Organized, Hybridized Network Monitoring Use a combination of technologies and organizational techniques to master complex network monitoring Abstract In the world of network monitoring, you re basically dealing with two technologies to gather information: Agents that install locally on servers and other computers, and Simple Network Management Protocol (SNMP). SNMP is nice because it works well with appliance-style devices, such as routers and switches, although agents can often provide more detailed information with less overhead for computers and server applications. A third technology, unique to Windows, is Windows Management Instrumentation (WMI). It s similar to SNMP, but can provide greater detail for compatible services and applications. It s not uncommon for monitoring solutions to use either locally installed agents or SNMP/WMI, but it s uncommon to see hybrid solutions that use agents and SNMP/WMI. This is especially true in situations where you don t want to treat an entire network as a single unit. Sometimes you need to monitor different portions of your network in different ways. For instance, perhaps some business divisions need separate monitoring and reporting. Possibly you re acting as a service provider to internal customers who have different monitoring needs, and you need to segregate their information from others. Or, you may need to treat each remote office as an independent entity, keeping network performance and other information separate. In general, these needs are referred to as multitenancy, with each customer, office, or business division acting as an independent tenant within the overall monitoring system.
The traditional approach First, let s look at how traditional monitoring solutions address these kinds of issues. Typically speaking, you ll install local agents wherever you need them, and then identify SNMP or WMI devices as needed. You ll obviously have to do this for each network that you re monitoring. Remote Network A Remote Network B Simple Network Management Protocol is nice because it works well with appliancestyle devices, such as routers and switches, although agents can often provide more detailed information with less overhead for computers and server applications. Figure 1. Remote networks Your Network 2
Now, you ll need a way for those agents to communicate their information back to the central monitoring service, and for SNMP information and traps to be centralized. Typically, that s done through establishing a Virtual Private Network (VPN), or working through an existing VPN. Remote Network A Remote Network B Your Network There s a hybridized approach, however, that can offer a better model. Figure 2. Remote networks with VPN Right here, there are a few problems. First, you re potentially running a lot of traffic through that VPN, which may be needed for other communications. Transmitting the data out-of-vpn isn t usually an option, however, because you need that data to be secured. Second, you re bringing all of that information into a single networkmonitoring database, meaning everything will show up unsegregated. Many solutions will let you manually reorganize the information into partitions, but that s a hassle to maintain as devices are removed and added over time. Third, your central monitoring server is accepting communications from a potentially huge number of agents and SNMP devices. It also has to communicate back with agents to provide configuration information. That s a lot of effort, and it may impact the performance of the monitoring solution itself. There s a hybridized approach, however, that can offer a better model. Hybridized Network Monitoring The solution is to implement a multi-tier, true multi-tenant network monitoring solution. Here, each site s agents and SNMP devices communicate to a specific aggregating agent installed at the site. That site then communicates back to the central monitoring server. It can either use the VPN in place (as shown on Remote Network B), or communicate out-of-band using HTTPS to ensure security (Remote Network A). 3
Remote Network A Remote Network B Agent Agent This approach is called hybrid because it relies both on local data collection and remote monitoring, using an aggregation agent to make the connection between the local data sources and the remote monitoring server. Figure 3. Hybrid remote monitoring This solves two of the three problems, and the solution for the third is simple: Each remote agent is represented as a Your Network discrete organization within the central monitoring console. Figure 4. Remote organizations 4
