A message will be ignored if it has a severity value greater then Max Severity Level [Page 32]. Page 31

32 Messages Dropped The number of messages which could not be processed due to a lack of system resources. A message that is dropped will not appear in the Cisco SysLog History Table. Max Severity Level Indicates which syslog severity levels will be processed. Any syslog message with a severity value greater than this value will be ignored by the agent. Severity numeric values increase as their severity decreases, e.g. error (4) is more severe than debug (8). Severity values are (1) emergency, (2) alert, (3) critical, (4) error, (5) warning, (6) notice, (7) info, and (8) debug. Cisco SysLog History Table View Note: From the Icon Subviews of the CiscSysLogApp Application icon, select History. This view displays Max Table Length and Messages Flushed fields as well as the Cisco SysLog History Table which displays the syslog messages generated by the device. Max Table Length The limit on the number of entries that the Cisco SysLog History Table may contain. A value of 0 will prevent any history from being retained. When this table is full, the oldest entry will be deleted and a new one will be created. Messages Flushed The number of entries that have been removed from the Cisco SysLog History Table in order to make room for new entries. This object can be used to determine whether your polling frequency is fast enough. Cisco SysLog History Table Index An increasing integer that indexes messages. When it reaches the maximum value, the agent flushes the table and returns this value to 1. Facility The name of the facility that generated this message. Page 32

33 Severity The severity of the message. Message Name A textual name for the message type. A facility name in conjunction with a message name uniquely identifies a message type. Message Text The text of the message. If the text of the message exceeds 255 bytes, the message will be truncated to 254 bytes and a * character will be appended to indicate this. Time Stamp The value of sysuptime when this message was generated. Page 33

34 Syslog Trap Support This section describes the Syslog Trap Support available for Cisco devices. The System Message Log (syslog) protocol is used to send text messages from a Cisco Router to the Network Management Software. These messages are sent to the SPECTRUM Event Manager as SNMP traps. Syslog trap support allows the router device to identify these messages and escalate them to alarms as necessary. Syslog trap support also provides the Cisco Router model icon the capability to communicate model alarm severity information. When an alarm occurs, as indicated by the Cisco Router device icon, you will be able to observe the SPECTRUM Alarm Severity and a syslog message will appear in the Alarm log (which can be found in the Alarm Manager View). These syslog messages are classified by severities that range from 0 to 7 (most severe to least severe). These messages are described in Table 1 The alarms are displayed in the Alarm Log. As these alarms are associated with the Cisco Router device model, the model icon will change color and flash depending on the severity of the alarm that it receives. Table 1: Severity Level Code Severity Level Description 0 emergency-system is unusable. 1 alert- Immediate action required. 2 critical -Critical condition. 3 error- Error condition. 4 warning- Warning condition. 5 notification- normal but significant condition 6 informational- informational message only. 7 debugging- message that appears during debugging only. Page 34

35 The syslog message severity is mapped to the SPECTRUM alarm severity as listed in Table 2. Table 2: Syslog Message Severity Alarm Severity Color 0-1 Red 2-3 Orange 4 Yellow Messages with an Alarm Severity of 5 through 7 typically do not generate an alarm, as they are of minor importance. Messages are listed by the facility (hardware device, protocol, or a module or system software) that produces the messages. A facility code is an abbreviation of the facility to which the message refers. A facility could be a specific hardware device, a protocol, or a portion of software. Within each facility, messages are listed by the severity level, from highest (0) to lowest (7). A mnemonic is a code which uniquely identifies the message. Each message is followed by an explanation and a recommended action. Messages appear only when the system remains operational. The following is an example of a syslog message: 01/01/2001,18:31:15:SYS-5-MOD_INSERT:Module 5 has been inserted The meaning of this message is as follows: 01/01/2001,18:31:15 is the date and time of the error (this appears if set for system log messaging). SYS is the facility type. 5 is the severity level, indicating that it is a normal but significant condition. MOD_INSERT is the mnemonic code that uniquely identifies the message. All mnemonics are uppercase character strings. Module 5 has been inserted is the message text which describes the condition and may contain detailed information which varies from message to message. Page 35

