Network Management. New York Institute of Technology CSCI 690 Michael Hutt

Transcription

1 Network Management New York Institute of Technology CSCI 690 Michael Hutt

2 FCAPS Fault Configuration Accounting Performance Security

3 Fault SNMP Polling SNMP Traps RMON syslog Emergency (level 0) Alert (level 1) Critical (level 2) Error (level 3) Warning (level 4) Notice (level 5) Info (level 6) Debug (level 7)

4 Simple Network Management Protocol (SNMP) SNMPv1 - RFC 1157 SNMPv2 - RFC 1905 SNMPv3 - RFC , NMS vs Agent MIB - Management Information Base MIB II - RFC implemented by all agents RMON - RFC 2819 RMONv2 - RFC 2021

5 SNMP Community Strings SNMPv1 and SNMPv2 use communities read-only read-write trap Community strings act as passwords public/private are default strings SNMPv3 introduced authentication

6 Structure of Management Information (SMI) Defines how management data is represented SMIv1 RFC 1155 SMIv2 RFC 2578 Name The name or object identifier (OID) uniquely defines a managed object Type and Syntax objects datatype defined using ASN.1 Encoding A single instance of a managed object is encoded into a string of octets using BER (Basic Encoding Rules)

7 SMIv1 Datatypes Integer Octet String Counter OID NULL Sequence Sequence of IpAddress NetworkAddress Gauge Timeticks Opaque

8 SMIv2 Integer32 Counter32 Gauge32 Unsigned32 Counter64 BITS

9 Management Information Base (MIB) RFC1213-MIB DEFINITIONS ::= BEGIN IMPORTS mgmt, NetworkAddress, IpAddress, Counter, Gauge, TimeTicks FROM RFC1155-SMI OBJECT-TYPE FROM RFC-1212; -- This MIB module uses the extended OBJECT-TYPE macro as -- defined in [14]; -- MIB-II (same prefix as MIB-I) mib-2 OBJECT IDENTIFIER ::= { mgmt 1 }

10 OIDs

11 OIDs +--iso(1) +--org(3) +--dod(6) +--internet(1) +--directory(1) +--mgmt(2) +--mib-2(1) +--system(1)

12 OIDs snmptranslate -Tp system(1) +-- -R-- String sysdescr(1) Textual Convention: DisplayString Size: R-- ObjID sysobjectid(2) +-- -R-- TimeTicks sysuptime(3) +--sysuptimeinstance(0) +-- -RW- String syscontact(4) Textual Convention: DisplayString Size: RW- String sysname(5) Textual Convention: DisplayString Size: RW- String syslocation(6) Textual Convention: DisplayString Size: R-- INTEGER sysservices(7) Range: R-- TimeTicks sysorlastchange(8) Textual Convention: TimeStamp +--sysortable(9) +--sysorentry(1) Index: sysorindex INTEGER sysorindex(1) Range: R-- ObjID sysorid(2) +-- -R-- String sysordescr(3) Textual Convention: DisplayString Size: R-- TimeTicks sysoruptime(4) Textual Convention: TimeStamp

13 SNMP Operations get get-next get-bulk (SNMPv2 and SNMPv3) set get-response trap notification (SNMPv2 and SNMPv3) inform (SNMPv2 and SNMPv3) report (SNMPv2 and SNMPv3)

14 SNMP get avgbusy1 OBJECT-TYPE SYNTAX INTEGER ACCESS read-only STATUS mandatory DESCRIPTION "1 minute exponentially-decayed moving average of the CPU busy percentage." ::= { lcpu 57 } snmpget -c rmspublic earth OLD-CISCO-CPU-MIB::avgBusy1.0 = INTEGER: 1 snmpget -c rmspublic earth avgbusy1.0 OLD-CISCO-CPU-MIB::avgBusy1.0 = INTEGER: 1

15 SNMP get snmptranslate -Tp local(2) +--lcpu(1) +-- -R-- INTEGER busyper(56) +-- -R-- INTEGER avgbusy1(57) +-- -R-- INTEGER avgbusy5(58) +-- -RW- INTEGER idlecount(59) +-- -RW- INTEGER idlewired(60) sudo tcpdump port 161 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on en0, link-type EN10MB (Ethernet), capture size 96 bytes 09:52: IP > earth.snmp: C=rmspublic GetRequest(30) E:cisco :52: IP earth.snmp > : C=rmspublic GetResponse(31) E:cisco =3

16 SNMP get-next retrieves a group of values from a MIB traverses a subtree based on the lexicographic ordering of the MIB s object tree usually implemented as snmpwalk

17 SNMP walk snmpwalk -c rmspublic earth system SNMPv2-MIB::sysDescr.0 = STRING: Cisco Internetwork Operating System Software IOS (tm) 2500 Software (C2500-JS56I-L), Version 12.1(11), RELEASE SOFTWARE (fc1) Copyright (c) by cisco Systems, Inc. Compiled Wed 03-Oct-01 03:02 by kellythw SNMPv2-MIB::sysObjectID.0 = OID: SNMPv2-SMI::enterprises DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (26846) 0:04:28.46 SNMPv2-MIB::sysContact.0 = STRING: hutt@ieee.org SNMPv2-MIB::sysName.0 = STRING: earth.nyc-dev.cisco.com SNMPv2-MIB::sysLocation.0 = STRING: lab SNMPv2-MIB::sysServices.0 = INTEGER: 78 SNMPv2-MIB::sysORLastChange.0 = Timeticks: (0) 0:00:00.00

