|
|
This chapter provides introductory information about the Cisco Info Center. It describes the entire Cisco Info Center system, including Administration tools. For more information about how to use the Administration tools, see the Cisco Info Center Administrator Reference.
This chapter contains the following sections:
This section describes what VPN and CNM are and how Cisco Info Center can be used to meet requirements in the area of partitioning of fault and event information. Initial versions of the Cisco Info Center product support basic VPN and CNM features in the context of alarm and event management.
Virtual Private Networks (VPN) and Customer Network Management (CNM) features are becoming increasingly important in key high-growth service networks based on Wide Area Network (WAN) connectivity. This includes Inter-exchange Carriers (IXC), Telcos (PTT), Local Exchange Carriers (LEC), Internet Service Providers (ISP), as well as enterprise networks of large corporations.
The support for customizable management partitions, as described above, is essential to support both VPN and CNM services. Today's network environment requires services that span multiple network providers and multiple services across various countries and continents. In these markets, consortia and regional alliances make it necessary for Service Providers to provide network management that supports partitioned views of the network, where the partitions may be defined according to geographic, administrative, operator, security, or customer criteria. Partitions provide a flexible and scalable means of managing large networks. Operators can be assigned specific management responsibilities over specified regions or partitions.
In addition to describing VPN and CNM, this chapter describes how these advanced services relate to the concept of resource partitioning, and what can be achieved with Cisco Info Center. It also describes, at a detailed level, the basic components of the Cisco Info Center product. Finally, this chapter describes a variety of network management scenarios and configurations where Cisco Info Center can play a role.
The increasingly strategic importance of VPN and CNM features in Service Provider and large-enterprise networks present a significant market opportunity based on network management. Service Providers generally request a vendor-provided, out-of-the-box VPN and CNM solution that can be rapidly deployed to meet their time-to-market needs for offering new services.
VPN and CNM features stem from different Service Provider requirements, however, they are fundamentally based upon the same concept of network and resource partitioning. Both are related to providing customizable views of the network and network services, and rely upon the network management solution to support these types of views. VPN and CNM features span all the functional areas of management - configuration, fault, performance, security, and accounting. In network environments where the infrastructure and offered services are constantly changing, VPN and CNM solutions must be extensible and flexible enough to support rapid customization to fit the constantly evolving needs of Service Providers.
Cisco Info Center is a customized, private-label OEM of Micromuse's Netcool/Omnibus products. The product's focus has traditionally been in the area of enterprise fault management and trouble isolation, and real-time service-level monitoring.
Cisco Info Center provides a highly configurable client/server application that can consolidate, filter, and correlate fault information from a wide range of management platforms and network technologies, including Cisco Wan Manager (CWM). Cisco Info Center's distributed architecture and easily customizable features make it ideal for supporting resource partitioning, in the management functional areas related to the upstream flow of information, from the network towards end-users.
VPNs allow Service Providers to logically partition the network for administrative and operational purposes along user-definable boundaries. Examples of VPN boundaries include:
Figure 1-1 illustrates VPN partitioning along geographical administrative boundaries.
The networking environment is currently going through a rapid change due to ever increasing network size and numerous cooperative ventures between Service Providers to extend market reach. This dynamic environment requires a new network operations model to customize various views of the network and its resources for distributing management responsibilities, sharing protected information, analyzing network usage trends, and other operational reasons.
Service Providers are seeking definable views of network partitions and configurable access permissions on those partitions. This requires a VPN solution that can support more than just regional or geographical partitioning. Different Service Providers require different ways of partitioning the network. Each Service Provider requires a VPN solution flexible enough to meet its own current and future needs.
For example, another way the network can be partitioned is based on service offering. Service Providers and large enterprises are migrating towards ATM network infrastructures that can support multiple services. Consolidation of services onto a single network provides economies of scale, bandwidth efficiencies, and cost savings in numerous areas. For an ATM network, a Service Provider may choose to partition the network based on Frame Relay and ATM services. Each service-based partition might be managed by different groups. Although the same physical resources might be shared between the partitions, visibility and manageability of the partition is limited to those resources belonging to that service, as illustrated below.
