1. Implementing a Highly Available Network
Implementing Network Monitoring
Implementing a Highly Available Network

2. Network Management Overview

3. Syslog Overview
Allows software subsystems to report and save important error messages either locally or to a remote logging server.
Can send messages on UDP port 514.
Provides very comprehensive reporting mechanism in plain English text.
Logging messages on console, terminal session, buffer, and syslog server.

4. Syslog Features Devices produce syslog messages.
Syslog messages contain level and facility.
Common syslog facilities: IP
OSPF protocol
SYS operating system
IP Security (IPsec)
Route Switch Processor (RSP)
Interface
Syslog levels:
Emergency (level 0, highest level)
Alert (level 1)
Critical (level 2)
Error (level 3)
Warning (level 4)
Notice (level 5)
Informational (level 6)
Debugging (level 7)

5. Cisco Syslog Message Standard
Documentation for each release explains the meaning of the messages.

6. Example: Syslog Messages
08:01:13: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/5, changed state to up
08:01:23: %DUAL-5-NBRCHANGE: EIGRP-IPv4:(1) 1: Neighbor (Vlan1) is up: new adjacency
08:02:31: %LINK-3-UPDOWN: Interface FastEthernet0/8, changed state to up
08:18:20: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/5, changed state to down
08:18:22: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/5, changed state to up
08:18:24: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/2, changed state to down
08:18:24: %ILPOWER-5-IEEE_DISCONNECT: Interface Fa0/2: PD removed
08:18:26: %LINK-3-UPDOWN: Interface FastEthernet0/2, changed state to down
08:19:49: %ILPOWER-7-DETECT: Interface Fa0/2: Power Device detected: Cisco PD
08:19:53: %LINK-3-UPDOWN: Interface FastEthernet0/2, changed state to up
08:19:53: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/2, changed state to up
08:27:42: %SYS-5-CONFIG_I: Configured from console by vty1 ( )
08:29:32: %ILPOWER-7-DETECT: Interface Fa0/3: Power Device detected: IEEE PD
08:29:36: %LINK-3-UPDOWN: Interface FastEthernet0/3, changed state to up
08:29:36: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/3, changed state to up
08:31:19: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/5, changed state to down
08:31:21: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/5, changed state to up

7. System Log Configuration
sw(config)# logging server_ip_address
Sw(config)# logging trap level
Configures a syslog server and the logging level
Configures the system local log
Displays the local logs
sw(config)# logging buffered [buffer_size] [alarm_level]
sw# show logging ?
count Show counts of each logging message
history Show the contents of syslog history table
onboard Onboard logging information
xml Show the contents of XML logging buffer
| Output modifiers

8. SNMP Overview Manager: SNMP: Agent: MIB: Polls agents on the network
Correlates and displays information
SNMP:
Supports message exchange
Runs on IP
Agent:
Collects and stores information
Responds to manager requests for information
Generates traps
MIB:
Database of objects (information variables)
Read and write community strings for controlling access

9. About SNMPv2 SNMPv2c defined in RFC 1901 SNMPv2 new features:
Get Bulk Request
Inform Request (acknowledged trap)
Data types with 64-bit values

10. About SNMPv3 RFCs 3410 through 3415 Authentication and privacy
Authorization and access control
Usernames and key management
Remotely configurable via SNMP operations

11. SNMP Recommendations Configure ACKs for SNMP community strings.
Restricts SNMP traffic to addresses in ACL.
Use SNMPv3 if possible.
Provides authentication and encryption.

12. SNMP Configuration Configure SNMP community strings.
Configure SNMP access lists.
Configure SNMP trap receiver.
Configure SNMPv3 user.
sw(config)# access-list 100 permit ip any
sw(config)# snmp-server community cisco RO 100
sw(config)# snmp-server community xyz123 RW 100
sw(config)# snmp-server trap

13. SLA Review
Companies need predictability in IP services as networks becoming increasingly important.
An SLA is a contract between the provider and its customers:
Provides a guarantee of service level.
Specifies connectivity and performance agreements for an end-user service.
Supports problem isolation and network planning.

14. IP SLA Measurements

15. IP SLA Operations
Operation is a measurement including protocol, frequency, traps, and thresholds.
Network manager defines UDP or TCP port for each IP SLA measurement operation.
IP SLAs can send traffic with different DSCP values.
IP SLA control protocol is used between source and responder.
MD5 authentication is supported between source and responder.
Results are stored on IP SLA source in the IP SLA MIB.

16. IP SLA Source and Responder
Cisco IOS Software device that sends data for operation.
Target device may or may not be a Cisco IOS Software device.
Some operations require an IP SLA responder.
IP SLA source stores results in MIB.
IP SLA responder
Greater measurement accuracy is available between an IP SLA source and responder.
IP SLA responder is a Cisco IOS Software device that is configured to respond to IP SLA packets that are based on the ip sla monitor responder configuration command.

17. IP SLA Operation with Responder

18. IP SLA Responder Time Stamps
IP SLA responder takes two time stamps (T2 and T3).
IP SLA responder factors out destination processing time, making results highly accurate.
IP SLA responder allows for one-way measurements for latency, jitter, and packet loss.

19. IP SLA Configuration Configure IP SLA probe. Activate probe.
Configure tracking object.
Configure action on tracking object.
Exact syntax depends on platform and on Cisco IOS version.

20. IP SLA Verification
Displays status of the IP SLA test, and its successes and failures. Show ip sla configuration can also be used to display details of the IP SLA test that was conducted.
sw# show ip sla statistics
Round Trip Time (RTT) for Index 1
Latest RTT: NoConnection/Busy/Timeout
Latest operation start time: 11:11: eastern Thu Jul
Latest operation return code: Timeout
Over thresholds occurred: FALSE
Number of successes: 177
Number of failures: 6
Operation time to live: Forever
Operational state of entry: Active
Last time this entry was reset: Never

21. Summary
Redundancy can be achieved at Layer 2 and at Layer 3 by providing additional redundant paths between devices.
Syslog and SNMP are used to monitor device status.
In IP SLA deployments, IP SLA measurements are performed between an IP SLA source and a destination (IP host or IP SLA responder).