Chapter 8: Network Management Chapter goals: introduction to network management motivation major components Internet network management framework MIB: management information base SMI: data definition language SNMP: protocol for network management security and administration presentation services: ASN.1 8: Network Management

Areas of Network Mangement Performance management - to quantify, measure, report, analyze, and control the performance of different network components; Fault management - to log, detect and respond to fault conditions in the network; Configuration management - to track which devices are on the managed network and the hardware and software configurations of these devices; Accounting management- to specify, log, and control user and device access to network resources; Security management- to control access to network resources according to some well-defined policy; 8: Network Management

What is network management? autonomous systems (aka “network”): 100s or 1000s of interacting hw/sw components other complex systems requiring monitoring, control: jet airplane nuclear power plant others? "Network management includes the deployment, integration and coordination of the hardware, software, and human elements to monitor, test, poll, configure, analyze, evaluate, and control the network and element resources to meet the real-time, operational performance, and Quality of Service requirements at a reasonable cost." 8: Network Management

Infrastructure for network management definitions: managing entity agent data managing entity data managed devices contain managed objects whose data is gathered into a Management Information Base (MIB) managed device agent data network management protocol managed device agent data agent data managed device managed device 8: Network Management

Network Management standards OSI CMIP Common Management Information Protocol designed 1980’s: the unifying net management standard too slowly standardized SNMP: Simple Network Management Protocol Internet roots (SGMP) started simple deployed, adopted rapidly growth: size, complexity currently: SNMP V3 de facto network management standard 8: Network Management

SNMP overview: 4 key parts Management information base (MIB): distributed information store of network management data Structure of Management Information (SMI): data definition language for MIB objects SNMP protocol convey manager<->managed object info, commands security, administration capabilities major addition in SNMPv3 8: Network Management

SMI: data definition language Purpose: syntax, semantics of management data well-defined, unambiguous base data types: straightforward, OBJECT-TYPE data type, status, semantics of managed object MODULE-IDENTITY groups related objects into MIB module Basic Data Types INTEGER Integer32 Unsigned32 OCTET STRING OBJECT IDENTIFIER IPaddress Counter32 Counter64 Guage32 Time Ticks Opaque 8: Network Management

SNMP MIB MIB module specified via SMI MODULE-IDENTITY (100 standardized MIBs, more vendor-specific) MODULE OBJECT TYPE: OBJECT TYPE: OBJECT TYPE: objects specified via SMI OBJECT-TYPE construct 8: Network Management

SMI: Object, module examples OBJECT-TYPE: ipInDelivers MODULE-IDENTITY: ipMIB ipMIB MODULE-IDENTITY LAST-UPDATED “941101000Z” ORGANZATION “IETF SNMPv2 Working Group” CONTACT-INFO “ Keith McCloghrie ……” DESCRIPTION “The MIB module for managing IP and ICMP implementations, but excluding their management of IP routes.” REVISION “019331000Z” ……… ::= {mib-2 48} ipInDelivers OBJECT TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION “The total number of input datagrams successfully delivered to IP user- protocols (including ICMP)” ::= { ip 9} 8: Network Management

MIB example: UDP module Object ID Name Type Comments 1.3.6.1.2.1.7.1 UDPInDatagrams Counter32 total # datagrams delivered at this node 1.3.6.1.2.1.7.2 UDPNoPorts Counter32 # underliverable datagrams no app at portl 1.3.6.1.2.1.7.3 UDPInErrors Counter32 # undeliverable datagrams all other reasons 1.3.6.1.2.1.7.4 UDPOutDatagrams Counter32 # datagrams sent 1.3.6.1.2.1.7.5 udpTable SEQUENCE one entry for each port in use by app, gives port # and IP address 8: Network Management

SNMP Naming question: how to name every possible standard object (protocol, data, more..) in every possible network standard?? answer: ISO Object Identifier tree: hierarchical naming of all objects each branchpoint has name, number 1.3.6.1.2.1.7.1 ISO ISO-ident. Org. US DoD Internet udpInDatagrams UDP MIB2 management 8: Network Management

OSI Object Identifier Tree Check out www.alvestrand.no/harald/objectid/top.html 8: Network Management

The presentation problem Q: does perfect memory-to-memory copy solve “the communication problem”? A: not always! struct { char code; int x; } test; test.x = 256; test.code=‘a’ test.code test.x a 00000001 00000011 test.code test.x a 00000011 00000001 host 1 format host 2 format problem: different data format, storage conventions 8: Network Management

Solving the presentation problem 1. Translate local-host format to host-independent format 2. Transmit data in host-independent format 3. Translate host-independent format to remote-host format 8: Network Management

ASN.1: Abstract Syntax Notation 1 ISO standard X.680 used extensively in Internet like eating vegetables, knowing this “good for you”! defined data types, object constructors like SMI BER: Basic Encoding Rules specify how ASN.1-defined data objects to be transmitted each transmitted object has Type, Length, Value (TLV) encoding 8: Network Management

