Network Management Automated Intelligence

Transcription

1 Network Management Automated Intelligence Open Source Based NMS solution bdnog November 2017 Dhaka, Bangladesh

2 p Network Management n Parameters n Components n Open Source Tools n Demonstration n Q & A

3

4 Parameters p p p p Operation: keeping the network (and the services that the network provides) up and running smoothly. It includes monitoring the network to spot problems as soon as possible, ideally before users are affected. Administration: deals with keeping track of resources in the network and how they are assigned. Maintenance: concerned with performing repairs and upgrades. Maintenance also involves corrective and preventive measures to make the managed network run "ʺbetter. Provisioning: is concerned with configuring resources in the network to support a given service.

5 So Network Management is the use of a system that constantly monitors a computer network for slow or failing systems and that notifies the network administrator in case of outages via , SMS or other alarms. subset of the functions involved in network management.

6 Network Management p System & Service monitoring n Reachability, availability p Resource measurement/monitoring n Capacity planning, availability p Performance monitoring (RTT, throughput) p Stats & Accounting/Metering p Fault Management n Fault detection, troubleshooting, and tracking p Configuration/Change Management p Coordination

7 Expectations A network in operation needs to be monitored in order to: - Deliver projected SLAs (Service Level Agreements) - SLAs depend on policy p p p p What does your management expect? What do your users expect? What do your customers expect? What does the rest of the Internet expect? What s good enough? % Uptime? è There'ʹs no such thing as 100% uptime (as we ll see) à

8 Uptime Expectations What does it take to deliver 99.9 % uptime? 30.5 days x 24 hours = 732 hours a month (732 (732 x.999)) x 60 = 44 minutes only 44 minutes of downtime a month! Need to shutdown 1 hour / week? (732 4) / 732x 100 = 99.4 % Remember to take planned maintenance into account in your calculations, and inform your users/customers if they are included/excluded in the SLA How is availability measured? In the core? End-to-end? From the Internet?

9 Baselining What is normal for your network? If you ve never measured or monitored your network you will need to know things like: n Typical load on links (è Cacti) n Level of jitter between endpoints (è Smokeping) n Typical percent usage of resources (è LibreNMS) n Typical amounts of noise : p Network scans p Dropped data p Reported errors or failures

10 Why do all this? Know when to upgrade Is your bandwidth usage too high? Where is your traffic going? Do you need to get a faster line, or more providers? Is the equipment too old? Keep an audit trace of changes Record all changes Makes it easier to find cause of problems due to upgrades and configuration changes Maintain history of network operations n n Using a ticket system lets you keep a history of events. Allows you to defend yourself and verify what happened

11 Components p Availability p Reliability p Performance p Configuration Mgmt & Monitoring p Network Forensic p Intrusion Detection p. p.. p Coordination

12 Tools n Diagnostic tools used to test connectivity, ascertain that a location is reachable, or a device is up usually active tools n Monitoring tools tools running in the background ( daemons or services), which collect events, but can also initiate their own probes (using diagnostic tools), and recording the output, in a scheduled fashion.

13 Tools p Active tools n Ping test connectivity to a host n Traceroute show path to a host n MTR combination of ping + traceroute n SNMP collectors (polling) p Passive tools n log monitoring, SNMP trap receivers p Automated tools n SmokePing record and graph latency to a set of hosts, using ICMP (Ping) or other protocols n MRTG record and graph bandwidth usage on a switch port or network link, at regular intervals n So MANY More...

14 Tools Reliability p SmokePing n Keeps track of your network latency: n Best of breed latency visualisation. n Interactive graph explorer. n Wide range of latency measurment plugins. n Master/Slave System for distributed measurement. n Highly configurable alerting system. n Live Latency Charts with the most 'ʹinteresting'ʹ graphs. n Free and OpenSource Software written in Perl

15 Tools SmokePing

16 Tools SmokePing

17 Tools Performance p Cacti/MRTG n n n n n n n A tool to monitor, store and present network and system/server statistics Designed around RRDTool with a special emphasis on the graphical interface Almost all of Cacti'ʹs functionality can be configured via the Web. Uses RRDtool, PHP and stores data in MySQL Supports the use of SNMP and graphics with MRTG Authentication Scheme Large Network Deployment

18 Tools Cacti

19 Tools Weathermap

20 Tools Availability p Nagios n server and service availability monitoring p Can monitor pretty much anything p HTTP, SMTP, DNS, Disk space, CPU usage,... p BGP, OSPF, Switch Port, room temperature,.. p Easy to write new plugins (extensions) p Zabbix, ZenOSS, Hyperic,... Many more Open Source... Ø Log, Log, Log... Ø Notification mechanism

21 Tools. Nagios

22 Tools. Nagios

23 Tools. Nagios XI

24 Tools. Nagios

25 Tools Availability+ Reliability LibreNMS l l l l SNMP-based auto-discover network monitoring Derived from another project (Observium) Written in PHP as a web application Includes support for a wide range of hardware: Cisco, Linux, FreeBSD, Juniper, Brocade, Foundry, HP and many more See Over 100 supported! Routers, Switches, Access Points, Security gateways, Hosts, Printers,

