Chapter 8: Network Management

1. Chapter goals: introduction to network management motivation major components Internet network management framework MIB: management information base SMI: data definition language SNMP: protocol for network management security and administration presentation services: ASN.1 Chapter 8: Network Management 8: Network Management

2. Areas of Network Mangement • Performance management - to quantify, measure, report, analyze, and control the performance of different network components; • Fault management - to log, detect and respond to fault conditions in the network; • Configuration management - to track which devices are on the managed network and the hardware and software configurations of these devices; • Accounting management- to specify, log, and control user and device access to network resources; • Security management- to control access to network resources according to some well-defined policy; 8: Network Management

3. What is network management? • autonomous systems (aka “network”): 100s or 1000s of interacting hw/sw components • other complex systems requiring monitoring, control: • jet airplane • nuclear power plant • others? "Network management includes the deployment, integration and coordination of the hardware, software, and human elements to monitor, test, poll, configure, analyze, evaluate, and control the network and element resources to meet the real-time, operational performance, and Quality of Service requirements at a reasonable cost." 8: Network Management

4. managing entity data data data data data agent agent agent agent Infrastructure for network management definitions: managing entity managed devices contain managed objects whose data is gathered into a Management Information Base (MIB) managed device network management protocol managed device managed device managed device 8: Network Management

5. OSI CMIP Common Management Information Protocol designed 1980’s: the unifying net management standard too slowly standardized SNMP: Simple Network Management Protocol Internet roots (SGMP) started simple deployed, adopted rapidly growth: size, complexity currently: SNMP V3 de facto network management standard Network Management standards 8: Network Management

6. SNMP overview: 4 key parts • Management information base (MIB): • distributed information store of network management data • Structure of Management Information (SMI): • data definition language for MIB objects • SNMP protocol • convey manager<->managed object info, commands • security, administration capabilities • major addition in SNMPv3 8: Network Management

7. Purpose: syntax, semantics of management data well-defined, unambiguous base data types: straightforward, OBJECT-TYPE data type, status, semantics of managed object MODULE-IDENTITY groups related objects into MIB module SMI: data definition language Basic Data Types INTEGER Integer32 Unsigned32 OCTET STRING OBJECT IDENTIFIER IPaddress Counter32 Counter64 Guage32 Time Ticks Opaque 8: Network Management

8. MODULE SNMP MIB MIB module specified via SMI MODULE-IDENTITY (100 standardized MIBs, more vendor-specific) OBJECT TYPE: OBJECT TYPE: OBJECT TYPE: objects specified via SMI OBJECT-TYPE construct 8: Network Management

9. OBJECT-TYPE:ipInDelivers MODULE-IDENTITY:ipMIB SMI: Object, module examples ipMIB MODULE-IDENTITY LAST-UPDATED “941101000Z” ORGANZATION “IETF SNMPv2 Working Group” CONTACT-INFO “ Keith McCloghrie ……” DESCRIPTION “The MIB module for managing IP and ICMP implementations, but excluding their management of IP routes.” REVISION “019331000Z” ……… ::= {mib-2 48} ipInDelivers OBJECT TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION “The total number of input datagrams successfully delivered to IP user- protocols (including ICMP)” ::= { ip 9} 8: Network Management

10. MIB example: UDP module Object ID Name Type Comments 1.3.6.1.2.1.7.1 UDPInDatagrams Counter32 total # datagrams delivered at this node 1.3.6.1.2.1.7.2 UDPNoPorts Counter32 # underliverable datagrams no app at portl 1.3.6.1.2.1.7.3 UDPInErrors Counter32 # undeliverable datagrams all other reasons 1.3.6.1.2.1.7.4 UDPOutDatagrams Counter32 # datagrams sent 1.3.6.1.2.1.7.5 udpTable SEQUENCE one entry for each port in use by app, gives port # and IP address 8: Network Management

11. SNMP Naming question: how to name every possible standard object (protocol, data, more..) in every possible network standard?? answer: ISO Object Identifier tree: • hierarchical naming of all objects • each branchpoint has name, number 1.3.6.1.2.1.7.1 udpInDatagrams UDP MIB2 management ISO ISO-ident. Org. US DoD Internet 8: Network Management

12. OSI Object Identifier Tree Check out www.alvestrand.no/harald/objectid/top.html 8: Network Management

13. a 00000011 00000001 a 00000001 00000011 The presentation problem Q: does perfect memory-to-memory copy solve “the communication problem”? A: not always! struct { char code; int x; } test; test.x = 256; test.code=‘a’ test.code test.x test.code test.x host 2 format host 1 format problem: different data format, storage conventions 8: Network Management

14. Solving the presentation problem 1. Translate local-host format to host-independent format 2. Transmit data in host-independent format 3. Translate host-independent format to remote-host format 8: Network Management

15. ASN.1: Abstract Syntax Notation 1 • ISO standard X.680 • used extensively in Internet • like eating vegetables, knowing this “good for you”! • defined data types, object constructors • like SMI • BER: Basic Encoding Rules • specify how ASN.1-defined data objects to be transmitted • each transmitted object has Type, Length, Value (TLV) encoding 8: Network Management

