Lecture 18: Network Management

Size: px

Start display at page:

Download "Lecture 18: Network Management"

Antonia Logan
6 years ago
Views:

1 Lecture 18: Network Management Prof. Shervin Shirmohammadi SITE, University of Ottawa Prof. Shervin Shirmohammadi CEG Objective Manage a network by managing its components: routers, bridges, gateways, applications, Managing: Observing status Changing settings Networks are indispensable More complexity makes failure more likely We need automatic network management tools Standards required to allow multi-vendor networks interoperability Prof. Shervin Shirmohammadi CEG

2 Network Management Systems Collection of tools for network management Single operator interface Powerful, user friendly command set Performing most or all management tasks Minimal amount of separate equipment i.e. use existing equipment View entire network as unified architecture Active elements provide regular feedback Prof. Shervin Shirmohammadi CEG Management station or manager Agent Management information base (MIB) Network management protocol Key Elements Prof. Shervin Shirmohammadi CEG

3 Management Station Stand alone system or part of shared system Interface for human network manager Set of management applications Data query and analysis Operational commands Fault recovery Interface to monitor and control network Translate manager s requirements into monitoring and control of remote elements Database of network management information extracted from managed entities Prof. Shervin Shirmohammadi CEG Management Agent Hosts, bridges, hubs, routers,, equipped with agent software Allows them to be managed from management station Respond to requests for information Respond to requests for action Asynchronously supply unsolicited information. Prof. Shervin Shirmohammadi CEG

4 Management Information Base (MIB) Representation of network resources as objects Each object a variable representing one aspect of managed object. Typically defined in ASN.1 MIB is a collection of access points at agent for management of station. Objects standardized across classes of system Bridge, router etc. There are pre-defined standard MIBs for many existing networking devices (ATM switches, Ethernet ports, IP routers, ) Prof. Shervin Shirmohammadi CEG MIB Example IP-MIB DEFINITIONS ::= BEGIN IMPORTS MODULE-IDENTITY, OBJECT-TYPE, Integer32, Counter32, IpAddress, mib-2 FROM SNMPv2-SMI PhysAddress FROM SNMPv2-TC MODULE-COMPLIANCE, OBJECT-GROUP FROM SNMPv2-CONF;... ipdefaultttl OBJECT-TYPE SYNTAX INTEGER (1..255) MAX-ACCESS read-write STATUS current DESCRIPTION "The default value inserted into the Time-To-Live field of the IP header of datagrams originated at this entity, whenever a TTL value is not supplied by the transport layer protocol." ::= { ip 2 } ipinreceives OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The total number of input datagrams received from interfaces, including those received in error." ::= { ip 3 } Prof. Shervin Shirmohammadi CEG

5 MIB Viewer Prof. Shervin Shirmohammadi CEG Management Layout May be centralized in a simple network May be distributed in large, complex networks Multiple management servers Each manages pool of agents Management may be delegated to intermediate manager Prof. Shervin Shirmohammadi CEG

6 Example Configuration Prof. Shervin Shirmohammadi CEG Network Management Protocol Protocol for exchange of information between management station and agent. TCP/IP uses Simple Network Management Protocol (SNMP) not very many capabilities but easy to implement most commonly used management protocol OSI uses Common Management Information Protocol (CMIP) Lots of capabilities but complicated to implement Used by large telecommunications companies SNMPv2 (enhanced SNMP) for OSI and TCP/IP Prof. Shervin Shirmohammadi CEG

SNMP IETF standard SNMP v2 1993, revised 1996 RFC 1901-1908 Stand alone management stations and bridges, routers workstations etc supplied with agents Defines limited, easily implemented MIB of

7 SNMP IETF standard SNMP v2 1993, revised 1996 RFC Stand alone management stations and bridges, routers workstations etc supplied with agents Defines limited, easily implemented MIB of scalar variables and two dimensional tables Capabilities: Get Retrieve information Set Configure settings Trap Unsolicited information Problems: Limited functionality Lack of security Prof. Shervin Shirmohammadi CEG SNMPv1 Configuration Prof. Shervin Shirmohammadi CEG

8 SNMP Architecture Application-level protocol Typically implemented as part of TCP/IP protocol suite Runs over UDP What if messages are lost? From a management station, three types of SNMP messages are issued GetRequest, GetNextRequest, and SetRequest Port 161 Agent replies with GetResponse Agent may issue trap message in response to event that affects MIB and underlying managed Port 162 Prof. Shervin Shirmohammadi CEG Role of SNMP v1 Prof. Shervin Shirmohammadi CEG