Figure 1-2 illustrates VPN partitioning along three types of service: Frame Relay, ATM, and Voice and Data.
Another type of VPN that network administrators seek is one that provides customer oriented views of network resources. This is referred to as Customer Administrative VPN's. Here, the network is logically partitioned according to customer accounts. This type of partitioning supports the management of resources from a customer perspective, and enables a Service Provider to be more responsive to customer account issues. Figure 1-3 shows two customers and different views are provided at the Service Provider network management center, based on the customer profile and services to which they subscribe.
From these examples, it is clear network partitioning need not be mutually exclusive. Service Providers may have differing reasons for partitioning their network's views, however, the primary benefactor for VPNs is the Service Provider, and the operational model it needs to be supported.
Unlike VPN, however, CNM is focused on providing information regarding the service the end-subscriber has purchased, and not on the network itself. End subscribers are increasingly interested in knowing:
This is traditionally known as read-only CNM.
For more sophisticated subscribers, a read-write CNM service allows them to not only monitor their WAN services, but also perform limited provisioning of those resources, such as changing bandwidth parameters.
Providing advanced CNM services enables Service Providers to differentiate themselves, and is an important component of network management for Service Providers.
Traditionally, CNM has focussed on Layer-2 (Data Link layer) statistics. However, customers are increasingly demanding statistics for Layer-3 and higher, so as to have better control and understanding of the network services they have subscribed to.
Table 1-1 highlights the differences between CNM and VPN services. In this table, the differences are indicated primarily from a Level-2 service perspective.
| Service | VPN | CNM |
|---|---|---|
Business Purpose | Facilitate management of a network partition, such as for administrative reasons. Management of wholesale bandwidth (for example, fixed bandwidth and switching capacity) is an example of a VPN management service. | Provide end-customers view (and potentially control) of WAN services. |
Level of Management Information | Network and Service level focus. | Service level focus. |
Partition criteria | Any (administrative, geographical, customer, service, etc.). Partitions may overlap. | Customer boundaries. Partitions do not typically overlap |
Management functional areas | Primary focus on provisioning and fault management. | Focus on performance monitoring, service affecting fault monitoring, and sometimes control and/or provisioning. |
Relevant Standards | None. | ATM-Forum M3, Bellcore GR-1604 and FRF.6 MIB for FR. |
This section provides an overview of the Cisco Info Center product and its architecture.
This section also describes how Cisco Info Center provides not only a powerful, customizable, distributed alarm and event management environment, it also provides a flexible and effective solution to address network partitioning and support for services such as VPN and CNM.
Cisco Info Center is a Service-Level Management (SLM) system that provides a consolidated view of enterprise-wide events and status information. It collects event streams or messages from many different data sources and presents a single, consistent view of the current state of all Cisco Info Center managed systems. It distributes the event information to the operators and administrators responsible for monitoring service levels.
This information can then be:
Cisco Info Center allows diverse management platforms, applications, and Internet protocols to be brought together to provide the administrator a single point of monitoring those platforms and applications. Cisco Info Center does not replace the management platforms. It instead compliments them by providing an enterprise wide event/fault and status exchange. Cisco Info Center can also tie together domain limited network management platforms in remote locations.
Cisco Info Center tracks the state of events in a high performance distributed database and presents information of interest to specific users through individually configurable filters and views. Cisco Info Center Automation functions can be used to perform intelligent processing on the current state of managed objects. Cisco Info Center can build upon existing management systems or applications, therefore, it utilizes existing management skills and minimizes deployment time.
Following are the key features of Cisco Info Center:
A typical situation where the Cisco Info Center solution helps is in the area of administrative VPNs, where the responsibility for monitoring the network is distributed across regional Network Operations Centers (NOCs). In some networks, provincial or regional NOCs require a partial view of a local portion of the network to facilitate local problem detection and resolution. These regional NOCs may also require a localized topological view of their portion of the network. In addition to regional NOCs, these Service Providers typically have global NOCs which provide a view of the entire network, as well as global fault monitoring.
