View
214
Download
0
Tags:
Embed Size (px)
Citation preview
Network Management
Jacques Labetoulle
Professor at Institut Eurécom
Overview• 1st part : Introduction
– Definition– Architectures and functions– Network Planning
• 2nd part : standards– Introduction to Object Oriented Approach– OSI standards – Internet standards– Comparison– The TMN
• 3rt part : platforms and products• 4th part : Perspectives
– CORBA and network management– Other approaches (Web, agents, ...)
Introduction
• Definition and motivations
• Support architecture
• Management domains
• Network planning
Network Management
• DefinitionIt is the set of all techniques to implement in order to master the technical, financial, organizational aspects of a private network as well as the access and
information security.
• Some key words- technical area : quality of service
continuity of service
- financial area : truth of the prices
- organizational area: control of the structure and evolutions
- security area : confidentiality
access control
The network in the enterprise
• Strategically important– finance (air plane reservations )
– security (bank transfers)
– service (bank notes distributors )
– competition (stock management)
• Service obligations– continuity of service
– quality of service
– adaptability (on demand evolutions)
– cost control
Complexity of networks
• Network evolutions
centralized networks ---> distributed networks
homogeneous networks ---> heterogeneous networks
separated networks ---> integrated networks
• Evolution of network utilization– generalization to all kind of personal
– opening to external clients or people
– multiplicity of services
Networks elements in a corporatenetwork
• Multiplicity of kinds of equipmentcommunication controllers
end of line equipment
multiplexers
PABX
LAN
interconnection equipment
interconnection networks
packet switches
computer manufacturers architectures
public networks and services • Multiplicity of providers• Rapid technological evolutions
Why to manage a network?
• Economical reasons– excessive global costs (> 1% of cash flow)
– increase of network budget (20% per year)
– tractability of prices
(multiplicity of services and evolutions)
• Complexity increase – offers from operators
– generalization of local area networks
– sophistication of equipment
• Pressure from the users• Internetworking with other networks
Management areas
Functional domain
manufacturers
Voice
Data
Computer networks
Integrated networks
Perf
orm
ance
Secu
rity
Faul t
s
Confi
gura
tion
Acc
ounti
ngAlcatel
BullIBM
TRTMatra
SAT
LAN
ATM
Network Management today
• 1- It exists
• 2- It is not satisfactory
• No coherent offer
– from network operators– from manufacturers– from service providers
• Non-adapted standardization
Network Management today
• Diversity of solutions : a large variety of proprietary systems characterized by:
– limitation of management domains --> partial visions– very different ergonomics --> problems of qualification of
people– functional limitations --> partial control of networks
(faults, performance) – communication difficulties --> partial and local visions
multiplicity of work stations– A few intelligence in systems --> necessity of highly qualified persons
Network Management tomorrow
• Universal workstations
– high ergonomics
– remote management
– multiples visions
– adaptation of functions to needs
– help systems
– automation
– possibilities for evolution and adaptations
• An adapted standardization
• Integration of new techniques
Users’ point of view
• Coverage of the solution and integration– the whole enterprise (and not only the headquarters)
– integration : network, systems, applications, services
– integration : all kinds of elements (voice, data, ...)
• To day advance– very variable
• Partners– manufacturers, software editors
• Difficulties (by order of importance)– training,
– performance of the offer,
– interoperability
– ... cost
Introduction
• Definition and motivations
• Support architecture
• Management domains
• Network planning
Principles for an architecture
• A logical architecture
– definition of elements• A physical architecture
– how to connect elements• A set of functions
– definition of usage• A methodology
– conception, evolution of the management system
Architecture
Integrator machine
EMSEMSEMS
Othermanagement
systems
(PNO) Integrator machine
Integrator machine
Agent Agent Agent Agent Agent AgentAgentAgent
Architecture : the EMS's
• Close vision of a sub-area• Proprietary interfaces with equipment (now)• Normalized interfaces with the integrator• Independence from manufacturers and equipment• Possibility of "migration" of functions between Integrator and EMS's
Architecture : the work stations
• High quality ergonomic
• Specialization of operators
- access security
- control of different visions
• Direct access to information
Architecture : The integrator system
• A set of functions- for universal needs
- easy adaptations
• flexibility (centralization/distribution)• Basic components
- exchange procedures
- man/machine interface management
- information system
- functions
- intelligent systems
Architecture : The integrator system
• A sufficient vision of problems
- notion of "view" of sub-networks
• Reasonable performance
- installation dimensioning
- portability on a set of machines
Introduction
• Definition and motivations
• support Architecture
• Management domains
• Network planning
Classification of functionsreal time / differed time activities
• Real time activities
- behavior supervision
- detection of incidents, fault diagnostic
- launching of rerouting procedures , maintenance, etc.
- access control to services and resources
• Differed time activities
- network configuration management
- access and security rights management
- financial management : cost affectation , bill verification
- edition of statistics and dash boards
- planning, simulation
Classification of functionsareas breakdown
• 5 areas defined by OSI
- Configuration management
- fault management
- Performance management
- accounting
- Security management
configuration management
• Management of the Information base (MIB)
- Inventory of network elements
- Management of names of managed elements
- add, delete, change of network components
- Initialization and modification of parameters, states, ...
