













Study with the several resources on Docsity
Earn points by helping other students or get them with a premium plan
Prepare for your exams
Study with the several resources on Docsity
Earn points to download
Earn points by helping other students or get them with a premium plan
Community
Ask the community for help and clear up your study doubts
Discover the best universities in your country according to Docsity users
Free resources
Download our free guides on studying techniques, anxiety management strategies, and thesis advice from Docsity tutors
An overview of network management, focusing on the key areas of fault management, accounting management, configuration and name management, performance management, and security management. It discusses the importance of network management in complex systems and the use of automated tools. The document also introduces the Simple Network Management Protocol (SNMP) as a widely used standard for network management.
Typology: Study notes
1 / 21
This page cannot be seen from the preview
Don't miss anything!
20.1 Network Management Requirements Fault Management Accounting Management Configuration and Name Management Performance Management Security Management 20.2 Network Management Systems Architecture of a Network Management System 20.3 Simple Network Management Protocol (SNMP) Simple Network Management Protocol Version 1 (SNMPv1) Simple Network Management Protocol Version 2 (SNMPv2) Simple Network Management Protocol Version 3 (SNMPv3) 20.4 Recommended Reading and Web Sites 20.5 Key Terms, Review Questions, and Problems
Networks and distributed processing systems are of critical and growing importance in enterprises of all sorts. The trend is toward larger, more complex networks supporting more applications and more users. As these networks grow in scale, two facts become painfully evident:
20.1 NETWORK MANAGEMENT REQUIREMENTS
Table 20.1 lists key areas of network management as suggested by the International Organization for Standardization (ISO). These categories provide a useful way of organizing our discussion of requirements.
Chapter Objectives After reading this chapter, you should be able to ♦ List and define the key requirements that a network management system should satisfy. ♦ Give an overview of the architecture of a network management system and explain each of its key elements. ♦ Describe SNMP and list the differences among versions 1, 2, and 3.
of redundant components and alternate communication routes, to give the network a degree of fault tolerance. The fault management capability itself should be redun- dant to increase network reliability. Users expect to be kept informed of the network status, including both sched- uled and unscheduled disruptive maintenance. Users expect reassurance of correct network operation through mechanisms that use confidence tests or analyze dumps, logs, alerts, or statistics. After correcting a fault and restoring a system to its full op- erational state, the fault management service must ensure that the problem is truly resolved and that no new problems are introduced. This requirement is called prob- lem tracking and control. As with other areas of network management, fault management should have minimal effect on network performance.
OVERVIEW In many enterprise networks, individual divisions or cost centers, or even individual project accounts, are charged for the use of network services. These are internal accounting procedures rather than actual cash transfers, but they are im- portant to the participating users nevertheless. Furthermore, even if no such internal charging is employed, the network manager needs to be able to track the use of net- work resources by user or user class for a number of reasons, including the following:
OVERVIEW Modern data communication networks are composed of individual components and logical subsystems (e.g., the device driver in an operating system) that can be configured to perform many different applications. The same device, for example, can be configured to act either as a router or as an end system node or both. Once it is decided how a device is to be used, the configuration manager can choose the appropriate software and set of attributes and values (e.g., a transport layer retransmission timer) for that device. Configuration management is concerned with initializing a network and gracefully shutting down part or all of the network. It is also concerned with
maintaining, adding, and updating the relationships among components and the status of components themselves during network operation.
USER REQUIREMENTS Startup and shutdown operations on a network are the spe- cific responsibilities of configuration management. It is often desirable for these operations on certain components to be performed unattended (e.g., starting up or shutting down a network interface unit). The network manager needs the capability to identify initially the components that comprise the network and to define the de- sired connectivity of these components. Those who regularly configure a network with the same or a similar set of resource attributes need ways to define and modify default attributes and to load these predefined sets of attributes into the specified network components. The network manager needs the capability to change the con- nectivity of network components when users’ needs change. Reconfiguration of a network is often desired in response to performance evaluation or in support of net- work upgrade, fault recovery, or security checks. Users often need to, or want to, be informed of the status of network resources and components. Therefore, when changes in configuration occur, users should be notified of these changes. Configuration reports can be generated either on some routine periodic basis or in response to a request for such a report. Before reconfig- uration, users often want to inquire about the upcoming status of resources and their attributes. Network managers usually want only authorized users (operators) to manage and control network operation (e.g., software distribution and updating).
