Survey
* Your assessment is very important for improving the workof artificial intelligence, which forms the content of this project
* Your assessment is very important for improving the workof artificial intelligence, which forms the content of this project
Computer network wikipedia , lookup
Wake-on-LAN wikipedia , lookup
Wireless security wikipedia , lookup
Deep packet inspection wikipedia , lookup
Cracking of wireless networks wikipedia , lookup
Airborne Networking wikipedia , lookup
Recursive InterNetwork Architecture (RINA) wikipedia , lookup
Distributed firewall wikipedia , lookup
Network tap wikipedia , lookup
Green Dam Youth Escort wikipedia , lookup
SNMPv3 and Network Management Chapter 2 Network Management, MIBs, and MPLS Stephen B. Morris Copyright 2003. Pearson Education Inc., Publishing as Prentice Hall PTR. All rights reserved. Visit the companion Web site at http://authors.phptr.com/morris/ Revised Spring 2006 SNMPv3 and Network Management 1 1 Overview The purpose of this particular lesson is to familiarize you with the message structure and encryption methods of SNMPv3. Revised Spring 2006 Rudimentary NMS Software Components 2 Structure Provides modular structure that is flexible Complements trend toward component technology Engine and a collection of applications Dispatcher and message, security, and access control subsystems Has Has four subcomponents two main components Subcomponents service versions one through three Important facts to remember about engine subcomponents Can hand off msg processing to each other as required Are themselves extensible entities Revised Spring 2006 SNMPv3 and Network Management 32 Applications Currently five SNMPv3 apps defined Cmd generators create msgs Cmd responders respond to msgs Notification originators send trap or inform msgs Notification receivers receive and processs trap or inform msgs Proxy forwarders forward messsages between SNMP entity components v3 framework allow room for additional apps Revised Spring 2006 SNMPv3 and Network Management 43 Message Formats Security Model Data Common Data Msg Version MsgID MaxMsgSize MsgFlags MsgSecurity General EngineID EngineBoots EngineTime UserName Authentication MD5 Digest or SHA Digest Context Privacy DES Key ContextID ContextName PDU PDU Types Msg format is broken down into four overall sections Common data: occur in all SNMPv3 msgs Security model data: three subsections-one general, one authentication, and one privacy data Context: two fields used to provide correct context in which PDU should be processed PDU: contains a v2 PDU Encrypted or plain text1 Revised Spring 2006 SNMPv3 and Network Management 54 Message Formats First field in SNMP msg is the MsgVersion MsgID used between two entities for msg correlation The number shown indicates version Similar IDs should not be used simultaneously Msg should time out or be answered before the ID is used again PDU has a request ID field No longer used since encryption is an option under v3 MsgID now found in the unencrypted header Revised Spring 2006 SNMPv3 and Network Management 65 Message Formats MsgID also allow discernment between duplicate msgs MaxMsgSize Supported by sender of msg Largest packet that transport protocol can carry without having to use fragmetation Receiver of msg uses info to ensure its reply is within allowed size range MsgFlags Underlying datagram services duplicate msgs 1 byte long: determines authentication and privacy settings for the msg Indicates if msg requires response The security subsystem handles processing of this section Revised Spring 2006 SNMPv3 and Network Management 77 MsgSecurity Message Formats An integer object that determines security setting associated with the msg 0 reserved for any and 1-3 correlates to SNMP versions 1-3 4-255 reserved for standards-track security models Values greater than 255 for enterprise specific security models Security Model Data: Authentication Protocol MD5 and SHA are two support protocols in SNMPv3 Both authenticate the SNMP msg SHA most complex algorithm with 20-byte calculation MD5 has 16-byte algorithm First 12-bytes/96 bits in both protocols are included in the authentication field 20-octet passwd for SHA and 16-octet for MD5 Revised Spring 2006 SNMPv3 and Network Management 8 8 Message Formats 12-byte octet string used to authenticate msg String known as electronic fingerprint Verifies data has not be altered in transit True for MD5 and SHA protocols SNMP: entity to entity During msg exchange authentication key is known to both parties During receipt of key the receiver recalculates the know key using algorithm If the recalculated key matches the original, then authentication occurs Security Model Data: Privacy Protocol Privacy protocol field 8-byte octet string used for Data Encryption Standard (DES) 16-byte key used for encryption First 8 octets of key used for encryption/DES Second 8 octets of key used as initialization vector (continued on next slide) Revised Spring 2006 SNMPv3 and Network Management 99 