- Modification, creation, suppression of relations between managed elements
• Network visualization
- Global visualization
- Geographical Zooms
- Sub-networks visualization
- On demand display of managed elements characteristics
Configuration management(continued)
• Reconfiguration
- Activation of stand by configurations
- resources re-affectations
- Remote software loading
- Edition of operational state modifications
- History of reconfigurations
• Creation of directories
- Directory of offered services
- Directory of users
- Directory of furnishers
Fault management
• Fault detection
- Creation of misbehavior reports
- Management of counters and alarm thresholds
- Event filtering (elimination of redundant information)
- disfonctionnement display
• Fault localization
- Analysis of alarm reports
- Launching of measurements and tests
==> Computer assisted diagnosis
• Initialization of corrective actions
- Resource re-affectations
- Re-routings
- Traffic limitations ==> Decision support system
- calling to maintenance
Fault management (continued)
• Equipment recovering
- Launching of behavior tests
- Backup systems management
• Recording of fault histories
("trouble tickets")
• Establishment of statistics
- breakdown probabilities
- duration of incidents
- Duration of repairing
• Interface with users
- signaling of incidents by users
- information to users
Accounting• Resource usage measurement
- Recording
- Creation and management of record files
• Control of quotas by user
- establishment of current consumption
- Verification of consumption authorizations
• Follow up and control of expenses
- recording of up to date tariffs (from operators)
- management of taxation tickets
- real time evaluation of current consumption
- bill control
- follow up of equipment costs
(investments, deadening, maintenance)
- follow up of exploitation costs
Accounting (continued)
• Financial management
- cost splitting
(by service, by user, by application)
- Analysis and prevision of expenses
- Study of scenarios for cost minimization• Internal billing
- Management of users
- Management of tariffs
- Creation of taxation tickets and bills
- Bill control
- Recording of historic
Security management
• Security of Network Management
- Management of access rights to working stations
- Management of operator "views"
- Access control to management information
• Access control to the managed network
- Functions dedicated to the mechanisms :
definition of usage conditions
activation/deactivation of mechanisms
modification of parameters
management of authorization lists
(to machines, services, network elements)
Security management (continued)
- Tracking of access (identity, time, destination)
- Detection of fraudulent access attempts
recording
statistics
setting of alarms• Information Security
- Management of protection mechanisms
- Management of encryption and decryption keys
- fault detection
- Detection of fraudulent attempts
Performance management (Real time)
• Recording of performance measurements
- Definition of measurement conditions criteria
- Management of information collecting and filtering
- Establishment of statistics
- Launching of on demand measurements
- Management of information files
• Monitoring of network behavior
- Visualization resource utilization
- Signaling of threshold overpass
Performance management Real time (continued)
• Performance measurement analysis
- Network behavior
load repartition
throughputs
response times
availability
- Analysis of probable reasons of threshold overpass
correlation with equipment faults
indicators comparison and correlation
==> computer aided system
Performance managementReal time (continued)
• Corrective and preventive actions
- Resource re-affectation
modification of configuration parameters
traffic routing optimization
- Traffic Limitations
filtering, priorities
- Choice of action mode ==> computer aided system
• Follow up of actions results
- Recording of historic
- Analysis of action efficiency, definition of rules
Performance managementDiffered time
• Information analysis
- Establishment of statistics and historic
- Establishment of quality of service indicators
- Edition of reports (periodically or on demand)
- Edition of dash boards
• Provisional analysis
- Elaboration of traffic matrices
- Evaluation of performance
detection of saturation risks
simulation of scenarios
==> improvement of the QoS
balancing of resource utilization
- Network planning et dimensioning
- Follow up of corrective management
Other management areas
• Planning (see later)
• Park management (inventories, catalogue, installations, ...)
• Cabling management
• License management• Host management (users, disks, versions, ...)
Introduction
• Definition and motivations
• support Architecture
• Management domains
• Network planning
Time scales
Scale operations actions
minutes supervision observation of network
real time management problem detection
corrective actions
hours day to day maintenance
days management statistics (performance, traffic)
configuration programmed operations
security installations
Time scalesweeks operation management purchases
months financial management billing
corrective management re-dimension
modifications (routings, ...)
year short term topological evolutions
planning dimensioning, routings, ...
choice of support services annual budgets
> 1 year Strategic or strategic decisions
long term planning choice of target structures evolution towards these
structures
evolution plans
Important steps
• Evaluation of traffic needs
• Choice of a target structure
• Choice of support services
• Dimensioning and optimization
• Verification
Traffic needs
Problem : find an adequate traffic representation
• telephony : volumes easy to measure
notion of heavy load hour (per site, per link, ...)
traffic measure : the Erlang
• data : measure unit : packets, transferred octets, bandwidth needs
Often : global measures (heavy load hour, possibility of differed transfers, ...)
Do not forget protocol’s overheads!
Traffic needs
• Empirical rules : heavy load hours :
20% of the daily traffic on 8 hours
or 16% for 12 hours ; or 14% for 24 hours
heavy load hour traffic = 2,5 times the mean hourly traffic
mean traffic at heavy hours : V/3600 (in bit/s or messages/s)
• Other method : calculate the traffics per hour (no heavy hour traffic problem)
Evaluation of traffic needs
• 1- Extrapolation of traffic matrices
– organize measurement campaigns (per week, month, year, ...)
– calculate representatives values, per period• global volumes
• heavy hour volumes
– utilize mathematical techniques for chronological series extrapolation (linear regressions, Kalman filtering, ...)
– correct, taking into consideration the impact of new services
– Can use directly network management measures and techniques.
Evaluation of traffic needs
• 2- Direct analysis of flows
– analysis of the structure of the enterprise (types of entities, organization levels, ...)
– analysis of the relations and applications used
– evaluate elementary flows and integrate them
– how to proceed : inquiries
– necessity of a validation (by direct measurement of existing flows)
Choice of a target structure• Problem
– Determine main orientations (strategic choices) :• meshed or star network
• where to implement transit centers
– choice of structures from the market (manufacturer networks, private network, based on PNO’s networks and services , security aspects , redundancy, ...)
– fundamental technological choices : kind of LAN, migration towards ATM
• Remark : mixing of technical and political problems
Choice of a target structure• Problem : determination of the basis of the solution
– Start from the needs, characterized by – traffic volumes and characterization (sporadic, interactive, big
transfers, ...)
– constraints : costs, performance, security
– offers : technical constraints , tariffs, performance, easy of use, ...
• Method : a lot of logic and common sense– take into account scales economy– integrate traffics leads to economies– use of elementary rules
• regular traffics ===> dedicated networks
• sporadic traffics ===> switched networks
• variable traffics ===> virtual private networks
– look carefully at pricing principles
Dimensioning and optimization
Basic techniques
1- Inversion of performance evaluation formulas
telephone networks :
B(A,N) = Erl (A,N) = AN/N! / (1+A+A2/2+ ....+ AN/N!)
data links (Kleinrock’s independence assumption) :
W = 1/(Ci - Di)
• In fact, dimensioning is often made by using a maximum utilization factor (60 or 70% of capacity).
Dimensioning and optimization (follow up)
2- Economical optimization
formalize the problem as an objective function minimization problem (the cost), subject to constraints (arcs and nodes capacity, performance, ...)
elementary costs may depend on non trivial functions (step functions)
To solve the problem : OR techniques (linear or integer numbers programming, ...., simulated annealing).
in general, problems are NP-complete and can be solved only by heuristics
• Results of this step : a dimensioned network, the routings, installation and exploitation costs (monthly costs, maintenance costs, ...)
Dimensioning and optimization Example of a formalization problem
• Min C = Cj ej + Ci,j ei,j + CRj ej
installation of a concentrator in j ; cost of the link between i and j ; cost of the link from the concentrator j to the central node.
ei : 1 if a concentrator in j, 0 if not
ei,j : 1 if site i is linked to site j (concentrator’s location) ,
0 if not
With the constraints :
i ei,j = capa capacity of the concentrator
j ei,j = 1 only 1 link between two sites
j ei,j ej= 1 each link towards a site with a concentrator
Verification of the solution
• The solution needs to be validated :– simplifies assumptions (performance)
– necessity to validate for each time slot
• How to proceed :– analytical methods (queuing theory)
– event driven simulation (also useful to analyze evolutions of the networks)
Standards
• The object oriented approach
• The OSI standards• SNMP
Encapsulation
METHODS FIELDS
INTERFACE
Classes
Two components:
• static component : the data, composed of fields. They characterize the state of the objects during execution.