Cisco Info Center can also be used to support service level monitoring. The flexible definition of partitions and event filters within Cisco Info Center allows Service Providers to monitor the status of services that encompass multiple technologies and resources. Services sold to customers typically include multiple resources. Monitoring of customer services inherently requires the ability to monitor all elements that comprise a service.
For example, a managed network service might include a variety of WAN, LAN, and computing resources. With Cisco Info Center, it is possible to create an abstract view of services that provides the status of each customer's services as a whole. This simplifies the monitoring of customer services, and allows the Service Provider to create a management environment that best suits their management model or understanding of what constitutes a service.
The Cisco Info Center solution can support event monitoring on a global network scale, as well as on a user-defined partition of the network.
Sun Microsystems SPARC-based Solaris 2.5.1 or 2.6.
Cisco Info Center supports the following user interface environments:
This section describes the components that comprise the Cisco Info Center architecture. Typical Cisco Info Center components are:
The Cisco Info Server is an active, main-memory database. It consolidates, associates, and normalizes event data from the probes and monitors, assigning events to tables and fields. Repeated events are automatically de-duplicated using an identifier field. All application functions are active threads that run within the database engine.
The Cisco Info Server transforms events, such as faults, alarms, and warning messages, into alerts that can be easily manipulated by operator-driven correlations, associations, and filters. This also allows the creation of logical service groups, which can include end-to-end applications, VPNs, departments, or business units. This process produces accessible, meaningful information on the status of any component or group within the network. Another key advantage of the Cisco Info Server is that it allows all events throughout the enterprise to be simultaneously viewed by multiple authenticated network operators and users.
The Cisco Info Server is optimized for the handling of large volumes of faults, which is essential for networks where thousands of alarms may arrive each second. It currently runs on Solaris. Wherever possible, the Cisco Info Server exploits the underlying operating system's ability to support parallel processing or multi-threading.
The Cisco Info Server obtains alarms and events from isolated management environments. It then isolates the fault, allowing actions to be taken by technicians, help desk systems, or other applications. It also allows an SNMP trap to be created from the fault information that can then be forwarded to an SNMP management platform (for example, HP OpenView).
Upon receiving a record of a fault in a device in the network, the Cisco Info Server automatically applies a sequence of rules to determine the impact of the fault. The impact is calculated in the context of all information that has been collected on the network, including other faults and connectivity information. The configuration of the rules system within the Cisco Info Server is achieved with the implementation of SQL as a declarative language. A suite of graphical drag-and-drop configuration tools hide the SQL for non-technical operators. In addition, the rules engine isolates the events of immediate concern within the network. When combined with the Cisco Info Admin Desktop tools, this allows for the managing of faults to meet business objectives.
The Cisco Info Server can, with the Automation subsystem enabled, automatically start up processes to respond to specific events. This mechanism is controlled by database triggers and actions.
The triggers and actions are configured through a GUI tool. Triggers call actions when there are state changes or when specific events occur. The action may be a change to the in-memory status table or the running of external processes. The Automation subsystem uses Cisco Info Center SQL to allow for complex correlations of events.
The types of tools linked into the Cisco Info Center menus include:
Future tools provided by Cisco can be added into the existing management environment without recompilation or reinstallation. Tools developed by users can also be easily integrated into a number of menus through the GUI.
Info Mediators allow operators to collect and interpret information from disparate network management consoles, transmission infrastructure, telephony devices, data networks, LANs and WANs, and applications. Info Mediators supplied with Cisco Info Center can collect events and traps from:
Info Mediators are also available that can collect MIB information from switches and routers from vendors, including Bay Networks, Cabletron, and N.E.T. There are also Info Mediators for CMIP, ASCII, TL1, and industry-standard UNIX.
Info Mediators collect network and system events using rules and look-up tables to define, categorize, and add information to events. They also have standard system properties that control how and where to store data. Info Mediators have a different superset of executable functions depending upon which network management platform they are designed for.
The design of the Info Mediator mechanism allows the software to be installed quickly and to become operational immediately. It is based on the exclusive management paradigm, which enables Info Mediators to recognize all faults from the managed system without requiring user configuration. It also allows user customization of the Info Mediator behavior. Info Mediators can also be configured, using a sophisticated rules engine, to filter and translate certain data.
