Policy-Based Management with SNMP and Comparison with COPS-PR Steve Waldbusser 5/16/01

Policy Based Management u A policy binds an action (simple or complex) to a filter rule that determines what elements the action should be applied to u I.e. if (an element has certain characteristics) then (apply operation to that element) u Alternately: if (policyFilter) then (policyAction)

A Conceptual policy Trunk Ethernet Gold 100Mb Trunk ATM Gold 45Mb Trunk Ethernet 100Mb Access Ethernet Gold 10Mb Access Ethernet Silver 10Mb Access Ethernet 10Mb Trunk Ethernet Silver 100Mb Access Ethernet Gold 100Mb Trunk Frame 45Mb Access Frame Gold 512Kb Access Frame Silver 512Kb Access Frame 128Kb Access Ethernet Bronze 10Mb Access Ethernet Gold 10Mb Trunk AND Ethernet AND 100Mb: Trunk Ethernet Gold 100Mb Trunk Ethernet 100Mb Trunk Ethernet Silver 100Mb Autonegotiate Off

A Conceptual policy Trunk Ethernet Gold 100Mb Trunk ATM Gold 45Mb Trunk Ethernet 100Mb Access Ethernet Gold 10Mb Access Ethernet Silver 10Mb Access Ethernet 10Mb Trunk Ethernet Silver 100Mb Access Ethernet Gold 100Mb Trunk Frame 45Mb Access Frame Gold 512Kb Access Frame Silver 512Kb Access Frame 128Kb Access Ethernet Bronze 10Mb Access Ethernet Gold 10Mb Access Ethernet Gold 10Mb Ethernet AND Access AND Gold: Access Ethernet Gold 10Mb Access Ethernet Gold 100Mb Access Ethernet Gold 10Mb Access Ethernet Gold 10Mb DSCP = 5.

The Policy-Based Management MIB u The Policy Management MIB (PM MIB) provides a way to describe and install policies for any domain: –QOS –Security –Routing –etc. u PM MIB Policies can manage any type of element –Interfaces –Circuits –Queues –Processes –Software –others...

PM MIB Goals u Leverage existing infrastructure and tools –Resulting simplicity will accelerate time to market u Leverage existing MIBs –Don’t start from scratch in our data models u Flexibility for real-world policy –Simple or complex filters –Simple or complex actions u Meet operational requirements –Policy-based management is *very* different –End-users will need new tools and practices

Policy Operation Existing SNMP MIBs PolicyFilterPolicyAction ifType == FastEthernet && roleString == trunk fullDuplexMode = ON ifType == Ethernet && roleString == GOLD Set QOS parameters to provide EF PHB Policies (Usually local operations in which SNMP packets on network are unnecessary)

Elements of the Policy MIB Architecture u PolicyScript Language –Interpreted language that policy filters and actions are expressed in u Accessor Function Library –Standard set of library functions available for PolicyScript code u PM MIB –Objects and attributes that describe policies, schedules and supporting information

PolicyScript Language u Least Common Denominator of C, Perl, C++, TCL, Python, and Javascript u No pointers, structures, typed variables, objects, classes, etc. u Does contain expressions, variables, looping

Accessor Function Library u Library of 41 standard functions for policy processing –Convenience SNMP Functions getvar, exists, setvar, searchcolumn, setRowStatus, counterRate,... –General SNMP Functions newPDU, readVar, writeVar, snmpsend –Policy Functions roleMatch, elementName, setScratchPad, getScratchPad, signalException, getParameters –Utility Functions regexp, regexp_replace, oidlen, oidncmp, insubtree, subid, substr,... –Library Functions strncmp, strncasecmp, strlen, random, sprintf, sscanf u Extensible –Vendors and others can add new accessor functions (e.g., setCLI())

policyFilter PseudoCode Pseudocode: (is an ethernet AND is operational AND gets gold or silver service) Scripted As: (getvar(“ifType.$*”) == ethernet-csmacd && getvar(“ifOperStatus.$*”) == up && (roleMatch("gold") || roleMatch("silver")))

Execution Example  Filter: (getvar(“ifType.$*”) == ethernet-csmacd && !(roleMatch("gold") || roleMatch("silver"))) u Action: setvar(“ifAdminStatus.$*”, down(2), Integer)

Example Policy u Web Hosting Provider gives shell accounts but prohibits long- running programs u Filter: // if it's an application and it's // consumed more than 5 minutes of CPU time (getvar("hrSWRunType.$*") == 4 // app, not OS or driver && getvar("hrSWRunPerfCPU.$*") > 30000) // 300 seconds u Action: // Kill it setvar("hrSWRunStatus.$*", invalid(4), Integer); // invalid(4) kills it

MIB Objects u Policy Table: Contains filter, action, scheduling info, execution instructions, debugging info, etc. –Policy installation consists of creating rows in this table u Other Tables in PM MIB for scheduling, roles and capabilities, operational tools, debugging, etc....

Initial Configuration Config Req (Get/Getnext) Config Data Policy Installation (Set) Ack Protocol Interaction Manager Managed System u No Polling u No Traps

Policy Change Policy Install/Modify (Set) Ack Protocol Interaction Manager Managed System u No Polling u No Traps

Config State Change Ack State Change (Inform) Policy Install/Modify (Set) Ack Protocol Interaction Manager Managed System u No Polling u No Traps

Features of Policy MIB u Scripting –Very flexible and understandable way to express policy –IT Personnel like the power of scripting –Much more flexible than string matching u Policies based on operational status –Capabilities, status of interface, utilization, etc. –Allows much more rich sets of policies than using human-input strings u Scheduling –Business calendars: “M-F 9-5” or “Last Friday of every month” –Videoconference from 12PM to 1PM u Conflict resolution –Follows a precedence tree to find best policy in case of conflict –COPS punts conflict resolution to the manager u Error Recovery –Scripting allows you to fallback to an alternate mechanism, an alternate policy, or to raise an alarm

Operational Requirements u Tools for Policy Creation –Need to allow an engineer to test a policy –Answer question: will this filter match the proper elements? u Tools for Ongoing Operations –Notifications if a policy undergoes errors –When debugging a problem, want to know: what policies are managing this element –May want to disable a policy on an element so operator can take back control (“limp-home mode”) until policy is fixed Must document this ad-hoc decision

Advantages of the PM MIB u Built with existing infrastructure and tools u Leverages existing MIBs u Flexibility u Complete Architecture –Includes operational tools