• dynamical component : procedures called methods. They represent the common behavior of the objects belonging to the same class. The methods manipulate the fields et characterize the actions done by the objects.
Example of a class
• Class Article
• Fields referencedesignationpriceHT (excluding VAT)quantity
• Methods PriceTTC (): return (1.186 * priceHT)transportPrice (): return (0.05 * priceHT)retire (q) quantity <---- quantity - qadd (q) quantity <---- quantity + q
Instantiation
• The class describes the object
• It is used as a model to build instances
• The list of the fields is hold by the class
• Instances have values
• Methods are not duplicated
Example of instantiation
Article
reference
designationpriceHT
quantity
priceTTCtransportPrice
retireadd
30341
kimono
495.00
1000
60021
portable TV
2480.00
100
Instance of Instance of
Inheritance
• Gathering of common characteristics to several classes
• Classes are specialized by defining sub-classes
• A sub-class shares variables and methods of its super-class
• It inherit the properties of its super-class
• Two techniques can be used :– enrichment : new variables and/or new methods are added
– substitution : a method is redefined
Example of inheritance
• Classclothes
• SuperclassArticle
• Instance variablessizecolor
• Methods
• ClasseArticleDeLuxe
• SuperclassArticle
• Instance variable
• MethodspriceTTC () : return (1.25*priceHT)
Inheritance graph
• The inheritance relation links a class to its super-class
• The graphical representation of this relation builds the inheritance graph
• The inheritance relation is transitive
• The word superclass designates any class from which a class inherits
• The structuring with classes brings an important modularity
• Most of OO languages behave predefined libraries of classes
• For example in Smalltalk-80 : LinkedList, Form (graphical objects), Process, Semaphore, ...
Inheritance graph
OBJECT
Article
referencedesignation
priceHTquantityprixTTC
transportPriceretireadd
ElectroMénager ArticleDeLuxe Clothesguarantyweight
priceTTC colorsize
AspiratornoiceLevelthroughput
Téléviseurtypetube
screenwidth
FreshCaviar origin
weight
Shirtshape
pocketNr
Inheritance graph
• Simple inheritance– The inheritance graph is a tree
– It determines a total order
• Multiple inheritance– A class can have several direct superclasses
– Not a tree, but an oriented graph
– Some classes can be created to be used as "inheritance reservoir". They are not instantiated. In some languages, they are called abstract classes.
– Advantages : improve modularity and avoid duplications
Multiple inheritance
OBJET
Articleréférence
désignationprixHT
quantitéretirerajouter
Transporttypeemballagedatelivraisonprixtransport
Alimélectriquevoltage
impédencepuissance
consommation
Fragileprixtransport
Périssabletempératureprixtransport
Electroménagerduréegarantie
poidsvaliditégarantie
ArticledeluxeprixTTC
Crèmeriedatelimite
Vêtementcoloristaille
Aspirateurniveausonorerayonaction
débitdépression
Téléviseurtypetube
largeurécrantélécommande
Caviarfraisprovenance
poids
Œufsprovenance
Chemisetypecol
typemanchesnbpoches
Relation «is a»
Electroménagerduréegarantie
poidsvaliditégarantie
ArticledeluxeprixTTC
OBJETArticleréférence
désignationprixHT
quantitéprixTTCretirerajouter
Crèmeriedatelimite
Aspirateurniveausonorerayonaction
débitdépression
Téléviseurtypetube
largeurécrantélécommande
Caviarfraisprovenance
poids
Œufsprovenance
Chemisetypecol
typemanchesnbpoches
Vêtementcoloristaille
Périssabletempératureprixtransport
Fragileprixtransport
Transporttypeemballagedatelivraisonprixtransport
Which method to apply?
• Simple inheritance– The inheritance graph reduces to an ordered list.
– The method is found by looking at this list from the bottom.
• Example :Method priceTTC for the class TV :
Inheritance tree of the class :
TV, Article DeLuxe, Article, Object
The selected method is taken in ArticleDeLuxe
Which method to apply?
• multiple inheritance
• The inheritance graph of a class is a graph.
• So there may be a conflict!
E
A
BC
D
D
A
B C
M
M
M
MM
D
A
B C MM
1: no conflict 2: conflict between B and C3: conflict between B and C
Message transmission
• An object cannot directly react on one another.
• It only can activate a method of the target object.
• To do that, he sends a message
• Sending of messages is the only communication mean between objects.
• The reception of a message leads to the research of the method to apply in the environment of the object.
• When the method delivers a result, this one is returned to the sender (transmission with return).
Main OO languages
• Smalltalk-80
• Objective-C LISP and object oriented derivations
(Le-Lisp, Flavors, Ceyx, ObjVLISP,...)
• SIMULA
• C++
• Eiffel
• ADA
• and JAVA!
Notion of view
Lightings
A B
C D
E
Objects
Object in NM
Element
Object
Interface
Object in NM
Newelement
ObjectInterface
Old appli
newappli
Newcharacteristics
Object in NM
• OSI protocol (CMIP)– classical object + specific characteristics
• Internet protocol (SNMP)– no inheritance
– only simple variables
• Other approaches– IDL CORBA
– Java
Standards
• The object oriented approach
• The OSI standards
• SNMP
StandardizationThe ISO model
• General framework
- included in Part 4 of the general ISO reference model
- specify the procedures for managing an heterogeneous network
- define the architectural framework
• Objectives
"plan, coordinate, organize, control and supervise the resources used in the communications in agreement with the ISO model and report on their utilization"
OSI standards
Basic reference modelISO 7298
General frameworkISO 7498-4
General overviewISO 10040
- Configuration management- Fault management
- Performance management- Accounting
- Security management
Definition of the specific management functionsISO 10164 : 1 à n
Structure of the Management Information
BaseISO 10165 - 1
Generic definitions of objets and their
attributesISO 10165 - 2
Framework for objects definitions
ISO 10165 - 4
Definition of specific managed objects
CMISISO 9595
CMIPCommon Managementinformation Protocol
Three models
• Organisational model
• Information model or MIB
• Functional model
The organizational model
• Define the framework to distribute the management
* uses the concepts of "management system" and "managed system or agent"
* The DMAP (Distributed management application process) is the application which controls and supervises the managed objects .
* The Agent Process allows the local management .
