Skip to content

Commit 2f2aa92

Browse files
alivin70stefanauss
alivin70
authored and
stefanauss
committed
Addes slides for Lesson 8 of Module 4, "Monitoring the Network"
This deck is a first write.
1 parent 8ad9cfa commit 2f2aa92

File tree

1 file changed

+324
-0
lines changed

1 file changed

+324
-0
lines changed

‎mod4-08.html‎

Lines changed: 324 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,324 @@
1+
<!doctype html>
2+
<html lang="en">
3+
4+
<head>
5+
<meta charset="utf-8">
6+
7+
<title>Advanced Networking - Module 4 Chapter 8 - Monitoring the Network</title>
8+
9+
<meta name="description" content="Abilitante alle certificazioni Cisco CCENT e CCNA">
10+
<meta name="author" content="Hacklab Cosenza">
11+
12+
<meta name="apple-mobile-web-app-capable" content="yes" />
13+
<meta name="apple-mobile-web-app-status-bar-style" content="black-translucent" />
14+
15+
<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no">
16+
17+
<link rel="stylesheet" href="css/reveal.min.css">
18+
<link rel="stylesheet" href="css/theme/default.css" id="theme">
19+
20+
<!-- For syntax highlighting -->
21+
<link rel="stylesheet" href="lib/css/zenburn.css">
22+
23+
<!-- If the query includes 'print-pdf', include the PDF print sheet -->
24+
<script>
25+
if( window.location.search.match( /print-pdf/gi ) ) {
26+
var link = document.createElement( 'link' );
27+
link.rel = 'stylesheet';
28+
link.type = 'text/css';
29+
link.href = 'css/print/pdf.css';
30+
document.getElementsByTagName( 'head' )[0].appendChild( link );
31+
}
32+
</script>
33+
34+
<!--[if lt IE 9]>
35+
<script src="lib/js/html5shiv.js"></script>
36+
<![endif]-->
37+
</head>
38+
39+
<body>
40+
41+
<div class="reveal">
42+
43+
<!-- Any section element inside of this container is displayed as a slide -->
44+
<div class="slides">
45+
<section>
46+
<h1>Advanced Networking</h1>
47+
<h2>Routing & Switching:<h2>
48+
<h2>Connecting Networks</h2>
49+
<h3>Chapter 8:</h3>
50+
<h3>Monitoring the Network</h3>
51+
<p>
52+
<small><a href="http://hlcs.it">Hacklab Cosenza</a> / Centro di Ricerca su Tecnologia e Innovazione</small>
53+
</p>
54+
</section>
55+
56+
<section>
57+
<h2>Introduction to Syslog</h2>
58+
<p>Syslog are important source of infomations to proactively monitor the network.</p>
59+
<p>Syslog messages are usually shown in the console, but they can be sent to many destinations:</p>
60+
<ul>
61+
<li>Logging buffer (RAM inside a router or switch)</li>
62+
<li>Console line</li>
63+
<li>Terminal line</li>
64+
<li>Syslog server</li>
65+
</ul>
66+
</section>
67+
68+
<section>
69+
<h2>Syslog severity levels</h2>
70+
<p>Every syslog message on CISCO IOS contains a <strong>severity level</strong> and a <strong>facility</strong>.</p>
71+
<p>There are 7 severity levels:</p>
72+
<ol>
73+
<li><strong>Alert</strong> Messages, Severity Level 1</li>
74+
<li><strong>Critical</strong> Messages, Severity Level 2</li>
75+
<li><strong>Error</strong> Messages, Severity Level 3</li>
76+
<li><strong>Warning</strong> Messages, Severity Level 4</li>
77+
<li><strong>Notification</strong> Messages, Severity Level 5</li>
78+
<li><strong>Informational</strong> Messages, Severity Level 6</li>
79+
<li><strong>Debugging</strong> Messages, Severity Level 7</li>
80+
</ol>
81+
</section>
82+
83+
<section>
84+
<h2>Syslog Message Format</h2>
85+
<p>By default, the format of syslog messages on the Cisco IOS Software is as follows:</p>
86+
<pre><code>[seq no:] timestamp: %facility-severity-MNEMONIC: description</code></pre>
87+
<p>For example:</p>
88+
<pre><code>00:00:46: %LINK-3-UPDOWN: Interface Port-channel1, changed state to up</code></pre>
89+
<p>To enable visible sequence numbering of system logging messages, use the global configuration mode command</p>
90+
<pre><code>service sequence-numbers</code></pre>
91+
<p>To display the date and time associated with the event, use the global configuration mode command</p>
92+
<pre><code>service timestamps log datetime</code></pre>
93+
</section>
94+
95+
<section>
96+
<h2>Timestamp of Syslog</h2>
97+
<p>It is important to synchronize the clocks of devices to properly recognise events.</p>
98+
<p>You can <u>manually</u> set the clock, using the <code>clock set</code> command or <u>automatically</u>, using the client/server <strong>Network Time Protocol (NTP)</strong>. To set a NTP server use the command:</p>
99+