Message Formats Unique 8-octet value is manipulated to prevent re-usage on encryption of packet DES in SNMPv3 uses private key to encrypt/decrypt msgs Context Deals with existing MIB indexing schemes and how to extend them Some MIB are indexed by port number Certain configs there may be cards/units with the same port numbers Context feature allows multiple instances of identical MIB tables within same SNMP agent Revised Spring 2006 SNMPv3 and Network Management 10 Message Formats SNMPv3 Message Exchanges The flow diagram explains the flow of SNMP msgs Revised Spring 2006 SNMPv3 and Network Management 11 Message Formats Revised Spring 2006 SNMPv3 and Network Management 12 Message Formats Revised Spring 2006 SNMPv3 and Network Management 13 SNMP Problems Has difficulty manipulating large data sets Scalability issues where table grow in the thousands Notifications aren’t guaranteed to arrive UDP Management operations (such as get or set) can time out if network is congested or agent host is heavily loaded SNMP use UDP Despite shortcomings, SNMP’s widespread deployment and simplicity are great strengths! Revised Spring 2006 SNMPv3 and Network Management 14 Summary SNMPv3 offers much greater security than previous versions Allows extension of MIBs Understanding SNMP msg flow is critical to network managers Network elements combine to make up a managed network Revised Spring 2006 SNMPv3 and Network Management 15 The Network Management Problem Chapter 3 Network Management, MIBs, and MPLS Stephen B. Morris Rodrigo Iglesias de Aliaga Revised Spring 2006 Rudimentary NMS Software Components 16 Overview Network Operators problems with the growth of traffic types and volumes. Operational increase due to Multiple NMS growth. There is a strong need to reduce the cost of ownership and improve the return on investment (ROI) for network equipment. Revised Spring 2006 Rudimentary NMS Software Components 17 Overview Automated, flow-through actions are required for network management operations. Provisioning Detecting faults Checking (and verifying) performance Billing/accounting Initiating repairs or network upgrades Maintaining the network inventory Revised Spring 2006 Rudimentary NMS Software Components 18 Bringing the Managed Data to the Code Managed objects reside on many SNMP agent hosts. Copies of managed objects reside on SNMP management systems. Changes in agent data may have to be regularly reconciled with the management system copy. Revised Spring 2006 Rudimentary NMS Software Components 19 Bringing the Managed Data to the Code Components of an NMS Revised Spring 2006 Rudimentary NMS Software Components 20 Bringing the Managed Data to the Code The Quality of an NMS is inversely proportional to the gap between its picture of the network and the actual state of the underlying network- the smaller the gap, the better the NMS. As managed NES become more complex, an extra burden is placed on the management system. Revised Spring 2006 Rudimentary NMS Software Components 21 Scalability Today’s Network is Tomorrow’s NE Scalability is one of the biggest problems facing modern networking. A scalability problem occurs when an increase in the number of instances of a given managed object in the network necessitates a compensating, proportional resource increase inside the management system. Revised Spring 2006 Rudimentary NMS Software Components 22 Layer 2 VPN Scalability Scalability Problems tend to arise in situations of proportional growth. The N2 Problem When the number of layer 2 virtual circuits required is proportional to the square of the number of sites. Anything in networking that grows at the rate of N2 tends to give rise to a problem of scale. As the number of sites gets bigger, the N2 term is more significant than the other terms. Revised Spring 2006 Rudimentary NMS Software Components 23 The N2 problem Revised Spring 2006 Rudimentary NMS Software Components 24 The N2 problem Layer 3 VPNs Layer 3 VPNs provide a much more scalable solution because the number of connections required is proportional to a number of sites, not the square of the number of sites. Layer 3 VPNs avoid the need for a full mesh between all of the customer edge routers by providing these features: A layer 3 core Overlapping IP address range across the connected sites (if separate organizations use the same VPN service) Multiple routing table instances in the provider edge routers Revised Spring 2006 Rudimentary NMS Software Components 25 Virtual Circuit Status Monitoring Scalability problems arise when the MIB table entries become very large due to NMS attempts to read all MIB table entries at the same time. Revised Spring 2006 Rudimentary NMS Software Components 26 MIB Scalability Network operators and their users demand more: Bandwidth Faster Networks Bigger Devices Scalability concerns are growing because routers and switches are routinely expected to support the creation of millions of virtual circuits. Revised Spring 2006 Rudimentary NMS Software Components 27 Creating