Organisation scheme
ManagementSystem
Manage-mentprocess
CMISE CMISECMIP
Agentprocess
Functions
Managedobjects
D
ManagedSystem
Management of objects
Managed object
Attributes
Operation
Notification
Operation : activated by orders sent to the class ( instance creation ) or to the object (method activation )
Notification : activated by the class or the object which send messages (state changes, thresholds overpass
Three models
• The Information model or MIB (Management Information Base)
* document ISO 10165-1
* it is a management information base , which must contain , in a structured manner, the set of all the managed objects, andthe information allowing their identification .
* the managed objects : all the resources used in an ISO communication. They are all defined with their attributes, methods, the messages they emit, the operations they can execute.
* the management information tree (MIT) represents the hierarchy of objects
Three models
• The functional model
* the ISO management is decomposed in 5 tasks :- fault management- configuration management- accounting- performance management- security management
Three management levels
• The system-management level
relies on information exchanges from all the protocol layers (ISO model)
• The layer-management level
- the management is restricted to a given layer (it relies on the services offered by lower layers)
- example : the Network Connection Management Subsystem (NCMS) which specifies a connection management sub-protocol (ISO 8073/AD1)
• The layer operations level
the management is realized by information exchanges within the layer protocol
The information model
• An object oriented approach– a description language
– an exchange language
• Principles– naming
– registration
• Libraries
The information model
• Objective : to allow the definition of managed objects in a standard way.
- coherence of definitions
- coherence with the management environment
(CMIP and functions)
- work repartition
The information model
• The model defines :
- what is an object
- of what it is composed
- what it can do
- what can be done on it
- how it is named in the protocol
- how it is linked to other objects
The information model Description of objects
- the attributes
- the methods
- the relations
- the conditional packages
- the containment tree
- the allomorphism
Description tool
• GDMO templates– MANAGED OBJECT CLASS : definition of a class
– PACKAGE
– PARAMETER
– NAME BINDING
– ATTRIBUTE
– GROUP-ATTRIBUTE
– BEHAVIOUR
– ACTION
– NOTIFICATION
Template "MANAGED OBJECT CLASS"
<class-label> MANAGED OBJECT CLASS
[DERIVED FROM <class-label>[,<class-label>]*;
]
[CHARACTERIZED BY <package-label>[,<package-label>]*;
]
[CONDITIONAL PACKAGES <package-label>PRESENT IF
<condition-definition>
[,<package-label>PRESENTIF<condition-definition>]*;
]
[PARAMETERS <parameter-label>[,<parameter-label>]*;
]
REGISTRETED AS object-identifier;
Example of a class
exampleObjectClass MANAGED OBJECT CLASS
DERIVED FROM "Rec. X.721 | ISO/IEC 10165-2 : 1992" : top;
CHARACTERIZED BY
examplePackage2 CONDITIONAL PACKAGE
examplePackage1 PACKAGE
ACTIONS qOSResetAction;
NOTIFICATION communicationError ;
REGISTRED AS {joint-iso-ccitt ms(9) smi(3) part4(4)package(4)examplepack1(0)};
PRESENT IF !conformance class 2 of underlying ressource implemented as descriptor in ISO/IEC xxxx! ;
REGISTRED AS {joint-iso-ccitt ms(9) smi(3) part4(4)managedObjectClass(3)exampleclass(0)} ;
The information model Description of objects
• Definition of information
- List of generic objects - TOP- DISCRIMINATOR- ...
- List of object classes specific to some functions- SUMMURIZATION REQUEST OBJECT- ...
- List of attributes types - COUNTERS- THRESHOLDS- ...
- List of operations, notifications, ...
Description tool
• ASN.1 (Abstract Syntax Notation 1)– It is a language defined by its grammar (cf ISO 8824)
– A grammar is a set of production rules
• The role of ASN.1– 1 Description of data structures
– 2 Allow transmission of these structures through the ISO stack
• Utilization mode – 1 describe objects in ASN.1 (following the formalism of GDMO templates)
– 2 use a "compiler" towards the development language (C, ADA, Pascal, ...) to generate :
* adapted data structures
* encoding rules to the transfer syntax
Thus, encoded ASN.1 will be transferred through the network.
The use of ASN.1
Entity A Entity B
transfert syntaxe
DescriptionASN1
data structure data structure
Encoding/decodingrules
Naming
• The containment tree– defines notions of contained and containing classes
– defines constraints for the naming process
• Naming tree– respects constraints of the registration tree
– defines a global name for each object
the Global Distinguished Name (GDN)
– allows the use of “local” names
Distinguished Name
Four trees
• Inheritance tree: properties of classes
• Containment tree: containment constraints for the naming process (defined within classes)
• Naming tree: for identification of objects (or instances)
• Registration tree: to reference classes (or constituents of classes, e.g. templates)
The inheritance tree
modem
boardswitchX25LAN
network equipment
top
The containment tree
root
network
equipment
The naming tree
station X station Y station Z station X station Z
LAN 1 routeur 1 network B LAN 2
network A
root
Name of objects :"networkA, LAN1, stationX""networkA, LAN2, stationX"
The registration tree
root (world)
ccitt iso joint-iso-ccitt
std reg member org authority body
dod
internet
directory mgmt experimental private
entreprises
reserved proteon ibm hp
021
01 2
3
6
1
12 3 4
1
01 2 11
MIB-1 MIB-2
1 2
Important remarks
All object classes must be registered by a competent authority.
The conformity will be verified using the MOCS (Management Objects Conformance Statements)
The standardization process does nor provide any help for the conception of the object model.
A set of generic object libraries are provided. These objects need to be extended (by the inheritance process).
The object TOPtop MANAGED OBJECT CLASS
CHARACTERIZED BY topPackage PACKAGE
BEHAVIOUR topBehaviour;
ObjectClass GET,
nameBinding GET;;;
CONDITIONAL PACKAGES packagesPAckage PACKAGE
ATTRIBUTES packages GET;
REGISTERED AS {smi2Package 16};
PRESENT IF "any REGISTERED package, other than this package has been instancied",
allamorphicPackage PACKAGE
ATTRIBUTES allomorphs GET;
REGISTERED AS {Smi2Package 17};
PRESENT IF "if an object supports allomorphism";
REGISTERED AS {smi2MObjectClass 14};
topBehaviour BEHAVIOUR DEFINED AS "This is the top level of managed object class hierarchy and every other managed objet class is a specialization of either this generic class (top) or a specialization of a subclass of top..."
Example : system object
system MANAGED OBJECT CLASS
DERIVED FROM top;
CHARACTERIZED BY
systemPackage PACKAGE
ATTRIBUTES systemId GET,
systemTitle GET,
operationalState GET,
usageState GET,
administrativeState GET-REPLACE;;;
CONDITIONAL PACKAGES
administrativeStatePackage PACKAGE
ATTRIBUTES administratoveState GET-REPLACE;
REGISTERED AS {smi2Package14};
PRESENT IF "an instance supports it",
....