<pre><code>Router(config)# ntp master [stratum]</code></pre>
100+
<p>To set the client use the command:</p>
101+
<pre><code>Router(config)# ntp server server-ip-address</code></pre>
102+
<p>The <strong>stratum</strong> is the distance between a network device and an authoritative time source. A stratum 1 time server is directly attached to an authoritative time source (such as a radio or atomic clock or a GPS time source).</p>
103+
</section>
104+
105+
<section>
106+
<h2>Syslog Server</h2>
107+
<p>First of all we need to set up a Syslog server.</p>
108+
<p>Gnu/Linux operating system has syslog server feature embedded.</p>
109+
<p>There are many open source graphical softwares available. For example:</p>
110+
<ul>
111+
<li><a href="http://loganalyzer.adiscon.com/">LogAnalyzer</a></li>
112+
<li><a href="https://github.com/MaxBelkov/visualsyslog">Visual Syslog Server for Windows</a></li>
113+
<li><a href="https://www.graylog.org/">Graylog</a></li>
114+
<li><a href="http://doxfer.webmin.com/Webmin/System_Logs">Webmin</a></li>
115+
</ul>
116+
</section>
117+
118+
<section>
119+
<h2>Default Logging</h2>
120+
<p>Cisco switches and routers send log messages to the console by default.</p>
121+
<p>To enable logging to the console use the <code>logging console</code> global configuration commands.</p>
122+
<p>To enable buffered logging use <code>logging buffered</code> global configuration command.</p>
123+
<p>To display the default logging service settings use the <code>show logging</code> global configuration command on a Cisco router.</p>
124+
</section>
125+
126+
<section>
127+
<h2>Send messages to a syslog server</h2>
128+
<p>To log on a remote syslog server use the following command:</p>
129+
<pre><code>R1(config)# logging 192.168.1.3</code></pre>
130+
<p>To limit the logged messages to a preferred level, use the command:</p>
131+
<pre><code>R1(config)# logging trap {level}</code></pre>
132+
<p>You can optionally, configure the source interface with a command like this:</p>
133+
<pre><code>R1(config)# logging source-interface g0/0</code></pre>
134+
<p>Use show <code>logging</code> command to see logged messages, followed by pipe and <code>begin</code> or <code>include</code> commands to filter results, for example:</p>
135+
<pre><code>R1(config)# show logging | begin June 12 22:35
136+
R1(config)# show logging | include changed state to up</code></pre>
137+
</section>
138+
139+
<section>
140+
<h2>SNMP</h2>
141+
<p><strong>Simple Network Management Protocol</strong> (SNMP) is an "Internet-standard protocol for managing devices on IP networks".</p>
142+
<p>Devices that typically support SNMP include <strong>routers, switches, servers, workstations, printers, modem racks</strong> and more.</p>
143+
<p>SNMP is widely used in network management systems to <strong><u>monitor network-attached devices</u></strong> for conditions that warrant administrative attention.</p>
144+
<p>SNMP is a <strong>component of the Internet Protocol Suite</strong> as defined by the Internet Engineering Task Force (IETF).</p>
145+
<p>It consists of a set of standards for network management, including an <strong><u>application layer protocol</u></strong>, a <strong><u>database schema</u></strong> and a <strong><u>set of data objects</u></strong>.</p>
146+
</section>
147+
148+
<section>
149+
<h2> Network Management System (NMS)</h2>
150+
<p>The SNMP system consists of three elements:</p>
151+
<ul>
152+
<li><strong>SNMP manager</strong> - Is part of NMS; it collects information from an SNMP agent and can change configurations on an agent using the "get" and "set" actions.</li>
153+
<li><strong>SNMP agents</strong> (managed node) - reside on networking device clients; they forward information directly to an NMS using "traps";</li>
154+
<li><strong>Management Information Base (MIB)</strong> - reside on networking device clients; it stores data about the device operation.</li>
155+
</ul>
156+
<p>SNMP uses <strong><u>UDP port number 162</u></strong> to retrieve and send management information.</p>
157+
</section>
158+
159+
<section>
160+
<section>
161+
<h2>SNMP protocol data units (PDUs)</h2>
162+
<ol>
163+
<li><strong>GetRequest</strong> - A <em>manager-to-agent</em> request to retrieve the value of a variable or list of variables. A Response with current values is returned.</li>
164+
