CS Efficient Network Management. Class 5. Danny Raz

Transcription

1 CS Efficient Network Management Class 5 Danny Raz 1

2 Minhalot Exercise 1 is due TODAY Exercise2 writing a paper review (list will be on the Web by the midterm) Mailing list - exists Mid Term exam: in class on 12/12 Example will be on the webpage this week 2

3 Objectives NAT + MPAT Control using SNMP the set command Traps 3

4 Economically Managing Multiple Private Data Networks 4

5 The Problem How to manage two or more private networks that use the same address space from a single management station? x.y x.y x.y x.y A typical case: NM service provider x.y x.y 5

6 NAT - Network Address Translation Address translation: the management station will see two different sets of addresses, while in fact both networks are using the same address domain x.y NAT x.y NAT is more complicated than that, it can dynamically assign addresses and map many devices to a single IP address. However, since we want to manage the devices we have to use a static one to one translation x.y 6

7 NAT and SNMP NAT works very well with many applications: telnet, ftp, http (WEB). But not for SNMP: x.y NAT x.y typically the NM application uses address information in the payload of packets when the NM application is unaware of NAT it gets confused x.y 7

8 Overview The problem Possible solutions MPAT - Management Payload Address Translation architecture technical description Implementation issues Conclusions 8

9 Possible Solutions Reassign addresses to all elements shortage of addresses major reconfiguration problem Make the NM application NAT aware conceptually preferred expensive and complicated Translate the payload of the SNMP messages transparent and do not require global reconfiguration introduces additional complexity to the system can it be done efficiently? 9

10 MPAT - Management Payload Address Translator Translates IP address(es) in packet payload or data area Scans all data in SNMP packets (s), and detects data that is an IP address Checks the translation tables and replaces this part of the packet if needed Computation intensive - needs to work in line speed 10

11 The Architecture Management Payload Address Translator (MPAT) To networks x.y COTS router with NAT Management station SNMP packets to/from a non-translated network 11

12 The Architecture Management Payload Address Translator (MPAT) TCP TCP TCP TCP To networks TCP TCP TCP TCP TCP TCP TCP TCP x.y COTS router with NAT Management station TCP packets to/from a translated network 12

13 The Architecture To networks Management Payload Address Translator (MPAT) How do detect IP addresses in the? Do we need to parse the MIB? x.y Should we translate GetRequest COTS router with NAT What should be translated? What address should we translate to? (outgoing s)? Management station SNMP packets from a translated network 13

14 SNMP 0000: E 0A F B4 8C CA 0010: 87 B4 8C A1 04 4C 00 4A C3 8C E 0020: C A F : 04 7E 23 7D 3C F : B B : C 81 4A B4 8C CA 0000: IP HEADER _ 0010: UDP HEADER _ L= : VER=0 com = p u b l i c GetResponse : request id error st error in SO L = 31 SO 0040: L = 27 OID L= : IP L=

15 Fast Parsing START. pointer points to the first object object type length object Object is of type IP ADDRESS yes Check and replace IP address. Advance pointer by 5 no Object is of type OID yes Check and replace OID. Advance pointer by object length + object length length no Advance pointer by object length + object length length no Object is of type SEQUENCE yes Advance pointer by object length length 15

16 Advanced Address Translation Changing the packet size (MTU) translating 12 to 134 requires one more byte IP address as an index (attable, ipaddrtable..) encoding is different from IPAddress type may change the lexicographic order and create a problem with GetNext Cannot be fully transparent 16

17 Implementation Need to combine COTS NAT with MPAT Prototype for MPAT was implemented (~2500 lines of C code), and is being used by a large network management service provider A provision and configuration problem (both NAT and MPAT should use the same translation tables) A unified GUI 17

18 The GUI To networks x.y Translation tables COTS router with NAT Management station 18

19 Conclusions An appealing solution to an acute problem Challenging research problems exist even at the byte level Very now (IPV6, new management software) Main ideas in an Internet draft ( 19

20 Control using SNMP Monitor just collect the information Control also react if needed Traditionally in configuration and security management Do it Get data Decide what to do 20

21 Getting the data Monitoring Takes time Value keeps on changing By the time action is taken, situation may be completely different Must be able to react within the time scale of the problem Do it Get data Decide what to do 21

22 Example load balancing Monitoring retrieves a snapshot at a fixed time server1 5000, server By the time data was moved to manager, decision has been taken, and command was sent back, situation is different server1 500, server server1 Load balancer server2 22

23 Control SNMP can be used when the values are semi-stable (time scale ~ minutes) Control parameters Security policies Needs to shorten Communication time Computation time 23

24 The set command set-request request-id Error status Error index identification value identification value response zero = OK or error code zero = OK or index code copy value copy value request-id Error status Error index identification value identification value 24

25 Set errors NoSuchName: general answer - cannot do it BadValue: value does not match type GenError: the agent could not do the set noaccess inconsistentname/value resourceunavailability 25

26 Set issues How to implement on an agent Depends on the way the MIB was defined Creating a table entry using the OID of the index and the values (do we need all columns?) Manny elements: one error no set at all 26

27 Control issues Time scales Internet traffic (msec,sec,min,days,months) Atomic actions working on top of UDP Easy to use? SNMPConf: a working group in the IETF a best current practices document provides guidelines on how to best use the existing Internet Standard Management Framework to perform configuration management. MIB modules a document which describes potential future work needed 27

28 Event reporting push vs. pull Pull: polling all element every time step Push: element will report events Event A predefined function on MIB values Traps Mechanism of reporting local events to the manager 28

29 Trap Type Enterprise Agent Address Generic Trap Type Specific Trap Type Timestamp VarBind 1 name VarBind 1 value... VarBind n name VarBind n value Generic Trap Type coldstart(0) warmstart(1) linkdown(2) linkup(3) authenticationfailure(4) egpneighborloss(5) enterprisespecific(6) Description (brief) Sending protocol entity is reinitializing itself; agent's configuration or protocol entity implementation may be altered Sending protocol entity is reinitializing itself; agent configuration or protocol entity implementation not altered Failure of one of the communication links One of the links has come up Authentication failure Loss of EGP neighbor Enterprise-specific trap 29

30 Traps Enterprise and agent address pertain to the system generating the trap Seven generic traps specified by enumerated INTEGER Specific trap is a trap not covered by enterprise specific trap Time stamp indicates elapsed time since last reinitialization No mechanism to acknowledge receiving the trap 30