The functional model
• Definition of 5 management domains
• Definition of SMFsSystem Management Functions
SMF : System Management Functions
• Objective :
Specification of management interfaces, based on the manager/agent model.
• Means :
Two aspects are necessary :
- the object model (managed resources , their properties, relations, operations)
- the accesses to the objects (access control , selections, coordination of elementary operation , timing...)
• Definition :
A SMF is a standard which describes object classes or properties of objets that can be used to perform management functions. It standardizes the protocol aspects of these services.
SMF : System Management Functions (continued)
• Content : three aspects- semantics of the properties and/or support objects
example : alarm types
objects Log, LogRecord
- description of the access services to these basic properties (procedures)
example : mapping on the services of CMISE
- syntax to support these definitions (GDMO templates and ASN.1 production rules )
• Relations between SMF's
A SMF can use the services defined in other SMF's
SMF : System Management Functions (continued)
• Functional units - A SMFU defines a set of properties (management services) that objects of a system can offer to a manager using an association. They can be negotiated when initializing the association.
- Example:
The object management defines two SMFU's :
- operations services
- notification services
The log management defines one SMFU
The states management does not defines a SMFU (cannot be negotiated )
• Remark :- A SMF is not a function in itself. The services described by a SMF are introduced to be integrated in a management interface. They can be used by objects from different classes.
SFM’s principle
Object
Management Interface
(CMISE)
SFM’s principleObject
Managementinterface(CMISE)
object
SMF Interface(enriched)
List of the SMF
Object Managt Function IS Workload Monitoring Function DIS
State Managt Function IS Test Management Function DIS
Attributes for Relationships IS Summarization Function CD
Alarm reporting IS Confidence and Diagnostic Test CD
Event Report Function IS Time Management WD
Log Control Function IS OSI software Management WD
Security Alarm Reporting Funct. IS
Security Audit trail Function DIS
Objects and Attributes for Access CD
Accounting Meter Function CD
Scheduling Function WD
Response Time Monitoring
Event Report Get Set Action
Create DeleteCancel-Get
ObjectManagement
StateManagement
RelationshipManagement
Alarmreporting
Event-reportmanagement
Logcontrol
Security-alarmreporting
Securityaudit trail
Accesscontrol
Accountingmeter
Workloadmonitoring
Testmanagement
Summarization
Faultmanagement
Accountingmanagement
Configurationmanagement
Performancemanagement
Securitymanagement
Specific Management Functions
State Management Function
• Attributes- Management attributes
* Operational state In service
Out of service
* Utilization state Free (non used)
Active (usable)
Occupied (not usable any more)
Unknown (from the object)
* Administrative state Blocked (by the manager)
Unblocked ( " )
Becoming free
- Maintenance attributes (STATUS)
* Repair status (in repair, alarm..)
* Installation status (being installed)
* Availability status (in test, out of service, out of tension...)
* Control status (reserved, suspended...)
State Management Function (continued)
• Notifications- State Change notification
with parameters :
state change info (state attribute)
additional state change info
• Object
- state change record
Specialization of the class "Event Log Record" with notification parameters (above)
• Offered services - State Change Reporting Service M-EVENT-REPORT
- State attribute read PT-GET
- State Attribute Modify PT-GET
CMISE/CMIP
• CMISE services– Interactions with object interfaces
(read, write, creation, instances destruction, ...)
– Utilization of naming principles
– Multiple object selection
– Multiples actions (atomicity)
CMISE(Common management Information
Service Element)
CMISE services
They are classified in two categories:
• the operation services : invocation of requests sent to an agent (concerning objects managed by this agent),
• a notification service : transmission by an agent of a report containing a notification emitted by an object.
CMISE services (continued)
Operation/notification Service Mode
Get attribute value M-GET confirmed
M-CANCEL-GET confirmed
Replace attribute value
Replace with default value
Add member M-SET conf/non-conf
Remove member
Create M-CREATE confirmed
Delete M-DELETE confirmed
Action M-ACTION conf/non-conf
Notification M-EVENT-REPORT conf/non-conf
(Common management InformationService Element)
CMISE services: M-CREATE
• Specific parameters
- superior object instance
- reference object instance
• Service
- naming : ie definition of the GDN (Global Distinguished Name)
--> choice of the superior in the naming
choice of the RDN (Relative Distinguished Name)
Example : M_CREATE
- M-CREATE uses 3 specific parameters:
- MOC (Managed object Class) - its class
- MOI (Managed Object Instance) - its GDN
- SOI (Superior Object Instance) - the GDN of the superior
- The manager has three options : it can send
- MOC and MOI
- MOC and SOI
- MOC
- In any case, the agent will return MOC and MOI
- Valorization of attributes
The values given to attributes have higher priorities than the default values of the class or the values of a referenced object.
Multiple object selection
-1
-2
-3
ScopingFiltering(attributes values)
CMIP
• ISO layer 7 protocol
• Supports remote CMISE operations
• Is integrated in an association (cf ACSE)– negotiation of the association (partners, functional units , ...)
– closure of the association
• Is built on ROSE services(remote operation invocation)
Implementations
• Normaly : on ISO stack (layers 1 to 6)
• Possible on TCP stack (CMOT)
• Possibly on LLC (with adaptations), and CMOL or LMMP
Standards
• The object oriented approach• The OSI standards
• SNMP
Network Management within Internet
• An organizational scheme
• An information system
• A protocol
• But :– no functional aspect
– no object oriented approach
– simplified mechanisms (naming, ...)
The model
Three components in the network management model :
• several managed nodes. One agent in each one. • one or several Network Management Stations (or NMS)• a protocol for the exchange of management information
The "Internet-standard Network Management Framework" describes the basic principles of the Internet network management
The managed nodesthree types are possible:• host system (work station , server, printer...)• gateway• transmission medium (bridge, multiplexer...)Architecture
MANAGEMENT PROTOCOL
"USEFUL"
PROTOCOLS
Network
Instrumen-tation
The management stations
• They are host systems containing :- the network management protocol
- the management applications
• Remark : a management station takes care of several nodes, but a node may be managed by several management stations.
• The model is thus of the type «Manager - Agent» (client-server)
The management protocol
• Each node is maintaining a set of "variables". Reading these variables allows to supervise the network. Writing these variables allows the control of the mechanisms.