OVERVIEW Modern data communications networks are composed of many and var- ied components, which must intercommunicate and share data and resources. In some cases, it is critical to the effectiveness of an application that the communication over the network be within certain performance limits. Performance management of a computer network comprises two broad functional categories—monitoring and controlling. Monitoring is the function that tracks activities on the network. The con- trolling function enables performance management to make adjustments to improve network performance. Some of the performance issues of concern to the network manager are as follows:
A network management system consists of incremental hardware and soft- ware additions implemented among existing network components. The software used in accomplishing the network management tasks resides in the host computers and communications processors (e.g., front-end processors, terminal cluster con- trollers, bridges, routers). A network management system is designed to view the en- tire network as a unified architecture, with addresses and labels assigned to each point and the specific attributes of each element and link known to the system. The active elements of the network provide regular feedback of status information to the network control center. Figure 20.1 suggests the architecture of a network management system. Each network node contains a collection of software devoted to the network manage- ment task, referred to in the diagram as a network management entity (NME). Each NME performs the following tasks:
NME Appl
Comm
OS
Network control host (manager)
Workstation (agent)
Server (agent)
Router (agent)
NMA network management application NME network management entity Appl application Comm communications software OS operating system
or Internet
NME Appl
Comm
OS
NME Appl
Comm
OS
Comm
OS
Figure 20.1 Elements of a Network Management System
At least one host in the network is designated as the network control host, or manager. In addition to the NME software, the network control host includes a collection of software called the network management application (NMA). The NMA includes an operator interface to allow an authorized user to manage the network. The NMA responds to user commands by displaying information and/or by issuing commands to NMEs throughout the network. This communication is carried out using an application-level network management protocol that em- ploys the communications architecture in the same fashion as any other distrib- uted application. Each other node in the network that is part of the network management sys- tem includes a NME and, for purposes of network management, is referred to as an agent. Agents include end systems that support user applications as well as nodes that provide a communications service, such as front-end processors, cluster con- trollers, bridges, and routers. As depicted in Figure 20.1, the network control host communicates with and controls the NMEs in other systems. For maintaining high availability of the net- work management function, two or more network control hosts are used. In normal operation, one of the centers is used for control, while the others are idle or simply collecting statistics. If the primary network control host fails, the backup system can be used.
20.3 SIMPLE NETWORK MANAGEMENT PROTOCOL (SNMP)
SNMP was developed for use as a network management tool for networks and in- ternetworks operating TCP/IP. It has since been expanded for use in all types of net- working environments. The term simple network management protocol (SNMP) is actually used to refer to a collection of specifications for network management that include the protocol itself, the definition of a database, and associated concepts. BASIC CONCEPTS The model of network management that is used for SNMP includes the following key elements:
its responsibility. It also plays an agent role to provide information and accept con- trol from a higher-level management server. This type of architecture spreads the processing burden and reduces total network traffic. NETWORK MANAGEMENT PROTOCOL ARCHITECTURE SNMP is an application-level protocol that is part of the TCP/IP protocol suite. It is intended to operate over the user datagram protocol (UDP). Figure 20.3 suggests the typical configuration of protocols for SNMPv1. For a standalone management station, a manager process controls access to a central MIB at the management station and provides an inter- face to the network manager. The manager process achieves network management by using SNMP, which is implemented on top of UDP, IP, and the relevant network- dependent protocols (e.g., Ethernet, ATM, frame relay). Each agent must also implement SNMP, UDP, and IP. In addition, there is an agent process that interprets the SNMP messages and controls the agent’s MIB. For an agent device that supports other applications, such as FTP, TCP as well as UDP is required. In Figure 20.3, the shaded portions depict the operational environment: that which is to be managed. The unshaded portions provide support to the network management function.
Ethernet
Internet
Ethernet switch
Ethernet
Ethernet
Router (agent) Router (agent)
Agent
Agent
Agent
Agent
Agent Agent
Agent
Agent Agent
Agent Agent
Router (agent)
Agent
Central site
Management server (manager)
Intermediate manager (manager/agent)
Router (agent)
Router (agent) Router (agent)
Figure 20.2 Example Distributed Network Management Configuration
Figure 20.4 provides a somewhat closer look at the protocol context of SNMP. From a management station, three types of SNMP messages are issued on behalf of management applications: GetRequest, GetNextRequest, and SetRequest. The first two are two variations of the get function. All three messages are acknowledged by the agent in the form of a GetResponse message, which is passed up to the manage- ment application. In addition, an agent may issue a Trap message in response to an event that affects the MIB and the underlying managed resources. Management re- quests are sent to UDP port 161, while the agent sends traps to UDP port 162. Because SNMP relies on UDP, which is a connectionless protocol, SNMP is it- self connectionless. No ongoing connections are maintained between a management station and its agents. Instead, each exchange is a separate transaction between a management station and an agent.