Using this approach, communications are consolidated to a single, secured channel. The aggregation agent in each location can also convey configuration information back to the agents in that site. A truly multi-tenant approach is revealed, with each site s information being completely self contained (although the central console could also report on aggregate information that combines multiple sites, if desired). This approach is called hybrid because it relies both on local data collection and remote monitoring, using an aggregation agent to make the connection between the local data sources and the remote monitoring server. This approach can not only optimize bandwidth, but also improve the performance of the monitoring solution by aggregating traffic into fewer overall connections. Although this example uses physically remote sites, this same approach could be used for different logical divisions of a single large network. With this approach, you can easily segregate business units, departments, or whatever you need. There s no need to manually track which devices go with which organization; that happens automatically, based simply on which aggregate agent each device or server is reporting to. A lingering concern of this approach is the ability to properly secure the WMI and SNMP credentials that will be needed. After all, failure to secure those can result in unauthorized access to devices something you ll want to avoid at all costs. Foglight Network Management System: Secure, hybridized, multitenant monitoring Foglight Network Management System (NMS) provides exactly the kind of hybrid, multi-tenant monitoring illustrated here, and does so in a solution that takes less than a half hour to install and configure. The Foglight NMS Remote Agent is responsible for aggregating information, and can also communicate policy and configuration information to remotely installed agents on your servers. What s more, that same Remote Agent can also facilitate remote access to those servers, helping to make troubleshooting and maintenance easier and more efficient. By letting you treat each Remote Agent as a distinct organization within the Foglight NMS console, you can create whatever boundaries you need. Treat business units as distinct entities. Even collect vertical segments of your own IT infrastructure into their own partitions, if desired. Using Foglight NMS, you can build network monitoring as a service that can be offered to internal customers, departments and divisions, or whomever you like. You ll get the same consistent, secure, powerful network monitoring capabilities that Foglight NMS is famous for and be able to offer them as a product to your internal customers. Foglight NMS also solves the problem of SNMP and WMI credentials by securely encrypting credentials in storage. Unauthorized users will have no ability to retrieve those passwords from Foglight NMS (unlike a simple Excel spreadsheet or other record keeping mechanism, and unlike less-secure monitoring systems that store credentials in cleartext databases). Foglight NMS will have exactly the permissions you give it within each SNMP- or WMI-enabled device or server, and nothing more. You ll also get all of the other features that make Foglight NMS such a desirable network monitoring system: Expert guidance for solving problems Performance baselines and trending Powerful reporting and network visualization Automated alerting and remediation The Foglight NMS Remote Agent is responsible for aggregating information, and can also communicate policy and configuration information to remotely installed agents on your servers. What s more, that same Remote Agent can also facilitate remote access to those servers, helping to make troubleshooting and maintenance easier and more efficient. 5
2013 Dell, Inc. ALL RIGHTS RESERVED. This document contains proprietary information protected by copyright. No part of this document may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying and recording for any purpose without the written permission of Dell, Inc. ( Dell ). Dell, Dell Software, the Dell Software logo and products as identified in this document are registered trademarks of Dell, Inc. in the U.S.A. and/or other countries. All other trademarks and registered trademarks are property of their respective owners. The information in this document is provided in connection with Dell products. No license, express or implied, by estoppel or otherwise, to any intellectual property right is granted by this document or in connection with the sale of Dell products. EXCEPT AS SET FORTH IN DELL S TERMS AND CONDITIONS AS SPECIFIED IN THE LICENSE AGREEMENT FOR THIS PRODUCT, DELL ASSUMES NO LIABILITY WHATSOEVER AND DISCLAIMS ANY EXPRESS, IMPLIED OR STATUTORY WARRANTY RELATING TO ITS PRODUCTS INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. IN NO EVENT SHALL DELL BE LIABLE FOR ANY DIRECT, INDIRECT, CONSEQUENTIAL, PUNITIVE, SPECIAL OR INCIDENTAL DAMAGES (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF PROFITS, BUSINESS INTERRUPTION OR LOSS OF INFORMATION) ARISING OUT OF THE USE OR INABILITY TO USE THIS DOCUMENT, EVEN IF DELL HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. Dell makes no representations or warranties with respect to the accuracy or completeness of the contents of this document and reserves the right to make changes to specifications and product descriptions at any time without notice. Dell does not make any commitment to update the information contained in this document. About Dell Dell Inc. (NASDAQ: DELL) listens to customers and delivers worldwide innovative technology, business solutions and services they trust and value. For more information, visit www.dell.com. If you have any questions regarding your potential use of this material, contact: Dell Software 5 Polaris Way Aliso Viejo, CA 92656 www.dell.com Refer to our Web site for regional and international office information. Whitepaper-OrganizedHybridNetworkMonitor-US-VG-01-10-13