TLV Encoding Idea: transmitted data is self-identifying T: data type, one of ASN.1-defined types L: length of data in bytes V: value of data, encoded according to ASN.1 standard Tag Value Type 1 2 3 4 5 6 9 Boolean Integer Bitstring Octet string Null Object Identifier Real 8: Network Management

TLV encoding: example Value, 259 Length, 2 bytes Type=2, integer Value, 5 octets (chars) Length, 5 bytes Type=4, octet string 8: Network Management

Basic Concepts of SNMP An integrated collection of tools for network monitoring and control. Single operator interface Minimal amount of separate equipment. Software and network communications capability built into the existing equipment SNMP key elements: Management station Managament agent Management information base Network Management protocol Get, Set and Notify 8: Network Management

request/response mode SNMP protocol Two ways to convey MIB info, commands: managing entity managing entity request trap msg response agent data agent data Managed device Managed device request/response mode trap mode 8: Network Management

Protocol context of SNMP 8: Network Management

Proxy Configuration 8: Network Management

8: Network Management

SNMP v1 and v2 Trap – an unsolicited message (reporting an alarm condition) SNMPv1 is ”connectionless” since it utilizes UDP (rather than TCP) as the transport layer protocol. SNMPv2 allows the use of TCP for ”reliable, connection-oriented” service. 8: Network Management

SNMP protocol: message types Function GetRequest GetNextRequest GetBulkRequest Mgr-to-agent: “get me data” (instance,next in list, block) InformRequest Mgr-to-Mgr: here’s MIB value SetRequest Mgr-to-agent: set MIB value Agent-to-mgr: value, response to Request Response Trap Agent-to-mgr: inform manager of exceptional event 8: Network Management

SNMP protocol: message formats 8: Network Management

Comparison of SNMPv1 and SNMPv2 Transmit unsolicited information Agent to manager SNMPv2-Trap Trap Respond to manager request Agent to manager or Manage to manager(SNMPv2) Response GetResponse Manager to manager InformRequest ------ Set value for each listed object Manager to agent SetRequest Request multiple values GetBulkRequest Request next value for each listed object GetNextRequest Request value for each listed object GetRequest Description Direction SNMPv2 PDU SNMPv1 PDU 8: Network Management

SNMPv1 Community Facility SNMP Community – Relationship between an SNMP agent and SNMP managers. Three aspect of agent control: Authentication service Access policy Proxy service 8: Network Management

SNMPv1 Administrative Concepts 8: Network Management

SNMPv3 SNMPv3 defines a security capability to be used in conjunction with SNMPv1 or v2 8: Network Management

Traditional SNMP Manager 8: Network Management

SNMPv3 Flow 8: Network Management

SNMP3 Message Format with USM 8: Network Management

User Security Model (USM) Designed to secure against: Modification of information Masquerade Message stream modification Disclosure Not intended to secure against: Denial of Service (DoS attack) Traffic analysis 8: Network Management

SNMP v.3 security and administration encryption: DES-encrypt SNMP message authentication: compute, send MAC(m,k): compute hash (MAC) over message (m), secret shared key (k) protection against playback: use nonce view-based access control SNMP entity maintains database of access rights, policies for various users database itself accessible as managed object! 8: Network Management

USM Timeliness Mechanisms USM includes a set of timeliness mechanisms to guard against message delay and message replay. If a message is considered to be outside of the time window, then the message is considered not authentic, and an error indication is returned to the calling module. Timeliness checking is done only if the authentication service is in use and the message is authentic, assuring the validity of the message header fields. 8: Network Management

8: Network Management

Key localization For the use of the authentication and privacy services it is required that a secret authentication key and a secret privacy key must be used for communications. The keys can be generated from the user password using a special algorithm. A single password could be used to generate a single key for both authentication and encryption. A more secure scheme is to use two passwords and to generate two different keys. A localized key is a secret key shared between a user and a remote SNMP engine. The process by which a single user key is converted into multiple unique keys is called key localization. 8: Network Management

Key Localization Process 8: Network Management

View-Based Access Control Model (VACM) VACM has two characteristics: Determines whether access to a managed object should be allowed. Make use of an MIB that: Defines the access control policy for this agent. Makes it possible for remote configuration to be used. 8: Network Management

Elements of the VACM Model Group – a set of <securityModel, securityName> tuples on whose behalf objects can be accessed MIB context - named subset of the object instances in the local MIB MIB view – specific set of of managed objects Access policy – particular set of access rights (read, write, notify) 8: Network Management

Access determination depends on: Principal making the access request Security level requested Security model MIB context for the request Object instance for which access is requested Type of access requested (read, write notify) 8: Network Management

Access control processing 8: Network Management

Motivation for VACM In SNMPv1 the security related information is lumped into a single variable – community. By this flexibility and functionality are lost. VACM provides the same set of security related information using distinct variables for each item. This is substantial improvement over SNMPV1. It uncouples various concepts so that values can be assigned to each one separately. 8: Network Management