36 The System Message Log (syslog) software can save the system messages in a log file or direct them to other devices. Syslog software allows you to do the following: save logging information for monitoring and troubleshooting. select the types of logging information captured. select the destination of captured logging information. By default the switch logs normal but significant system messages to its internal buffer and sends these messages to the system console. You can specify which system messages should be saved based on the type of facility and the severity level. Messages can be time-stamped to enhance real-time debugging and management. Refer to the Enterprise Alarm Manager User Guide (2065) documentation for more information about SPECTRUM Alarm Manager. Note: The URL product/software/ios121/121newft/121t/ sem121t.htm is a link to more information about Cisco syslog messages including a list of facility codes and of error messages with their corresponding recommended actions. Adding Syslog Trap Mappings to SPECTRUM SPECTRUM includes three text files which contain information that the SpectroSERVER uses to map Cisco syslog traps to Spectrum events (Table 3): Page 36

37 Table 3:.Syslog Text Files Device Syslog Message Cisco Router Catalyst Switch Cisco PIX Text File <$SPECROOT>/SS/CsVendor/Cisco_Router/Rtr.txt <$SPECROOT>/SS/CsVendor/Ctron_CAT/Switch.txt <$SPECROOT>/SS/CsVendor/CiscoPIX/Pix.txt Each line in these text files contains information to map a specific syslog message to a specific SPECRTRUM event. The lines have the following format (each field is separated by a single space): <facility> <severity> <mnemonic> <event code> To add support for a new syslog message follow this procedure: Procedure 1. Add a new line to the appropriate file that contains the above information. For example, to add support for the following syslog message for Cisco Routers: %SPE-3-SM_DOWNLOAD_FAILED add the following line to the Rtr.txt file: SPE 3 SM_DOWNLOAD_FAILED 0xffff0001 where 0xffff0001 is an arbitrary code you choose. 2. Create Event Format and Probable Cause files for the event and alarm. For more information on creating these files, see the Event Configuration Files Guide (5070). In this case you would need to create Eventffff0001 and Probffff0001. You can enter any text in these files. The following variable data can be read from the Event Message and displayed in the Event Format file: {S 1}- Facility {T T1_ }- Severity {S 3}- Mnemonic {S 4} - Message 3. Finally, in the same directory as the Rtr.txt file there should be an EventDisp file. You need to add the event to alarm mapping to this. Using the above example you would need to add the following line: 0xffff0001 E 50 A 2,0xffff0001 Page 37

38 This will cause an orange alarm to be generated whenever this syslog trap is received by the SpectroSERVER. Note: All of this configuration can be done while the SpectroSERVER is running. The server will check for changes to the *.txt files once a minute. Page 38

39 Cisco IPM Routing Application This application (CiscIPMRoutApp) provides IP multicasting management views. In This Section IPM Route Table View [Page 39] IPM Route Next Hop Table View [Page 41] IPM Route Interface Table View [Page 42] IPM Route Boundary Table View [Page 43] Cisco IPM Route Table View [Page 44] Cisco IPM Route Next Hop Table View [Page 46] Cisco IPM Route Heartbeat Table View [Page 47] IPM Route Table View This view provides the IPM Route table as well as an IPM Route Enable [Page 41] button, both described below. IPM Route Table Note: From the Icon Subviews menu for the CiscIPMRoutApp Application icon, select Route. This table contains the following IP multicast routing information. Group Address The IP multicast group address for which this entry contains multicast routing information. Source Address The network address which when combined with the corresponding value of Source Mask [Page 40] identifies the sources for which this entry contains multicast routing information. Page 39