• Besides the reading and writing operations , two additional mechanisms are provided :
– the transversal operation to learn about implemented parameters
– the trap operation, for fault signaling
• It is possible to manage a node not implementing the Internet stacks using a "Proxy"
The information system
Data description A sub-set of ASN.1 is used by the "management framework" In particular, only 4 kinds of data types can be used :- INTEGER a data type that can only take integer values example :Status ::=
INTEGER { up(1), down(2), testing(3)}myStatus Status ::= up -- or 1- OCTET STRING a series of de 0 or more octets (values from 0 to 255).- OBJECT IDENTIFIER a type to reference a registered object (by a competent authority). It is a series of numbers, referencing the registration tree.- NULL
Definition of managed objects
OBJECT-TYPE MACRO ::= BEGIN
TYPE NOTATION::= "SYNTAX" type (ObjectSyntax)
"ACCESS" Access
"STATUS" Status
Access::= "read-only"
| "read-write"
| "write-only"
| "not-accessible"
Status ::= "mandatory"
| "optional"
| "obsolete"
| "deprecated"
Description ::= value (description DisplayString)
VALUE NOTATION::= value (VALUE ObjectName)
END
Definition of managed objects
Example :
sysDescr OBJECT-TYPE
SYNTAX OCTET STRING
ACCESS read-only
STATUS mandadory
::= { system 1 }
The information system
2 types of structured data :
• list :
<list>::= SEQUENCE { <type1>, . . ., <typeN>}
where <type> are simple types
• table :
<table>::= SEQUENCE OF <list>
Only 2 dimensions tables are authorized.
Registration
iso(1)
org(3)
dod(6)
...
...
... internet(1)
directory(1) mgmt(2) experimental(3) private(4)
Objects must be registered. Internet prefix :
internet OBJECT IDENTIFIER ::= { iso(1) org(3) dod(6) 1}or : 1.3.6.1
The SNMP MIB• MIB-1 (first version)
• MIB-2group nb comment
system 7 nodes
interfaces 23 network interfaces
at 3 IP address translation
ip 38 Internet Protocol
icmp 26 Internet Control Message Protocol
tcp 19 Transmission Control Protocol
udp 7 User Datagram Protocol
egp 18 Exterior Gateway Protocol
transmission 0 transmission
snmp 30 SNMP itself
total 171
Example : the System group
system OBJECT IDENTIFIER ::= { mib 1}
sysDesc: description of the equipment
sysObjextID : agent identity
sysUpTime : duration since last start
sysContact : contact person
sysName : equipment identification
sysLocation : location
sysServices : offered services
Example : sysDescr "4BSD/ISODE SNMP"
SysObjectId 1.3.6.1.4.1.4.1.2.1
SysUpTime 45366736 (=5 days, 6h,1mn,7.36sec)
SysContact "M. Dupont <@ IP>"
SysName wp.psi.com
SysLocation "building A"
SysServices 48 (transport, application)
MIB structure and addressing
system 1.3.6.1.2.1.1
interfaces 1.3.6.1.2.1.2
at 1.3.6.1.2.1.3
ip 1.3.6.1.2.1.4
icmp 1.3.6.1.2.1.5
tcp 1.3.6.1.2.1.6
udp 1.3.6.1.2.1.7
egp 1.3.6.1.2.1.8
cmot 1.3.6.1.2.1.9
transmission 1.3.6.1.2.1.10
snmp 1.3.6.1.2.1.11
MIB II - interface groupifAdminStatus administrative state (up/down/test)
ifOperStatus operationnal state (idem)
ifLastChange date of last operationnal change
ifDescr interface’s name
ifType type
ifMtu maxi Nr of datagramme
ifIndex a unique value for each interface
idfSpeed throughput
ifInDiscard nr of rejected packets in input
ifOutDiscard id in output
ifInErrors nr of packets in error in imput
ifOuterrors id in output
ifInOctets nr of octets received
ifOutOctets nr of octets sent
...
ifInUnknownProtos nr of received packets with unknown protocol
ifOutQlen nr of packets in the output queue
MIB II - IP groupipRouteTable IP routing table
ipNetToMediaTable address translation table
ipForwarding if the equipment can forward
ipAddrTable IP adresse
ipInReceives nr of datagrammes (input)
ipInHdrErrors nr of packets with header error
ipInAddrErrors nr of packets with address error
ipForwDatagrammes nr of forwarded datagrammes
ipInUnknownProtos nr of input datag. with protocol error
ipInDiscards nr of discarded datagrammes (input)
ipInDelivers nr of datagrammes (input)
ipOutRequests nr of datagrammes (output)
ipOutDiscards nr of rejected datagrammes (output)
...
ipFragFails nr of failed fragmentations
ipFragCreates nr of generated fragments
Protocol mechanisms
• Authentication
• Authorization (access policy)
• Objets identification
• Internal mechanisms
Authentication
• A SNMP message contains two parts :- a community name. It must be known from receiving entity to validate the message.
- data, with an operation and operands
• Each community name :– is verified for each message
– is correlated with rights (read - write)
– «sees» a sub-set of the MIB
Authorisation
• Each community defines an access mode that can be read-only or read-write for all the objects belonging to the community (the view).
• The intersection of the access mode and object's characteristics determines the authorization :
access mode read-only read-write write-only not-accessible
read-only 3 3 1 1
read-write 3 2 4 1
where classes are defined as follows :1 no right 3 get, get-next, trap
2 get, get-next, set, trap 4 get, get-next, set, trap ** used by specific implementations
Object's identification
• Each object is identified by its OID, followed by a suffix:– 0 for a simple variable (not in a table)
– a not null value if not
• Variables inside an agent can be classified (lexicographical order),
• The naming mechanism is not explicit:
variable = - the agent (IP address , port Nr )
- OID
- suffix
SNMP behaviour
SNMP is an asynchronous request/answer protocol .Four kinds of interactions are possible :
1- the manager sends a get-request; the agent answers by a get-response.2- the manager sends a get-next-request; the agent answers by a get-response.3- the manager sends a set-request; the agent answers by a get-response4- the agent sends a trap message.
SNMP behaviour
Each SNMP message (except traps) contains :
- a request identifier
- a list of variable bindings (names and values)
- a field for error types (tooBig, noSuchName, badValue, readOnly, genErr)
- an error index (number of the faulty variable).
SNMP Version Number
Community Name
Request -id
error status
error index
variable binding
name1 value1 name2 value2 ....... namen valuen
Variable Binding
PDUtype
The get-next operation• This operation has been designed to allow to receive as
answer the value of the object immediately following the object named in the request (referring to the community's view)..
• The answer will give the name of the next object and its value.
• Why to use this instruction ?– to know if an object is managed by an agent– to "traverse" a table without knowing its size– to "traverse" completely a MIB (the last request will be followed by a "
noSuchName").
example : reading of a routing tableget-next (ipRouteDest) -> ipRouteDest.0.0.0.0
get-next (ipRouteDest.0.0.0.0) -> ipRouteDest.192.33.4.0
get-next (ipRouteDest.192.33.4.0) -> ipRouteIfIndex.0.0.0.0
The TRAP
The trap operation is used by an agent to inform a manager of events.