One of the most significant functions of an Info Gateway in network partitioning is its ability to support the real-time filtering and distribution of faults and events. The discriminators within the Info Gateways facilitate the creation of customized views of the network, whether for VPN or CNM applications. Events relevant to a specified partition can be passed through an Info Gateway to another Cisco Info Server, thus allowing operators or customers a view of what they're allowed to see, as defined by an administrator. Graphical views reflecting the state of services and/or resources defined within the partition help to present a more concrete picture.
Cisco Info Gateways only distribute partitioned event and alarm information; the Cisco Info Gateways cannot be used to distribute performance or accounting statistics.
An unlimited number of Cisco Info Servers can be connected together using Info Gateways, providing a scalable SLM environment. Cisco Info Server Info Gateways can monitor the changes within other Cisco Info Servers, sending appropriate updates to the central application.
Cisco Info Servers can be linked as follows:
An example of an RDBMS gateway deployment is the Info Gateway to Sybase. This gateway allows historical reporting using a two-phase-commit function, which ensures data integrity between the Cisco Info Server and the Sybase RDBMS. Statistical analysis of Cisco Info Center event archives can then be carried out directly from the RDBMS. This allows operators to create detailed reports on the availability of the network or services over a period of time.
Examples of trouble ticketing and help desk gateway deployment are the Peregrine Service Center and Remedy AR systems. The Service Center and AR gateways are bidirectional gateways that allow trouble-tickets to be created. Trouble-ticket creation is controlled from the Cisco Info Center Desktop tools. Faults can be consolidated, filtered, correlated, and isolated, then created as trouble-tickets that are sent to the counterpart systems. The Info Gateways create records within the counterpart systems and add the ticket number to the event record. The event can then be acted upon by the help desk operators. This allows fault reporting without direct access to Cisco Info Center. The trouble-ticket number is returned to the Cisco Info Server to update the creation record. Trouble-ticket status can be updated in Cisco Info Center when it has changed in the counterpart system. When the fault is closed in either the counterpart system or Cisco Info Center, it closes in both databases.
The Process Control system elements allow for a single point of control and administration of distributed systems. The Process Control agents cooperate automatically and have memory for their configuration. Process Control agents start remote processes and are capable of keeping those processes running. When a managed host is restarted, the Process Control agent restarts local components automatically. Any changes to the configuration are automatically replicated to all hosts in the configuration.
Cisco Info Admin Desktop information can be viewed from a UNIX/Motif front-end or a Java-driven Web browser. Event information is delivered in a format that allows operators to quickly determine the availability of services on a network. When an event cause has been identified, vendor-specific configuration tools allow operators to resolve problems quickly.
Cisco Info Admin Desktops provide two ways to view events: color-coded Event Lists and an Objective View mapping facility. The available graphical tools eliminate the need to manipulate text files to perform tasks. It is also possible to define tools that launch other commands.
Three categories of Cisco Info Admin Desktops exist. They are:
Tools available to all operators are the Filter Builder, View Builder, and Browsers. The tools available only to administrators and super-users are the Configuration Tool, the Objective View map editor, and the Automation Builder.
For normal operators, desktops act as the point of access to the event information stored in the Cisco Info Server. For administrators, the Cisco Info Admin Desktop functionality allows for the visual configuration of the Cisco Info Server, and operator desktops. Administrators also have access to graphical configuration editors. Through the configuration editors, complete Cisco Info Center configurations and components can be designed and deployed. They can implement the Cisco Info Center high-availability process control and multi-tiered security access.
Three standard client desktop applications for Cisco Info Center exist: Conductor, Objective View, and Event List. These applications attach to a Cisco Info Server and allow you to view the current state of the in-memory database, which in turn, reflects the status of the objects being managed.
These tools can be used by normal users, administrators, and super-users.
This is the desktop entry point for the Cisco Info Center system. It allows you to open the other client applications and to display configurations. Example configurations include filter or view files for the Event List or map files for the Objective View, as shown in Figure 1-4.