<li><strong>SetRequest</strong> - A <em>manager-to-agent</em> request to change the value of a variable or list of variables. A Response with (current) new values for the variables is returned.</li>
165+
<li><strong>GetNextRequest</strong> - A <em>manager-to-agent</em> request to discover all available variables and their values. The entire MIB of an agent can be walked by iterative application of GetNextRequest.</li>
166+
<li><strong>GetBulkRequest</strong> - Optimized version of GetNextRequest. A manager-to-agent request for multiple iterations of GetNextRequest. GetBulkRequest was introduced in SNMPv2.</li>
167+
</ol>
168+
</section>
169+
<section>
170+
<h2>SNMP protocol data units (PDUs)</h2>
171+
<ol start="5">
172+
<li><strong>Response</strong> - Returns variable bindings and acknowledgement from <em>agent to manager</em> for <em>GetRequest</em>, <em>SetRequest</em>, <em>GetNextRequest</em>, <em>GetBulkRequest</em> and <em>InformRequest</em>.<br>
173+
Although it was used as a response to both gets and sets, this PDU was called <em>GetResponse</em> in SNMPv1.</li>
174+
<li><strong>Trap</strong> - Asynchronous notification <em>from agent to manager</em>. SNMP traps enable an agent to notify the management station of significant events by way of an unsolicited SNMP message.<br>
175+
Includes current sysUpTime value, an OID identifying the type of trap and optional variable bindings.</li>
176+
<li><strong>InformRequest</strong> - Acknowledged asynchronous notification.</li>
177+
</ol>
178+
</section>
179+
</section>
180+
181+
<section>
182+
<h2>SNMP Versions</h2>
183+
<p><strong>SNMP version 1 (SNMPv1)</strong> is the initial implementation of the protocol. RFCs for SNMP appeared in 1988.</p>
184+
<p><strong>Community-Based SNMP version 2 (SNMPv2c)</strong> is defined in RFC 1901–RFC 1908 uses the simple <strong><em>community-based security scheme</em></strong> of SNMPv1.</p>
185+
<p>SNMPv3 primarily added security and remote configuration enhancements to SNMP providing the features:</p>
186+
<ul>
187+
<li>Identification of SNMP entities.</li>
188+
<li>Encryption of packets, Message integrity, Authentication - to verify that the message is from a valid source.</li>
189+
<li>SNMPv3 contains the specifications for USM (User-based Security Model).</li>
190+
<li>Supports different auth/privacy protocols (MD5, SHA).</li>
191+
<li>Definition of a discovery procedure.</li>
192+
</ul>
193+
</section>
194+
195+
<section>
196+
<h2>Community Strings</h2>
197+
<p>SNMPv1 and SNMPv2c use <strong>plaintext passwords</strong> called <strong>community strings</strong> that control access to the MIB.</p>
198+
<p>Community strings can be:</p>
199+
<ul>
200+
<li><strong>Read-only (ro)</strong> to provide only read access to the MIB variables. Because security is weak in version 2c, many network administrators use SNMPv2c in read-only mode.</li>
201+
<li><strong>Read-write (rw)</strong> provides read and write access to all objects in the MIB</li>
202+
</ul>
203+
</section>
204+
205+
<section>
206+
<h2>MIB Object ID</h2>
207+
<p><u>SNMP itself does not define which information (i.e. which variables) a managed system should offer</u>.</p>
208+
<p>Rather, SNMP uses an <strong>extensible design</strong>, where the available information is <u>defined by management information bases</u>.</p>
209+
<p>MIBs describe the structure of the management data of a device subsystem; they use a <strong>hierarchical namespace containing object identifiers (OID)</strong>.</p>
210+
<p>Each OID identifies a variable that can be read or set via SNMP.</p>
211+
</section>
212+
213+
<section>
214+
<h2>CISCO MIB structure</h2>
215+
<p>In the MIB structure defined by Cisco the OID can be described in words or numbers to help locate a specific variable in the tree.</p>
216+
<p>The first <strong>four numbers of an OID</strong> are almost always <code>.1.3.6.1</code>:</p>
217+
<ul>
218+
<li>1—iso Stands for the International Standards Organization (ISO).</li>
219+
<li>3—org Objects under ISO are organizations recognized by the ISO.</li>
220+
<li>6—dod Department of Defense, which developed the original Internet (ARPANET).</li>
221+
<li>1—internet A code that the DOD assigned to something called the "Internet Community."</li>
222+
</ul>
223+
<p>OIDs belonging to <strong>Cisco</strong> are numbered as follows: .iso (1).org (3).dod (6).internet (1).private (4).enterprises (1).cisco (9). This is displayed as <code>.1.3.6.1.4.1.9</code></p>