In August of 1988, the specification for SNMP was issued and rapidly became the dominant network management standard. A number of vendors offer standalone network management workstations based on SNMP, and most vendors of bridges, routers, workstations, and PCs offer SNMP agent packages that allow their products to be managed by an SNMP management station. As the name suggests, SNMP is a simple tool for network management. It de- fines a limited, easily implemented management information base (MIB) of scalar
Network-dependent protocols
IP
UDP TCP
SNMP FTP, etc.
User processes
Agent process
Host
Network-dependent protocols
IP
UDP TCP
SNMP FTP, etc.
User processes
Agent process
Host
Network-dependent protocols
IP
UDP
SNMP
Agent process
Network manager Central MIB
Management station
Network-dependent protocols
IP
UDP
SNMP
Manager processes
Figure 20.3 SNMPv1 Configuration
SNMPv2 standard defines the structure of this information and the allowable data types; this definition is known as the structure of management information (SMI). We can think of this as the language for defining management information. The standard also supplies a number of MIBs that are generally useful for network man- agement. 1 In addition, new MIBs may be defined by vendors and user groups.
SNMPv manager/agent
SNMPv2 agent
Management applications
SNMPv2 manager
SNMPv2 agent SNMPv2 agent
Element manager
Agent
SNMPv manager/agent
Figure 20.5 SNMPv2-Managed Configuration
(^1) There is a slight fuzziness about the term MIB. In its singular form, the term MIB can be used to refer to the entire database of management information at a manager or an agent. It can also be used in singular or plural form to refer to a specific defined collection of management information that is part of an over- all MIB. Thus, the SNMPv2 standard includes the definition of several MIBs and incorporates, by reference, MIBs defined in SNMPv1.
At least one system in the configuration must be responsible for network man- agement. It is here that any network management applications are hosted. There may be more than one of these management stations, to provide redundancy or sim- ply to split up the duties in a large network. Most other systems act in the role of agent. An agent collects information locally and stores it for later access by a man- ager. The information includes data about the system itself and may also include traffic information for the network or networks to which the agent attaches. SNMPv2 supports either a highly centralized network management strategy or a distributed one. In the latter case, some systems operate both in the role of manager and of agent. In its agent role, such a system will accept commands from a superior management system. Some of those commands relate to the local MIB at the agent. Other commands require the agent to act as a proxy for remote devices. In this case, the proxy agent assumes the role of manager to access information at a remote agent, and then assumes the role of an agent to pass that information on to a superior manager. All of these exchanges take place using the SNMPv2 protocol, which is a sim- ple request/response type of protocol. Typically, SNMPv2 is implemented on top of the user datagram protocol (UDP), which is part of the TCP/IP suite. Because SNMPv2 exchanges are in the nature of discrete request-response pairs, an ongoing reliable connection is not required. STRUCTURE OF MANAGEMENT INFORMATION The structure of management infor- mation (SMI) defines the general framework within which a MIB can be defined and constructed. The SMI identifies the data types that can be used in the MIB, and how resources within the MIB are represented and named. The philosophy behind SMI is to encourage simplicity and extensibility within the MIB. Thus, the MIB can store only simple data types: scalars and two-dimensional arrays of scalars, called ta- bles. The SMI does not support the creation or retrieval of complex data structures. This philosophy is in contrast to that used with OSI systems management, which provides for complex data structures and retrieval modes to support greater func- tionality. SMI avoids complex data types and structures to simplify the task of im- plementation and to enhance interoperability. MIBs will inevitably contain vendor-created data types and, unless tight restrictions are placed on the definition of such data types, interoperability will suffer. There are three key elements in the SMI specification. At the lowest level, the SMI specifies the data types that may be stored. Then the SMI specifies a formal technique for defining objects and tables of objects. Finally, the SMI provides a scheme for associating a unique identifier with each actual object in a system, so that data at an agent can be referenced by a manager. Table 20.2 shows the data types that are allowed by the SMI. This is a fairly re- stricted set of types. For example, real numbers are not supported. However, it is rich enough to support most network management requirements. PROTOCOL OPERATION The heart of the SNMPv2 framework is the protocol itself. The protocol provides a straightforward, basic mechanism for the exchange of man- agement information between manager and agent. The basic unit of exchange is the message, which consists of an outer message wrapper and an inner protocol data unit (PDU). The outer message header deals with security and is discussed later in this section.