The buttons at the top of the window provide quick access to the other tools; the Event List, Filter Builder, View Builder, Browser, Map Editor Automation, Configuration, and Users Administration. The two left-most buttons in the figure shown above, allow automatic start-up of the files that are present. The Personal Library region displays icons of your own configuration files.
This tool displays a filtered view of alerts. The color-coded alerts are displayed in a scrolling list. You can set up multiple Event List clients, each with different priorities and filters. You can also use the Event List to reprioritize events and to assign or reassign problems to other users. When an alert has been assigned to a user, they can acknowledge they are working on it, or conversely, de-acknowledge it so it can be picked up by another user, as shown in Figure 1-5.
Instant summaries of alert states are provided through Monitor boxes. With a single click, you can display full details.
Configurable views and filters provide the information you need in an easy-to-use Event List.
The Filter Builder allows you to create complex graphical queries on the state of managed objects, as shown in Figure 1-7.
The top pane displays the query in a graphical tree display. Immediately below the tree are the Filter buttons. The bottom pane shows the SQL query and the Metric buttons below the query provide summary information associated with each filter.
The View Builder allows you to create graphical views of the state of managed objects, as shown in Figure 1-8.
Modifications to the view are instantly visible in the Display Columns pane near the top of the window. The Column Details region in the center of the window shows width justification and title. The Sort Columns controls at the bottom of the window allow you to sort any column, including columns that are not displayed.
The Objective View is a point and click tool for browsing through the managed objects. It allows you to browse managed objects in a hierarchical fashion and see alerts or state changes. The Objective View can also launch other applications, such as the Event List or the console of an underlying management system, as shown in Figure 1-9.
The Objective View Map editor displays a library of available maps through the Map Page window, as shown in Figure 1-10.
Graphical maps also provide access to third party tools. Advanced entity mapping allows for service level maps, as well as, device level maps.
The Java Event List for Cisco Info Center allows for the distribution and management of Cisco Info Center events through the World-Wide Web (WWW). With the backend process installed, Java applets can connect to the Cisco Info Server. These applets are configured in the HTML page by the administrator, providing you a range of facilities. Any operation which requires traceability also requires authentication, which is validated against the Cisco Info Center user database, as shown in Figure 1-11.
Users of the Java Event List can, when the Web administrator allows them, do the following:
For ease of configuration, the following administrator client applications are provided with Cisco Info Center:
For detailed information about how to use these applications, see the Cisco Info Center Administrator Reference.
To make the configuration of the Automation engine as simple as possible, the Automation Builder allows you to use iconic representations of triggers and actions. The associations between them are created by point and click actions, as shown in Figure 1-12.
Triggers, represented by icons on the left, detect states in the system and call actions. Actions, represented by the icons on the right, can modify the internal alert database, or run programs on other machines in the system, to respond to events.
Associations between triggers and actions are shown graphically, by arrows.
The User Administration tool simplifies the management of users and groups that have access to the Cisco Info Center system, and allows the administrator to define what privileges those users have. The User Administration tool also provides a reference list of all the known users in the system, as shown in Figure 1-13.
The Configuration Manager tool allows the administrator to define graphically how the Cisco Info Center system should be configured. The Configuration Manager tool then updates the Cisco Info Server, distributing the information to Cisco Info Center nodes, as shown in Figure 1-14.
Cisco Info Center is highly configurable. Access is provided with the Configuration Manager tool.
Windows are used for selecting icons and images; no editing of hidden command files, only scroll and select.
The Objective View allows for a wide range of visual objects and filter interaction. To make the development of these maps easier, the Objective View editor allows the administrator to create these maps as if they were using a structured drawing package, as shown in Figure 1-16.
You can use the Map Editor to create new maps.
The Symbol Inspector allows you to select individual components to be added to your map.
You can create multi-layered maps with a wide range of supported graphics.