LSPs in an MPLS network Revised Spring 2006 Rudimentary NMS Software Components 28 Other Enterprise Network Scalability Issues Scalability concerns also affect enterprise networks in these areas: Storage Solutions Administration of Firewalls Access control lists and static routes Security Managements Rules for permitting or blocking packet transit Routers Adding, deleting, modifying, and monitoring SANs Encryption keys, biometrics facilities, and password control Application Management Revised Spring 2006 Rudimentary NMS Software Components 29 Light Reading Trials Internet core routers from Cisco, Juniper, Charlotte’s Networks, and Foundry Networks were stress-tested during 2001 using these tests MPLS throughput Latency IP throughput at OC-48 IP throughput at OC-192 Revised Spring 2006 Rudimentary NMS Software Components 30 Large NEs Advantages of the deployment of much bigger device They reduce the number of devices required, saving central office (CO) space and reducing cooling and power requirements. They may help to reduce cabling by aggregating links. They offer richer feature set. Disadvantages They are harder to manage. They potentially generate vast amounts of management data. They are a possible single point of failure if not back up. Revised Spring 2006 Rudimentary NMS Software Components 31 Expensive (and Scarce) Development Skill Sets Building management systems for the devices of today and tomorrow is increasingly difficult. General migration to a Layer 3 infrastructure is another reason for the widening gap between available development skills and required product features. The need for customers to see rapid ROI for all infrastructural purchases Revised Spring 2006 Rudimentary NMS Software Components 32 Expensive (and Scarce) Development Skill Sets A different approach is needed for developing management systems. Acquiring skills like these would positively enhance the development process. A solution mindset Distributed, creative problem solving Taking ownership Acquiring domain expertise Embracing short development cycles Minimizing code changes Strong testing capability Revised Spring 2006 Rudimentary NMS Software Components 33 A Solution Mindset Solutions have a number of characteristics Clear economic value Fulfillment of important requirements Resolution of one or more end-user problems Revised Spring 2006 Rudimentary NMS Software Components 34 A Solution Mindset Revised Spring 2006 Rudimentary NMS Software Components 35 Distributed, Creative Problem Solving Software Bugs NE Bugs (Hard to identify) Performance Bottlenecks in FCAPS applications due to congestion on the network. Client Applications crashing from time to time MIB Table Corruption SNMP Agent Exceptions Revised Spring 2006 Rudimentary NMS Software Components 36 Distributed, Creative Problem Solving Tools available to solve these problems UML support packages Java/C++/SDL products Version control Debuggers Revised Spring 2006 Rudimentary NMS Software Components 37 Taking Ownership A broad task can be ring-fenced by a small group of developers who take responsibility for design, development, and delivery. Traditional development boundaries are removed. No more pure GUI, backend, or database developers. All NMS software developers should strive to extend their portfolio of skills to achieve this. Institutional memory relates to individual developers with key knowledge of product infrastructure. Revised Spring 2006 Rudimentary NMS Software Components 38 Acquiring Domain Expertise Domain expertise represents a range of detailed knowledge IP/MPLS that can be readily applied to the needs of an organization. Revised Spring 2006 Rudimentary NMS Software Components 39 Acquiring Domain Expertise Knowledge include areas such us: Layer 2 and layer 3 traffic engineering Layer 2 and layer 3 QoS Network Management Convergence of legacy technologies into IP Backward and forward compatibility of new technologies MPLS Revised Spring 2006 Rudimentary NMS Software Components 40 Linked Overviews ATM Linked Overview IP Linked Overview Embracing Short Development Cycles Minimizing Code Changes Revised Spring 2006 Rudimentary NMS Software Components 41 Elements of NMS Development NMS Developments Using a browser-based GUI Developer wants to check that the software executed the correct actions During provisioning, developer verifies Java Database is updated by the management system code Verifying that the correct set of managed objects was written to the NE Revised Spring 2006 Rudimentary NMS Software Components 42 Elements of NMS Development Data Analysis Upgrade considerations UML, Java, and Object-Oriented Development Class Design for Major NMS Features GUI Development Middleware Using CORBA-Based Products Insulating Applications from Low-Level Code Revised Spring 2006 Rudimentary NMS Software Components 43 Expensive (and Scarce) Operational Skill Sets The growing complexity of networks is pointing to increasingly scarce operational skills Multiservice Switches Enterprise