The syntax of the trap is different from the other messages. The fields are:
– PDU type– agent's identification (enterprise)
– its address
– the kind of generic trap
– specific field for non-generic traps
– the time of the event
– a list of variables containing information concerning the trapversion community PDUtype
enterprise agent-addr specific-trapgeneric-trap time-stampvariablebindings
MIB's extensions
• A number of MIBs has been created for various areas :
– X25
– LAN
– FDDI
– printers
– ...
The list of the RFCs can be consulted
• A particular MIB : RMONIt allows to extend the possibilities of the protocol
The MIB RMON
The management of probes
– off line operations
– preemptive monitoring
– problem detection and alarms
– value added data
– multiple managers
MIB's structure
• The Statistics group• The History group• The Alarm group• The Host group• The HostTopN group• The Matrix group• The Filter group• The Packet Capture group• The Event group
Control mechanisms
It is based on tables containing entries
- control tables : to define operations- data tables : for recording results
+ the status variable + the "owner" variable
The "owner" variableRFC1271 - MIB DEFINITIONS ::= BEGIN
IMPORTS
Counter FROM RF11555-SMI
DisplayString FROM RFC1158-MIB
min-2 FROM RFC1213-MIB
OBJECT-TYPE FROM RFC-1212;
-- This MIB module uses the extended OBJECT-TYPE macro as defined in RFC1212.
-- Remote Network Monitoring MIB
rmon OBJECT IDENTIFIER ::= {mib-2 16}
-- textual conventions
OwnerString ::= DisplayStringASCII encoding is used to determine the user, who must be
identified by his name, his IP address, the station's name, location, phone number, 'monitor'
The "status" variable
EntryStatus ::= INTEGER
{ valid (1),
createRequest (2),
underCreation (3),
invalid (4) }
- invalid : the entry is not valid any more- createRequest : positioned by the manager, while the
agent is working- underCreation : positioned by the agent when action can
start - valid : positioned by the manager when the state is
"underCreation".
The statistics group
etherStatsTable OBJECT-TYPE
SYNTAX SEQUENCE OF EtherStatsEntry
ACCESS not-accessible
STATUS mandatory
DESCRIPTION "A list of Ethernet statistics entries"
::= { statistics 1 }
etherStatsEntry OBJECT-TYPE
SYNTAX EtherstatsEntry
ACCESS not-accessible
STATUS mandatory
DESCRIPTION "A collection of statistics kept for a particular Ethernet interface"
INDEX { etherStatsIndex }
::= { etherStatsTable 1 }
EtherStatsEntry ::= SEQUENCE { etherStatsIndex INTEGER (1..65535),
etherStatsDataSource OBJECT IDENTIFIER,
etherStatsDropEvents Counter,
···
etherStatsOwner OwnerString,
etherStatsStatus INTEGER }
The statistics group
etherStatsIndex OBJECT-TYPE SYNTAX INTEGER (1..65535)
ACCESS read-only
STATUS mandatory
DESCRIPTION "the value of this object uniquely identifies this etherStats entry."
::= {etherStatsEntry 1 }
···
etherStatsOwner OBJECT-TYPE
SYNTAX OwnerString
ACCESS read-write
STATUS mandatory
DESCRIPTION
"The entity that configured ths entry and is therefore using the ressources assigned to it"
::= { etherStatsEntry 20 }
etherStatsStatus OBJECT-TYPE
SYNTAX EntryStatus
ACCESS read-write
STATUS mandatory
DESCRIPTION "The status of this etherStats entry"
::= { etherStatsEntry 21 }
SNMP Vx
• SNMP V1 : full version (RFC 1157)
• SNMPsec (historic) (RFC 1351, 1353) : secured version of SNMP V1
• SNMP V2p (historic) : V1 + protocol operations, data types, party-based security (RFC 1441 and followings). This version is also called V2 classic
• SNMP V2c (experimental) (RFC 1901, 1905 and 1906). It is an update of V2p.
• SNMP V2u (experimental) (RFC 1905, 1906, 1909 and 1910). Same as SNMP V2C, except for security (based on users)
• SNMP V2* (experimental) (no RFC). Combine the best features of V2p and V2u.
• SNMP V3 (proposed)
SNMPv3: What is it?
• SNMPv2 and more:– protocol security, i.e.,
authentication/confidentiality/key management
this is the User-Based Security model
– an enhanced access-control model• based on MIB views and groups
this is the View-Based Access Control model
SNMPv3 - RFCs
• 2570 - Introduction (April ‘99)
• 2571 - Architecture
• 2572 - Message Processing/Dispatch
• 2573 - v3 applications (functional parts)
• 2574 - User-based Security Model
• 2575 - View-based Access Control Model
• 2576 - Coexistence between v1, v2 and v3
SNMP V3
Digest of the main improvements:• A manager can behave as an Agent for a manager allows manager to
manager communications)
• An agent can manage several MIBs
(by introduction of a naming process))
• Communication classesGET 1 --not used 16
GETNEXT 2 GETBULK 32
RESPONSE 4 INFORM 64
SET 8 SNMP V2 -TRAP 128
• Table manipulations (dynamic creation or deletion of rows : method “CreateAndWait”)
• Some new types (Counter32 and Counter64)
• Two new operations (Getbulk, inform)
Architectural elements
• snmpEngineID - a string that uniquely defines a manager or an agent,
• contextEngineID - id entity with a context
• contextName - parameter to access the control subsystem, represents a set of MIB objects (String)
New terms
• scopedPDU - PDU with contextEngineID, contextName
• snmpSecurityModel – v1, v2, USM (user-based) are possible
• snmpSecurityLevel– noAuthNoPriv, authNoPriv, authPriv
• principal - for whom everything is done– people ultimately, but processes in real life
• securityName - string representing the principal
SNMP V3 protocol
• Two new instructions
* GET-BULK
For multiple lectures (repetitive use of the principles of the GET-NEXT) – N 'simple' variables
– M variables leading
to R responses
* Inform
A manager can send information about a MIB to an another manager.
N M
R
Protocol overview
• Simply: v3 wrapper + v2/v1 PDU
globalheader
message security parameters
scoped PDU header
SNMP PDU
SNMPv3 partcrypto-field part
User-based Security Model
• Cryptography
• Anti-replay and time
• usmUser group
• Key management– password to hash key mechanisms– key localization– key update
View-based Access Control Model (VACM)
• Determines whether access to a managed object in a local MIB by a remote principal should be allowed,
• Makes use of a MIB that:– defines the access control policy for this agent– makes it possible for remote configuration to be
used.
Elements of the VACM model
• Groups - a group is a set of (securityModel, securityName), for whom access rights are identical
• Security level - different security levels => different access rights
• Contexts
• Mib views - collection of subtrees
• Access policies - used to enforce a particular set of access rights.