16. TLV Encoding Idea: transmitted data is self-identifying • T: data type, one of ASN.1-defined types • L: length of data in bytes • V: value of data, encoded according to ASN.1 standard Tag ValueType Boolean Integer Bitstring Octet string Null Object Identifier Real 1 2 3 4 5 6 9 8: Network Management

17. TLV encoding: example Value, 259 Length, 2 bytes Type=2, integer Value, 5 octets (chars) Length, 5 bytes Type=4, octet string 8: Network Management

18. Basic Concepts of SNMP • An integrated collection of tools for network monitoring and control. • Single operator interface • Minimal amount of separate equipment. Software and network communications capability built into the existing equipment • SNMP key elements: • Management station • Managament agent • Management information base • Network Management protocol • Get, Set and Notify 8: Network Management

19. request managing entity managing entity data data agent agent SNMP protocol Two ways to convey MIB info, commands: trap msg response Managed device Managed device request/response mode trap mode 8: Network Management

20. Protocol context of SNMP 8: Network Management

21. Proxy Configuration 8: Network Management

22. 8: Network Management

23. SNMP v1 and v2 • Trap – an unsolicited message (reporting an alarm condition) • SNMPv1 is ”connectionless” since it utilizes UDP (rather than TCP) as the transport layer protocol. • SNMPv2 allows the use of TCP for ”reliable, connection-oriented” service. 8: Network Management

24. SNMP protocol: message types Function Message type GetRequest GetNextRequest GetBulkRequest Mgr-to-agent: “get me data” (instance,next in list, block) InformRequest Mgr-to-Mgr: here’s MIB value SetRequest Mgr-to-agent: set MIB value Agent-to-mgr: value, response to Request Response Agent-to-mgr: inform manager of exceptional event Trap 8: Network Management

25. SNMP protocol: message formats 8: Network Management

26. SNMPv1 PDU SNMPv2 PDU Direction Description GetRequest GetRequest Manager to agent Request value for each listed object GetNextRequest GetNextRequest Manager to agent Request next value for each listed object ------ GetBulkRequest Manager to agent Request multiple values SetRequest SetRequest Manager to agent Set value for each listed object ------ InformRequest Manager to manager Transmit unsolicited information GetResponse Response Agent to manager or Manage to manager(SNMPv2) Respond to manager request Trap SNMPv2-Trap Agent to manager Transmit unsolicited information Comparison of SNMPv1 and SNMPv2 8: Network Management

27. SNMPv1 Community Facility • SNMP Community – Relationship between an SNMP agent and SNMP managers. • Three aspect of agent control: • Authentication service • Access policy • Proxy service 8: Network Management

28. SNMPv1 Administrative Concepts 8: Network Management

29. SNMPv3 • SNMPv3 defines a security capability to be used in conjunction with SNMPv1 or v2 8: Network Management

30. Traditional SNMP Manager 8: Network Management

31. SNMPv3 Flow 8: Network Management

32. SNMP3 Message Format with USM 8: Network Management

33. User Security Model (USM) • Designed to secure against: • Modification of information • Masquerade • Message stream modification • Disclosure • Not intended to secure against: • Denial of Service (DoS attack) • Traffic analysis 8: Network Management

34. SNMP v.3 security and administration • encryption: DES-encrypt SNMP message • authentication: compute, send MAC(m,k): compute hash (MAC) over message (m), secret shared key (k) • protection against playback: use nonce • view-based access control • SNMP entity maintains database of access rights, policies for various users • database itself accessible as managed object! 8: Network Management

35. USM Timeliness Mechanisms • USM includes a set of timeliness mechanisms to guard against message delay and message replay. • If a message is considered to be outside of the time window, then the message is considered not authentic, and an error indication is returned to the calling module. • Timeliness checking is done only if the authentication service is in use and the message is authentic, assuring the validity of the message header fields. 8: Network Management

36. 8: Network Management

37. Key localization • For the use of the authentication and privacy services it is required that a secret authentication key and a secret privacy key must be used for communications. • The keys can be generated from the user password using a special algorithm. • A single password could be used to generate a single key for both authentication and encryption. • A more secure scheme is to use two passwords and to generate two different keys. • A localized key is a secret key shared between a user and a remote SNMP engine. • The process by which a single user key is converted into multiple unique keys is called key localization. 8: Network Management

38. Key Localization Process 8: Network Management

39. View-Based Access Control Model (VACM) • VACM has two characteristics: • Determines whether access to a managed object should be allowed. • Make use of an MIB that: • Defines the access control policy for this agent. • Makes it possible for remote configuration to be used. 8: Network Management

40. Elements of the VACM Model • Group – a set of <securityModel, securityName> tuples on whose behalf objects can be accessed • MIB context - named subset of the object instances in the local MIB • MIB view – specific set of of managed objects • Access policy – particular set of access rights (read, write, notify) 8: Network Management

41. Access determination depends on: • Principal making the access request • Security level requested • Security model • MIB context for the request • Object instance for which access is requested • Type of access requested (read, write notify) 8: Network Management

42. Access control processing 8: Network Management

43. Motivation for VACM • In SNMPv1 the security related information is lumped into a single variable – community. By this flexibility and functionality are lost. • VACM provides the same set of security related information using distinct variables for each item. • This is substantial improvement over SNMPV1. It uncouples various concepts so that values can be assigned to each one separately. 8: Network Management