9 Object Names and SMI Object Tree itu 0 iso 1 org 3 dod 6 iso-itu 2 In a MIB there is an identifier for each occurrence of an object. internet OBJECT IDENTIFIER ::= {ISO(1) ORG(3) DOD(6) INTERNET(1)} internet 1 private 4 enterprise 1 IBM 2 Private type identifier for IBM Prof. Shervin Shirmohammadi CEG SNMP MIB-2 {mgmt 1} Internet { } directory (1) mgmt (2) experimental (3) private (4) mib-2 (1) system (1) interfaces (2) at (3) ip (4) icmp (5) tcp (6) snmp (11) transmission (10) cmot (9) egp (8) udp (7) Figure 4.26 Internet MIB-II Group Prof. Shervin Shirmohammadi CEG

10 This group has various information on the parameters of the IP protocol. ipforwarding: Gateway(1) and Router(2) IP Address Table contains table of IP addresses IP Route Table contains an entry for each route IP Network-to-Media Table is address translation table mapping IP addresses to physical addresses IP Group ipforwarding (1) ipdefaultttl (2) ipinreceives (3) ipinhdrerrors (4) ipinaddrerrors (5) ipforwdatagrams (6) ipinunknownprotos (7) ipindiscards (8) ipindelivers (9) ipoutrequests(10) ip (mib-2 4) iproutingdiscards (23) ipnettomediatable (22) iproutetable (21) ipaddrtable (20) ipfragcreates (19) ipfragfails (18) ipfragoks (17) ipreasmfails (16) ipreasmoks (15) ipreasmreqds (14) ipoutdiscards (11) ipreasmtimeout (13) ipoutnoroutes (12) Figure 4.29 IP Group Prof. Shervin Shirmohammadi CEG ipaddrtable (ip 20) ipaddrentry (ipaddrtable 1) IP Address Table ipadentaddr (1) ipadentifindex (2) Legend: INDEX in bold ipadentnetmask (3) ipadentreasmmaxsize (5) ipadentbcastaddr (4) Figure 4.30 IP Address Table Entity OID Description (brief) ipaddrtable ip 20 Table of IP addresses ipaddrentry IpAddrTable 1 One of the entries in the IP address table ipadentaddr IpAddrEntry 1 The IP address to which this entry's addressing information pertains ipadentifindex IpAddrEntry 2 Index value of the entry, same as ifindex ipadentnetmask IpAddrEntry 3 Subnet mask for the IP address of the entry ipadentbcastaddr IpAddrEntry 4 Broadcast address indicator bit ipadentreasmmaxsize IpAddrEntry 5 Largest IP datagram that can be reassembled on this interface Prof. Shervin Shirmohammadi CEG

11 Example Say a Router has this standard table status IpAdEntAddr IpAdEntIfIndex IpAdEntBcastAddr IpAdEntReasmMaxSize Bold Column indicates index. To get the maximum reassembly size at interface 3, the manager would send the SNMP command: get_request( ) To which the agent on the router replies: get_response( =12000) Prof. Shervin Shirmohammadi CEG Structure of Management Information (SMI) Defines general framework with which MIB is defined and constructed Language for defining management information Based on ASN.1 Identifies data types Identifies how resources are represented and named Encourages simplicity and extensibility Scalars and two dimensional arrays of scalars (tables) only Prof. Shervin Shirmohammadi CEG

12 SMI Definition from RFC1155 EXPORTS identifies the objects that any other module could import RFC1155-SMI DEFINITIONS ::= BEGIN EXPORTS -- EVERYTHING internet, directory, mgmt, experimental, private, enterprises, OBJECT-TYPE, ObjectName, ObjectSyntax, SimpleSyntax, ApplicationSyntax, NetworkAddress, IpAddress, Counter, Gauge, TimeTicks, Opaque; -- the path to the root internet OBJECT IDENTIFIER ::= { iso org(3) dod(6) 1 } directory OBJECT IDENTIFIER ::= { internet 1 } mgmt OBJECT IDENTIFIER ::= { internet 2 } experimental OBJECT IDENTIFIER ::= { internet 3 } private OBJECT IDENTIFIER ::= { internet 4 } enterprises OBJECT IDENTIFIER ::= { private 1 } Prof. Shervin Shirmohammadi CEG SMI Definition from RFC1155 ( ) -- definition of object types OBJECT-TYPE MACRO ::= BEGIN TYPE NOTATION ::= "SYNTAX" type (TYPE ObjectSyntax) "ACCESS" Access "STATUS" Status VALUE NOTATION ::= value (VALUE ObjectName) Access ::= "read-only" "read-write" "write-only" "not-accessible" Status ::= "mandatory" "optional" "obsolete" END application-wide types NetworkAddress ::= CHOICE { internet IpAddress } IpAddress ::= [APPLICATION 0] -- in network-byte order IMPLICIT OCTET STRING (SIZE (4)) Counter ::= [APPLICATION 1] IMPLICIT INTEGER ( ).. Prof. Shervin Shirmohammadi CEG