40 Source Mask The network mask which when combined with the corresponding value of Source Address [Page 39] identifies the sources for which this entry contains multicast routing information. Upstream Neighbor The address of the upstream neighbor (e.g., RPF neighbor) from which IP datagrams from these sources to this multicast address are received, or if the upstream neighbor is unknown (e.g., in CBT). IF Index The value of IF Index for the interface on which IP datagrams sent by these sources to this multicast address are received. A value of 0 indicates that datagrams are not subject to an incoming interface check, but may be accepted on multiple interfaces (e.g., in CBT). Up Time The time since the multicast routing information represented by this entry was learned by the router. Expiry Time The minimum amount of time remaining before this entry will be aged out. The value 0 indicates that the entry is not subject to aging. Packets The number of packets which this router has received from these sources and addressed to this multicast group address. Diff In IF Packets The number of packets which this router has received from these sources and addressed to this multicast group address, which were not received from the interface indicated by IF Index [Page 40]. Octets The number of octets contained in IP datagrams which were received from these sources and addressed to this multicast group address, and which were forwarded by this router. Protocol The routing mechanism via which this route was learned. Possible values are other, local, netmgmt, dvmrp, mospf, pimsparsedense, cbt, pimsparsemode, pimdensemode, and igmponly. Page 40

41 IPM Route Enable This button lets you enable and disable IP multicast routing. IPM Route Next Hop Table View This view provides the IPM Route Next Hop table, described below. Note: From the Icon Subviews menu for the CiscIPMRoutApp Application icon, select Route Next Hop. IPM Route Next Hop Table This table contains the following information on the next hops on outgoing interfaces for routing IP multicast datagrams. Each entry is one of a list of next hops on outgoing interfaces for particular sources sending to a particular multicast group address. Group The IP multicast group for which this entry specifies a next hop on an outgoing interface. Source The network address which when combined with the corresponding value of Source Mask identifies the sources for which this entry specifies a next hop on an outgoing interface. Source Mask The network mask which when combined with the corresponding value of Source identifies the sources for which this entry specifies a next hop on an outgoing interface. IF Index The IF Index value of the interface for the outgoing interface for this next hop. Address The address of the next hop specific to this entry. For most interfaces, this is identical to Group. NBMA interfaces, however, may have multiple next hop addresses out a single outgoing interface. Page 41

42 State An indication of whether the outgoing interface and next hop represented by this entry is currently being used to forward IP datagrams. The value forwarding indicates it is currently being used while the value pruned indicates that it is not. Up Time The time since the multicast routing information represented by this entry was learned by the router. Expiry Time The minimum amount of time remaining before this entry will be aged out. The value 0 indicates that the entry is not subject to aging. Closest Member Hops The minimum number of hops between this router and any member of this IP multicast group reached via this next hop on this outgoing interface. Any IP multicast datagrams for the group which have a TTL less than this number of hops will not be forwarded to this next hop. Protocol The routing mechanism via which this next-hop was learned. Possible values are other, local, netmgmt, dvmrp, mospf, pimsparsedense, cbt, pimsparsemode, pimdensemode, and igmponly. Packets The number of packets which have been forwarded using this route. IPM Route Interface Table View This view provides the IPM Route Interface table, described below. Note: From the Icon Subviews menu for the CiscIPMRoutApp Application icon, select Route Interface. IPM Route Interface Table This table contains the following multicast routing information specific to interfaces. Double-clicking any entry in this table opens the IPM Route Interface Table Entry view, which displays information for and lets you configure that entry. Page 42

43 IF Index The IF Index value of the interface for which this entry contains information. TTL Threshold The datagram TTL threshold for the interface. Any IP multicast datagrams with a Time to Live less than this threshold will not be forwarded out the interface. The default value of 0 means all multicast packets are forwarded out the interface. Protocol The routing protocol running on this interface. Possible values are other, local, netmgmt, dvmrp, mospf, pimsparsedense, cbt, pimsparsemode, pimdensemode, and igmponly. Rate Limit The rate-limit, in kilobits per second, of forwarded multicast traffic on the interface. A rate-limit of 0 indicates that no rate limiting is done. In Mcast Octets The number of octets of multicast packets that have arrived on the interface. Out Mcast Octets The number of octets of multicast packets that have been sent on the interface. IPM Route Boundary Table View This view provides the IPM Route Boundary table, described below. Note: From the Icon Subviews menu for the CiscIPMRoutApp Application icon, select Route Boundary. IPM Route Boundary Table This table lists the router's scoped multicast address boundaries and contains the following information. Page 43