26 LibreNMS Available metrics l l l l CPU, memory and storage statistics Interface traffic, packet and detailed error statistics (L2 and L3) Temperature, fan speed, voltage, amperage, power humidity and frequency sensors Users, processes, load average and uptime statistics

27 LibreNMS Available metrics cont. l l l l l l Linux distribution detection Real-time interface traffic graphing Device inventory collection (useful!) Detailed IPv4, IPv6, TCP and UDP stack statistics BGP and OSPF information MAC <-> IP address lookup l Find which port an IP/MAC was last seen on

28 LibreNMS

29 LibreNMS

30 Tools Configuration Mgmt & Monitoring The Really Awesome New Cisco config Differ p Rancid n Rancid is a configuration management tool that keeps track of changes in the configurations of any size network equipment (Cisco, HP, Juniper, Foundry, etc.). Works on routers and switches. Automates retrieval of the configurations and archives them as backup tool, audit tool, blame allocation.

31 Tools RANCID The Really Awesome New Cisco config Differ The data is stored in a VCS (Version Control System) which keeps n Track changes in the equipment configuration n Track changes in the hardware (S/N, modules) n Track version changes in the OS (IOS, CatOS versions) n Find out what your colleagues have done without telling you! n Recover from accidental configuration errors.

32 Tools RANCID

33 RANCID

34 Tools Net Forensic p Network Flow Analysis Tool n NetFlow (C), n cflowd (F), n FlowScan (F), n Sniffer Pro (C), n argus (F), n i-flow (C) n NFSen (F) n AS-STATS

35 Tools NFSen p Network Flow Analysis Tool n NFSen p Display netflow data: Flows, Packets and Bytes using RRD (Round Robin Database). p Easily navigate through the netflow data. p Process the netflow data within the specified time span. p Create history as well as continuous profiles. p Set alerts, based on various conditions.

36 Tools NFSen

37 Tools NFSen

38 Tools NFSen TCP UDP Flows Packets Bytes Flows Packets Bytes Rank Port Count Port Count Port Count Port Count Port Count Port Count

39 AS-STATS p A netflow/sflow collector p n Storing data in RRD files A cron program n order the ASNs by level of traffic exchanged p A web interface to : n See your traffic per ASN n See your traffic per LINK

40 How as-stats looks? (Peers)

41 How as-stats looks? (Link)

42 What it is good for? p BGP Traffic Engineering p Finding out who you should (try to) peer with p Knowing what's going on in your network p Planning for future expansion

43 Tools IDS & IPS Computer Security is not something that you can just add on when you need it. Proper planning, installation, monitoring and maintenance all become part of a successful IDS/IPS implementation. p Tri-Sentry (Host Sentry, NetSentry, Service Sentry) p Nessus, Snort p Checkpoint, Cisco IPS, UTM (Cyberoam, Barracuda) $$$ ARE YOU AWARE OF YOUR NETWORK POLLUTION.

44 Malicious Traffic Detection Tool

45 Tools Log Management Elasticsearch flexible and powerful open source, distributed real- time search and analytics engine for your log ( n n n n n n n n n n n Easy to scale (Distributed) Everything is one JSON call away (RESTful API) Unleashed power of Lucene under the hood Excellent Query DSL Multi-tenancy Support for advanced search features (Full Text) Configurable and Extensible Document Oriented Schema free Conflict management Active community

46 Tools Log Management commercial SIEM Logstash Kibana

47 Elastic Elasticity

48 Tools Log Management Elasticsearch, Logstash & Kibana (ELK)

49 Tools Collaboration So, we have many Open Source/Commercial deployments already to monitor our network. All the programs can generate alert/alarm on fault detection. Need to centralize all the information. We need to collaborate these programs Need NOC Its not a big Room/House it s a software Its RT (the ticketing system)

50 Tools RT Request Tracker p RT is a battle-tested issue tracking system which thousands of organizations use for n bug tracking, n help desk ticketing, n customer service, n workflow processes, n change management, n network operations, n And so on..

51 Tools RT Request Tracker Whenever, wherever and however there is a problem in the network the relevant monitoring software will send a ticket directly to RT system and system admins will know immediately via or SMS. This automation will keep track of the SLA. RT has its own Help Desk system and escalation procedure.

52 Tools... RT n Why are they important? p Track all events, failures and issues n Focal point for help desk communication n Use it to track all communications p Both internal and external n Events originating from the outside: p customer complaints n Events originating from the inside: p System outages (direct or indirect) p Planned maintenance, upgrades, etc.

53 Tools... RT l l l l l Why are they important? Track all events, failures and issues Focal point for help desk communication Use it to track all communications Both internal and external Events originating from the outside: customer complaints Events originating from the inside: System outages (direct or indirect) Planned maintenance, upgrades, etc.

54 Tools RT

55 Tools The Big Cycle

56 Conclusion RT Cacti SmokePing Nagios NFSen Weather Map Rancid ALL IN ONE NETWORK MANAGEMENT SYSTEM

57 ???