13 SNMPv2 SNMPv1 was developed as an interim solution to an eventual adoption of OSI. This never came about: OSI was not as widely adopted as originally hoped. We got stuck with SNMPv1, which was not a comprehensive solution. SNMPv2, released in 1996, was basically major revisions added to SNMP. Prof. Shervin Shirmohammadi CEG Major Changes Bulk data transfer Manager-to-manager message Enhancements to SMI: SMIv2 Module definitions: MODULE-IDENTITY macro (information) Object definitions: OBJECT-IDENTITY macro (info about OID) Trap definitions: NOTIFICATION-TYPE macro Textual conventions (Help define new data types) Conformance statements (Compatibility to standard) Row creation and deletion in table MIB enhancements (added security & snmpv2) Transport mappings Security features, originally to be in SNMPv2, moved to SNMPv3 Hence, SNMPv2, like SNMPv1, uses a community-based administrative framework Prof. Shervin Shirmohammadi CEG

SNMPv2 PDU Exchange of messages Outer message header deals with security (outside the scope of SNMPv2) Seven types of PDU (InformRequest used between managers) Prof.

14 SNMPv2 PDU Exchange of messages Outer message header deals with security (outside the scope of SNMPv2) Seven types of PDU (InformRequest used between managers) Prof. Shervin Shirmohammadi CEG SNMPv3 Key Features: Modularization of documentation and architecture Enables the use of SNMPv1 and SNMPv2 with the newly developed SNMPv3. SNMP engine defined A model for the processing of SNMP messages. New Security features Secure information to prevent tampering of data Access control to determine proper access to MIB. Prof. Shervin Shirmohammadi CEG

15 Architecture An SNMP entity is a node with an SNMP management element either an agent or manager or both The architecture of an SNMP entity consists of the elements of the entity and the names associated with it. There are three names associated with an entity Entities: e.g. SNMP engine (snmpengineid) Identities: e.g. Principal and security name Management Information: Used when multiple objects are managed. E.g. Context engine SNMP entity SNMP Engine (identified by snmpengineid) Dispatcher Application(s) Command Generator Command Responder Message Processing Security Notification Receiver Notification Originator Access Control Proxy Forwarder Prof. Shervin Shirmohammadi CEG Figure 7.2 SNMPv3 Architecture Other Dispatcher There is one dispatcher in an SNMP engine Handles multiple versions of SNMP messages Interfaces with the various modules: application modules, network modules, and message processing modules. Three components for three functions: Transport mapper delivers messages over the transport protocol. Message Dispatcher routes messages between network and appropriate module of Message Processing (MPS). PDU dispatcher handles messages between applications and MPS SNMP Engine (identified by snmpengineid) Dispatcher Message Processing Security Access Control Prof. Shervin Shirmohammadi CEG

16 Message Processing (MPS) Contains one or more Message Processing Models (MPM) One MPM for each SNMP version SNMP version identified in the header SNMP Engine (identified by snmpengineid) Dispatcher Message Processing Security Access Control Prof. Shervin Shirmohammadi CEG Security and Access Control Security at the message level Authentication Privacy of message via secure communication Flexible access control Who can access? What can be accessed? Flexible MIB views? SNMP Engine (identified by snmpengineid) Dispatcher Message Processing Security Access Control Prof. Shervin Shirmohammadi CEG

Lecture 11: Introduction to Network Management

Lecture 11: Introduction to Network Management Prof. Shervin Shirmohammadi SITE, University of Ottawa Prof. Shervin Shirmohammadi CEG 4185 11-1 Objective Manage a network by managing its components: routers,