SNMP Entity
SNMP Entity
SNMP engine (identified by snmpEngineID)
DispatcherMessageProcessingSubsystem
SecuritySubsystem
AccessControl Subsystem
Application (s)
CommandGenerator
NotificationReceiver
ProxyForwarder
CommandResponder
NotificationOriginator
Other
SNMP entity (identified by snmpEngineID, example : abcd)
SNMP engine (identified by SNMPEngineID)
DispatcherMessageProcessingSubsystem
SecuritySubsystem
Access ControlSubsystem
Command Responder Application(contextEngineID, example : abcd)
example contextnames :
“bridge 1” “bridge 2” “ “ (default)
MIB instrumentation
context context context
bridge MIB bridge MIBother MIB
some MIB
SNMPv3 engine parts• Dispatcher
– interface to applications, network, and other SNMP engine parts
• Message processing– accepts/sends PDUs from/to the Dispatcher, and invokes the USM to
verify the security-related parameters
• Security subsystem– user-based security model
• Access control– view-based model
V3 Applications
• Command generator– does get/getnext/getbulk/set and processes the
received responses
• Command responder– receives get/getnext, etc., and sends the
response
• Notification receiver/originator– receives/sends traps and inform PDUs
SNMP Manager
SNMP entityNOTIFICATIONORIGINATOR
applications
NOTIFICATIONRECEIVERapplications
COMANDGENERATOR
applications
Network
UDP IPX other...
Dispatcher
PDU Dispatcher
TransportMapping
MessageDispatcher
Message Processing Subsystem
V1MP
V2cMP
V3MP
otherMP
Security subsystem
other securitymodel
User-basedsecurity model
SNMP AgentNetwork
UDP IPX other
MIB Instrumentation
COMMANDRESPONDER
application
ACCESSCONTROL
NOTIFICATIONORIGINATOR
applications
PROXYFORWARDER
applications
V1MP
V2cMP
V3MP
otherMP
Message ProcessingSubsystem
SecuritySubsystem
Othersecuritymodel
User-basedSecurityModel
Dispatcher
Transport Mapping
Message Dispatcher
PDU Dispatcher
Comparison CMIP vs SNMP
• Information system
(object orientation, inheritance, utilization of ASN.1, ...)
• Protocol mechanisms
(filtering vs pooling; dynamic creation, ...)
• Addressing
(naming vs simple mechanisms)
• Manager to manager dialogues
Attention : a CMIP manager is simpler than a SNMP manager
SNMP vs CMIP
INTERNET ISO
Cost perelement
Relatively inexpensive to implement sinceSNMP, UDP & IP have low to zerolicence fees, and the code is small. Publicdomain implementations are available
More expensive to implement due toadditional resources (memory,processors, etc.) required.
Scalability
Polling used by most SNMP-basedmanagement systems requires carefultuning in large networks to avoidexcessive bandwidth consumption.Simplicity of SNMP agents does notprovide strong built-in support tomanager-manager interfaces.
Event or ientation of most CMIP-basedmanagement systems allows scaling inlarge networks using built-in services.Distr ibution of load between manager andagent can be used to support manager-manager interfaces.
Element to EMSbandwidth
Excessive polling for many MIB variablescan result in high bendwidth consumption.Effective pollong strategies and use oflocal proxies can reduce bandwidthrequirements.
Excessive event generation and longermessages can result in high bandwidthconsumption. Buit-in logging and eventfilter ing services can be used to reducebandwidth requirements.
Lights out localintelligence
Most agents are relatively simple andtherefore offer little self-managementcapability
Increased complexity of agents can beused as the basis for self-managementcapability
Elementintelligence
SNMP agents are intended to be simple.Arbitrary complexity to the agents can beadded by extending the MIB in theEnterprise and Extension areas
CMIP agents are expected to do eventfilter ing, and to accept action commandsas defined in the object definitions.
SNMP vs CMIPINTERNET ISO
Security ofmanagement
Secure SNMP offers authentification andaccess control, including a securityviolation alarm.
CMIP offers authentification and accesscontrol, with a full set of security alarmsand a security audit trail service.
Redundancy ofmanagement
SNMP agents implementations may sendtraps to multiple managers. SNMP useslocal naming that is relative to an agentsystem and requires additionalinformation to make local names globallyunique.
CMIP offers a management service tocontrol event forwarding and loggingwhich may be distr ibuted to multipledestinations. CMIP uses global X500 stylenaming to facilitate manager-managerdistr ibution.
Communicationreliability
Typically used over a connectionlessdatagram protocol which does not ensurereliability. This puts the burden on themanager application to detect and recoverfrom lost requests. Since SNMP traps arenot acknowledged, there is no way todetect or recover from lost trap aler ts.
Must be used over a connection whichensured reliable data transport. Thisplaces the burden for loss detection andrecovery on the underlying transport, noton the manager or agent. CMIP is stillvulnerable to connection loss whennetwork conditions are bad, however.
Installed baseSNMP has great popular ity and thousandsof agents fave been deployed, particular lyin the distr ibuted LAN area
CMIP implementations are just enter ingservice
Standardmanagementapplications
The best SNMP managers on the marketprovide fault, configuration andperformance applications. Many of thesecan support custom extensions,and/orseamlessly incorporate vendor-specific applications.
Vendors of integrating systems andapplications provide configuration andfaults management applications.Performance applications are emerging
SNMP vs CMIP
INTERNET ISO
ExtensibilityExtensibility is provided through newMIBs and MIB II extensions ine theEnterprise and Extension areas.
Object classes used with CMIP may bedesigned using extensibility mechanismssuch as inheritance, specialization andallomorphism. Thses mechanisms allowexisting classes to be refined for extension,promoting reuse of existingimplementations ans seamless integrationof new features.
Backbonetransportprotocols
Typically used over UDP, can also be usedover TCP. Below the transport layerusually employed over Internet IP, butmay also be used over OSI, Appeltalk,NetWare IPX, etc.
Typically used over a full OSI stack, canalso be used over TCP/IP by employingRFC 1006 to map OSI transport to TCP.Also may be used over LANs byemploying IEEE 802.1B to map to LLC
Designcomplexity
See also cost. Simple and low cost designsare possible.
CMIP agents and their supporting objectsrequire a rigorous design approach usingobject oriented methodology
Automateddiscovery
Automatic discovery is possible through anumber os mechanisms, with additionalinformation via SNMP-walkingtechniques. Secure SNMP may make thesetechniques obsolete.
OMNIPoint 1 provides sharedmanagement knowledge services forCMIP management systems which enablesmanagers to discover agent capabilitiesand objects.
Comparison
CMIP SNMP V1 SNMP V3 RMON
complexity ofagent
high low low high
dissemination low high low(increasing)
medium
security high low as requested low
complexity ofmanager
medium high high medium
distributedarchitecture
yes no yes no
complexity ofAPI
high low low medium