responding agent will send a Response-PDU. The variable-bindings list will contain the identifier and value of all retrieved objects. For any variables that are not in the relevant MIB view, its identifier and an error code are returned in the variable- bindings list. Thus, SNMPv2 permits partial responses to a GetRequest, which is a significant improvement over SNMP. In SNMP, if one or more of the variables in a GetRequest is not supported, the agent returns an error message with a status of no- SuchName. To cope with such an error, the SNMP manager must either return no values to the requesting application, or it must include an algorithm that responds to an error by removing the missing variables, resending the request, and then sending a partial result to the application. The GetNextRequest-PDU also is issued by a manager and includes a list of one or more objects. In this case, for each object named in the Variable-Bindings field, a value is to be returned for the object that is next in lexicographic order, which is equivalent to saying next in the MIB in terms of its position in the tree structure of object identifiers. As with the GetRequest-PDU, the agent will return values for as many variables as possible. One of the strengths of the GetNextRequest-PDU is that it enables a manager entity to discover the structure of a MIB view dynamically. This is useful if the manager does not know a priori the set of objects that are supported by an agent or that are in a particular MIB view. One of the major enhancements provided in SNMPv2 is the GetBulkRequest PDU. The purpose of this PDU is to minimize the number of protocol exchanges re- quired to retrieve a large amount of management information. The GetBulkRequest PDU allows an SNMPv2 manager to request that the response include as many requested variables as possible given the constraints on message size. The SetRequest-PDU is issued by a manager to request that the values of one or more objects be altered. The receiving SNMPv2 entity responds with a Response- PDU containing the same Request-ID. The SetRequest operation is atomic: Either all of the variables are updated or none are. If the responding entity is able to set values for all of the variables listed in the incoming variable-bindings list, then the Response-PDU includes the Variable-Bindings field, with a value supplied for each variable. If at least one of the variable values cannot be supplied, then no values are returned, and no values are updated. In the latter case, the error-status code indi- cates the reason for the failure, and the error-index field indicates the variable in the Variable-Bindings list that caused the failure. The SNMPv2-Trap-PDU is generated and transmitted by an SNMPv2 entity acting in an agent role when an unusual event occurs. It is used to provide the man- agement station with an asynchronous notification of some significant event. The variable-bindings list is used to contain the information associated with the trap message. Unlike the GetRequest, GetNextRequest, GetBulkRequest, SetRequest, and InformRequest-PDUs, the SNMPv2-Trap-PDU does not elicit a response from the receiving entity; it is an unconfirmed message. The InformRequest-PDU is sent by an SNMPv2 entity acting in a manager role, on behalf of an application, to another SNMPv2 entity acting in a manager role, to provide management information to an application using the latter entity. As with the SNMPv2-Trap-PDU, the Variable-Bindings field is used to convey the associ- ated information. The manager receiving an InformRequest acknowledges receipt with a Response-PDU.
For both the SNMPv2-Trap and the InformRequest, various conditions can be defined that indicate when the notification is generated; the information to be sent is also specified.
Many of the functional deficiencies of SNMP were addressed in SNMPv2. To cor- rect the security deficiencies of SNMPv1/v2, SNMPv3 was issued as a set of Pro- posed Standards in January 1998 (currently RFCs 3410 through 3415). This set of documents does not provide a complete SNMP capability but rather defines an overall SNMP architecture and a set of security capabilities. These are intended to be used with the existing SNMPv2 or with SNMPv1. SNMPv3 provides three important services: authentication, privacy, and access control. The first two are part of the User-Based Security Model (USM), and the last is defined in the View-Based Access Control Model (VACM). Security services are governed by the identity of the user requesting the service; this identity is expressed as a principal, which may be an individual or an application or a group of individu- als or applications. The authentication mechanism in USM assures that a received message was transmitted by the principal whose identifier appears as the source in the message header. This mechanism also assures that the message has not been altered in transit and has not been artificially delayed or replayed. The sending principal provides au- thentication by including a message authentication code with the SNMP message it is sending. This code is a function of the contents of the message, the identity of the sending and receiving parties, the time of transmission, and a secret key that should be known only to sender and receiver. The secret key must be set up outside of USM as a configuration function. That is, the configuration manager or network manager is responsible for distributing secret keys to be loaded into the databases of the var- ious SNMP managers and agents. This can be done manually or using some form of secure data transfer outside of USM. When the receiving principal gets the message, it uses the same secret key to calculate the message authentication code once again. If the receiver’s version of the code matches the value appended to the incoming message, then the receiver knows that the message can only have originated from the authorized manager and that the message was not altered in transit. The shared secret key between sending and receiving parties must be preconfigured. The actual authentication code used is known as HMAC, which is an Internet-standard authen- tication mechanism. The privacy facility of USM enables managers and agents to encrypt messages. Again, manager principal and agent principal must share a secret key. In this case, if the two are configured to use the privacy facility, all traffic between them is en- crypted using the Data Encryption Standard (DES). The sending principal encrypts the message using the DES algorithm and its secret key and sends the message to the receiving principal, which decrypts it using the DES algorithm and the same se- cret key. The access control facility makes it possible to configure agents to provide dif- ferent levels of access to the agent’s MIB to different managers. An agent principal can restrict access to its MIB for a particular manager principal in two ways. First, it
STAL99 Stallings, W. SNMP, SNMPv2, SNMPv3, and RMON 1 and 2. Reading, MA: Addison-Wesley, 1999. SUBR00 Subranamian, M. Network Management: Principles and Practice. Reading, MA: Addison-Wesley, 2000.