18 sysservices sysservices OBJECT-TYPE SYNTAX INTEGER (0..127) ACCESS read-only STATUS mandatory DESCRIPTION "A value which indicates the set of services that this entity primarily offers. The value is a sum. This sum initially takes the value zero, Then, for each layer, L, in the range 1 through 7, that this node performs transactions for, 2 raised to (L - 1) is added to the sum. For example, a node which performs primarily routing functions would have a value of 4 (2^(3-1)). In contrast, a node which is a host offering application services would have a value of 72 (2^(4-1) + 2^(7-1)). Note that in the context of the Internet suite of protocols, values should be calculated accordingly: layer functionality 1 physical (e.g., repeaters) 2 datalink/subnetwork (e.g., bridges) 3 internet (e.g., IP gateways) 4 end-to-end (e.g., IP hosts) 7 applications (e.g., mail relays) For systems including OSI protocols, layers 5 and 6 may also be counted." ::= { system 7 }

19 SNMP get-bulk snmpbulkget -v2c -c rmspublic earth ifinoctets RFC1213-MIB::ifInOctets.1 = Counter32: RFC1213-MIB::ifInOctets.2 = Counter32: RFC1213-MIB::ifInOctets.3 = Counter32: 0 RFC1213-MIB::ifInOctets.4 = Counter32: 0 RFC1213-MIB::ifInOctets.5 = Counter32: 0 RFC1213-MIB::ifInOctets.6 = Counter32: 0 RFC1213-MIB::ifInOctets.7 = Counter32: 0 RFC1213-MIB::ifInUcastPkts.1 = Counter32: 602 RFC1213-MIB::ifInUcastPkts.2 = Counter32: 5512 RFC1213-MIB::ifInUcastPkts.3 = Counter32: 0

20 SNMP set snmp-server contact snmpset -c rmsprivate earth system.syscontact.0 s "mhutt@nyit.edu" RFC1213-MIB::sysContact.0 = STRING: mhutt@nyit.edu snmp-server contact mhutt@nyit.edu

21 SNMP Traps Asynchronous notification of an event Sent from SNMP Agent to NMS NMS app must be listening on UDP port 162 Generic Traps coldstart(0) warmstart(1) linkdown(2) linkup(3) authenticationfailure(4) egpneighborloss(5) enterprisespecific(6)

22 RMONv1 RMONv1 9-Groups rmon OBJECT IDENTIFIER ::= { mib-2 16 } statistics OBJECT IDENTIFIER ::= { rmon 1 } history OBJECT IDENTIFIER ::= { rmon 2 } alarm OBJECT IDENTIFIER ::= { rmon 3 } hosts OBJECT IDENTIFIER ::= { rmon 4 } hosttopn OBJECT IDENTIFIER ::= { rmon 5 } matrix OBJECT IDENTIFIER ::= { rmon 6 } filter OBJECT IDENTIFIER ::= { rmon 7 } capture OBJECT IDENTIFIER ::= { rmon 8 } event OBJECT IDENTIFIER ::= { rmon 9 } rmon event 1 log trap rmspublic description CPU_HIGH owner mike rmon alarm 1 lsystem absolute rising-threshold 50 1 falling-threshold 40 1 owner mike

23 RMONv2 protocoldir OBJECT IDENTIFIER ::= { rmon 11 } protocoldist OBJECT IDENTIFIER ::= { rmon 12 } addressmap OBJECT IDENTIFIER ::= { rmon 13 } nlhost OBJECT IDENTIFIER ::= { rmon 14 } nlmatrix OBJECT IDENTIFIER ::= { rmon 15 } alhost OBJECT IDENTIFIER ::= { rmon 16 } almatrix OBJECT IDENTIFIER ::= { rmon 17 } usrhistory OBJECT IDENTIFIER ::= { rmon 18 } probeconfig OBJECT IDENTIFIER ::= { rmon 19 }

24 Configuration cli - command line interface telnet,ssh tftp earth#copy tftp running-config Address or name of remote host []? Source filename []? init-router-config Destination filename [running-config]? gui - for Cisco routers - CiscoWorks

25 Configuration version control cvs,svn,git svn diff earth-config Index: earth-config =================================================================== --- earth-config (revision 27) +++ earth-config (working copy) -119,8 +119,8 tacacs-server host tacacs-server key tac_plus168 snmp-server engineid local E0B0640B7C -snmp-server community rmspublic RO -snmp-server community rmsprivate RW +snmp-server community public RO +snmp-server community private RW snmp-server trap-source Loopback0 snmp-server location lab snmp-server contact

26 Accounting TACACS+ Authentication, Authorization, Accounting tacacs 49/udp # Login Host Protocol (TACACS) RADIUS radius 1812/udp # RADIUS radius-acct 1813/udp # RADIUS Accounting

27 Performance MRTG Cricket rrdtool round robin database tool Trending Analysis

28 Security TACACS+ RADIUS SNMPv3 User based security model (USM) Message integrity to ensure that a packet has not been tampered with in transit. Authentication to verify that the message is from a valid source. Encryption of packets to prevent snooping by an unauthorized source.

29 References Essential SNMP, Mauro & Schmidt, O Reilly, 2001 The Simple Book, Rose, Prentice Hall, 1996 Understanding MIBs, Perkins & McGinnis, Prentice Hall,