224+
</section>
225+
226+
<section>
227+
<h2>Configure SNMPv2</h2>
228+
<p>The only required configuration are the community string and access level (read-only or read-write) with the command:</p>
229+
<pre><code> snmp-server community {string} [ro | rw]</code></pre>
230+
<p>Optional informations about the device:</p>
231+
<pre><code>snmp-server location text
232+
snmp-server contact text</code></pre>
233+
<p>Restrict SNMP access to NMS hosts using ACLs:</p>
234+
<pre><code> snmp-server community string access-list-number-or-name </code></pre>
235+
<p>Specify the recipient of the SNMP trap operations:</p>
236+
<pre><code>snmp-server {host} {host-id} [version{ 1| 2c | 3 [auth | noauth | priv]}] {community-string}
237+
snmp-server enable traps {notification-types}
238+
</code></pre>
239+
</section>
240+
241+
<section>
242+
<h2>Verify SNMP</h2>
243+
<p>To verify SNMP configurations, use the commands</p>
244+
<pre><code>show snmp
245+
show snmp community</code></pre>
246+
</section>
247+
248+
<section>
249+
<h2>SNMPv3</h2>
250+
<h3>I don’t belong here :(</h3>
251+
</section>
252+
253+
<section>
254+
<h2>NetFlow</h2>
255+
<p>NetFlow is a Cisco IOS technology that <strong>provides statistics on packets flowing through a Cisco router or multilayer switch</strong>. </p>
256+
<p>Flexible NetFlow is the latest NetFlow technology.</p>
257+
<p><strong>Flexible NetFlow</strong> improves on "original NetFlow" by adding the capability to customize the traffic analysis parameters for the specific requirements of a network administrator.</p>
258+
<p>Most organizations use NetFlow for data collection purposes:</p>
259+
<ul>
260+
<li>Measuring who is using network resources.</li>
261+
<li>Accounting and charging back according to the resource utilization level.</li>
262+
<li>Using the information to improve the infrastructure and optimize resources to meet user needs and customer service requirements.</li>
263+
</ul>
264+
</section>
265+
266+
<section>
267+
<h2>NetFlow Configuration</h2>
268+
<p>NetFlow captures data from ingress (incoming) and egress (outgoing) packets.</p>
269+
<p>Specify IP address or hostname of the NetFlow collector:</p>
270+
<pre><code>Router(config)# interface fe0/2
271+
Router(config-if)# ip flow ingress
272+
Router(config-if)# ip flow egress
273+
Router(config-if)# exit
274+
Router(config)# ip flow-export destination 192.168.1.3 2055
275+
Router(config)# ip flow-export version 5</code></pre>
276+
<p>Verifying NetFlow configuration using the commands</p>
277+
<pre><code>show ip cache flow
278+
show ip flow interface
279+
show ip flow export</code></pre>
280+
</section>
281+
282+
<section>
283+
<h1>End of Lesson</h1>
284+
</section>
285+
286+
</div>
287+
288+
</div>
289+
290+
<script src="lib/js/head.min.js"></script>
291+
<script src="js/reveal.min.js"></script>
292+
293+
<script>
294+
295+
// Full list of configuration options available here:
296+
// https://github.com/hakimel/reveal.js#configuration
297+
Reveal.initialize({
298+
controls: true,
299+
progress: true,
300+
history: true,
301+
center: true,
302+
303+
theme: Reveal.getQueryHash().theme, // available themes are in /css/theme
304+
transition: Reveal.getQueryHash().transition || 'linear', // default/cube/page/concave/zoom/linear/fade/none
305+
306+
// Parallax scrolling
307+
// parallaxBackgroundImage: 'https://s3.amazonaws.com/hakim-static/reveal-js/reveal-parallax-1.jpg',
308+
// parallaxBackgroundSize: '2100px 900px',
309+
310+
// Optional libraries used to extend on reveal.js
311+
dependencies: [
312+
{ src: 'lib/js/classList.js', condition: function() { return !document.body.classList; } },
313+
{ src: 'plugin/markdown/marked.js', condition: function() { return !!document.querySelector( '[data-markdown]' ); } },
314+
{ src: 'plugin/markdown/markdown.js', condition: function() { return !!document.querySelector( '[data-markdown]' ); } },
315+
{ src: 'plugin/highlight/highlight.js', async: true, callback: function() { hljs.initHighlightingOnLoad(); } },
316+
{ src: 'plugin/zoom-js/zoom.js', async: true, condition: function() { return !!document.body.classList; } },
317+
{ src: 'plugin/notes/notes.js', async: true, condition: function() { return !!document.body.classList; } }
318+
]
319+
});
320+
321+
</script>
322+
323+
</body>
324+
</html>

0 commit comments

Comments
 (0)