regarding the standard values for network behavior. It is the inexperienced manager that decides to be notified of any and all network events. As an example, we might set an alarm to e-mail us when the number of frames transmitted in error on the wireless network ex- ceeds 100 when the normal level of retransmissions is 1000. This results in a lot of auto- matically generated e-mail.
With small business and home networks, the amount of management required is usually very small. However, there are instances where a certain amount of configuration and no- tification may be desired. These instances include initial setup, security alerts, and net- work-specific items such as billing or authorization. At home we may have additional requirements, such as parental monitoring for children using the Web, spyware/antivirus programs, and software configuration for browsers. In either case, the level of involve- ment is usually small and there is not much call for expensive servers or days spent config- uring the management system.
As networks grow, decisions need to be made regarding the appropriate level of sophisti- cation of the Network Management System (NMS). Remember, the time you spend man- aging the network is time away from other tasks. The NMS can also degrade network performance. Earlier in this book, the concepts of in-band and out-of-band control were introduced. Most enterprise devices are initially configured via a console or serial link. This is a separate physical pathway for the management traffic and is called out-of-band management. Once the administrator starts using telnet, ssh, http, or SNMP to run the network, the messages compete with standard data traffic. This is called inband manage- ment. There are some instances where the topology or configuration can effectively dis- able a portion of the network because of management-inspired messaging. For example, a suspect link can be told to mirror all of its traffic to another location for analysis. Once this is done, the link receiving the new information can be oversubscribed if there are other processes running. Lastly, network failures may cause the connection to the man- agement devices to be severed.
Management of computing resources and a network can be costly and time consuming. Keys to running successful management schemes include appreciating the normal operating con- ditions of the network, implementing only those management items that are required, under- standing the conditions that will result in alarms, knowing the effect of implementing your NMS, and only configuring alerts for items you really want to know about.
20.4 RECOMMENDED READING AND WEB SITES
[STAL99] provides a comprehensive and detailed examination of SNMP, SNMPv2, and SNMPv3; the book also provides an overview of network management technol- ogy. One of the few textbooks on the subject of network management is [SUBR00].
20.1 List and briefly define the key areas that comprise network management. 20.2 Define fault as it applies to network management. 20.3 List two ways in which a network management system may be characterized as inte- grated. 20.4 List and briefly define the key elements of SNMP. 20.5 What functions are provided by SNMP? 20.6 What lower-layer protocol encapsulates SNMP messages? 20.7 Describe two different interpretations of the term MIB. 20.8 What are the differences among SNMPv1, SNMPv2, and SNMPv3?
20.1 Because SNMP uses two different port numbers (UDP ports 161 and 162), a single system can easily run both a manager and an agent. What would happen if the same port number were used for both? 20.2 The original (version 1) specification of SNMP has the following definition of a new type: Gauge :: = [APPLICATION 2] IMPLICIT INTEGER (0..4294967295) The standard includes the following explanation of the semantics of this type: This application-wide type represents a non-negative integer, which may increase or de- crease, but which latches at a maximum value. This standard specifies a maximum value of 2^32 1 (4294967295 decimal) for gauges.
20.5 KEY TERMS, REVIEW QUESTIONS, AND PROBLEMS
accounting management agent configuration and name man- agement fault fault management management information base (MIB)
management station manager network management network management protocol network management system performance management security management
Simple Network Management Protocol (SNMP) Structure of Management In- formation (SMI)