network typically want to: Reduce the payback period for new purchases Maintain and expand existing network services Reduce operational costs associated with multiple networks Telephony LAN Revised Spring 2006 Rudimentary NMS Software Components 44 Expensive (and Scarce) Operational Skill Sets Multiservice Switches MPLS provides a way of filling these needs in conjunction with multiservice switches ATM FR TDM IP Revised Spring 2006 Rudimentary NMS Software Components 45 MPLS: Second Chunk Managed objects of MPLS Explicit Route Objects Resource blocks Tunnels and LSPs In-segments Out-segments Cross-connects Routing Protocols Signaling Protocols Label operations Traffic Engineering QoS Revised Spring 2006 Rudimentary NMS Software Components 46 Explicit Route Objects An ERO is a of layer 3 address hops inside an MPLS cloud Describes a list of MPLS nodes through which a tunnel passes. EROs are used by signaling protocols to create tunnels Revised Spring 2006 Rudimentary NMS Software Components 47 Resource Blocks MPLS permits the reservation of resources in the network. Resource blocks provide a means for recording the bandwidth settings Resource blocks include Maximum reserved bandwidth Maximum traffic burst size Packet length Revised Spring 2006 Rudimentary NMS Software Components 48 Tunnels and LSPs MPLS-encapsulated packets enter the tunnel, pass across the appropiaye path, and exhibit three important characteristics Forwarding is based on MPLS label rather than IP header Resource usage is fixed, based on those rederved at the time of connection creation The path taken by the traffic is constrained by the path chosen in advance by the user. Revised Spring 2006 Rudimentary NMS Software Components 49 In-Segments and Out-Segments In-segments on an MPLS node represent the point of ingress for traffic Out-segments represent the point of egress for traffic Revised Spring 2006 Rudimentary NMS Software Components 50 Cross-Connects MPLS node uses the cross-connect settings to decide how to switch traffic between the segments Connection Types Point-to-Point Point-to-Multipoint Multipoint-to-Point Revised Spring 2006 Rudimentary NMS Software Components 51 Routing Protocols MPLS incorporates standard IP routing protocols such as OSPF, IS-IS and BGP4 Revised Spring 2006 Rudimentary NMS Software Components 52 Signaling Protocols LSPs and tunnels can be achieved either manually or via signaling Signaled connections have Resource Reserved Labels Distributed Paths selected by protocols RSVP-TE LDP Revised Spring 2006 Rudimentary NMS Software Components 53 Label Operations MPLS-labeled traffic is forwarded based on its encapsulated value The operations that can be executed against labels are Lookup Swap Pop Push Revised Spring 2006 Rudimentary NMS Software Components 54 MPLS Encapsulation The MPLS Encapsulation specifies four reserved label values 0-IPv4 explicit null that signals the receiving node to pop the label and execute an IP lookup 1-Router alert that indicates to the receiving node to examine the packet more closely (rather than simply forwarding it) 2-IPv6 explicit null 3-Implicit null that signals the receiving node to pop the label and execute an IP lookup Revised Spring 2006 Rudimentary NMS Software Components 55 Qos and Traffic Engineering LAN Bandwidth can be increased as needed using switches Excess bandwidth helps avoid congestion Traffic Engineering is set to become a mandatory element of converged layer 3 enterprise networks. Revised Spring 2006 Rudimentary NMS Software Components 56 QoS There are three approaches that can be adopted for providing different levels of network service Best effort (as provided by the Internet) Fine granularity QoS (Integrated Services – IntServ) Coarse granularity QoS (Differentiated Services – DiffServ) Revised Spring 2006 Rudimentary NMS Software Components 57 IP Header Revised Spring 2006 Rudimentary NMS Software Components 58 MPLS and Scalability This table can include millions of rows It is not practical to try to read or write an object of this size using SNMP Unfortunately, it might be necessary if a network is being initially commissioned or rebalanced after adding new hardware Revised Spring 2006 Rudimentary NMS Software Components 59 MPLS and Scalability Revised Spring 2006 Rudimentary NMS Software Components 60 MPLS and Scalability Revised Spring 2006 Rudimentary NMS Software Components 61 Summary Bringing managed data and code together is one of the central foundations of computing and network management Designers of management systems need rarified skills set that matches the range of technologies embedded in NEs and networks Liberal use of standards documents and linked overviews are some important tools for tackling the complexity of system development, managed object derivation, and definition. Networks must increasingly support a growing range of traffic types. (Traffic Engineering and QoS handling in Layer 2 and Layer 3 Networks). Revised Spring 2006 Rudimentary NMS Software Components 62