All Cisco Info Center tools have a Help menu with a standard set of options. Table 1-2 shows the Help menu options.
| Menu Items | Short-cut | Action |
On Context | Shift+F1 or Shift + Help | Changes the mouse pointer to a question mark. You can then click on any element of the tool you are interested in. The tool then calls the Help system and provides appropriate Help. |
On Help |
| Calls on the Help system to display Help about using the Help system. |
On Keys |
| Calls on the Help system to display information on the keyboard short-cuts available for the tool. |
Index |
| Calls on the Help system to display an index of Help pages available for the current tool. |
On Version |
| Displays an About window with information on the version number and other relevant details. |
Throughout the system, Help buttons are available on most windows. These buttons display a relevant overview of the current window.
The following sections contain some examples of how Cisco Info Center component configurations can be designed and deployed.
In the simplest configuration, Cisco Info Center can be configured to acquire event data from single or multiple CWM workstations. This architecture includes the Cisco Network Node Manager (NNM) Mediator and CWM Mediator collecting data from the HP Network Node Manager application and the CWM Service Agent. The connectivity between the architecture components is shown in Figure 1-19.
Cisco Info Center can unify separate management platforms and Internet protocols with one Cisco Info Server. Info Mediators are developed to acquire data from a number of different data sources. For example, as shown in Figure 1-20, the Cisco Info Server can collect Level-2 WAN events from CWM hosts through the Cisco NNM Mediator and the CWM Mediator, Level-3 Cisco router information from a UNIX host collecting Cisco IOS event information through the UNIX Syslog Mediator, and events from the Internet Server Monitors from Micromuse, a family of Mediators that can acquire event and status data from various Internet protocols. The connectivity between the architecture components is shown in Figure 1-20.
Cisco Info Center allows configurations where two or more Cisco Info Servers communicate through an Info Gateway, with the Cisco Info Admin Desktop tools viewing system activity on either side. The connections between the architecture components are shown in Figure 1-21.
The enterprise-wide array of tools may require you to integrate more than just management platforms. The architecture of Cisco Info Center allows for this. In the example shown in Figure 1-22, the system is extended and its functionality includes supporting help desk users, other SNMP systems, and network management reporting. The connections between the architecture components are shown in Figure 1-22.
When patterns of behavior and appropriate actions have been identified, an Cisco Info Server's built-in Automation system can be configured to detect those patterns and execute the required actions. These actions may include automatically updating the Cisco Info Server (for example, when a critical object has an alert cleared, clear all associated alerts) or sending messages to the Process Control system which will then attempt to run a task on a specific target machine or machines. The tasks executed can include paging system operators, generating logs, running software to correct faults, or triggering audible alerts on appropriate stations. The connections between the architecture components are shown in Figure 1-23.
In the busiest enterprise networks, the Cisco Info Center architecture allows the arrangement of a number of Cisco Info Servers to act as a single entity. Figure 1-24 shows three Cisco Info Servers connected through an Info Gateway configuration. Each Cisco Info Server is connected with a bidirectional Info Gateway to the other Cisco Info Servers. The same Info Gateway allows for the historical logging of alerts to a Sybase database system.
Figure 1-24 shows a geographically distributed system and is one example of the distributed management configurations that can be designed and deployed using Cisco Info Center.
Collection of alarms and events from the network and distribution of partitioned information to other operation centers can be achieved with a configuration similar to the one shown in Figure 1-25. This peer-to-peer configuration of Cisco Info Servers is typically used to forward fault information from one Cisco Info Center to another, such as in a follow-the-sun type of management environment, or in an administrative VPN environment. Events that meet certain Info Gateway criteria, such as the location of the source of the event or the event type, can be forwarded from one Cisco Info Server to another. Figure 1-25 shows one Cisco Info Server aggregating events from the network and distributing them to two operations centers, each with responsibility for a certain partition of the network. The flexible architecture supports customizable collection and distribution policies to fit the network and operational requirements. In this manner, a distributed alarm and event management environment can be realized, where operators at different sites, and using different Cisco Info Servers, can share the view of the same events.
Figure 1-25 illustrates the use of multiple Cisco Info Servers to partition a network in a VPN environment.
Multiple Cisco Info Servers can be deployed to provide highly available event monitoring services. In the event a Cisco Info Server fails, Process Automation (PA) functions within Cisco Info Center can automatically switch the event feed from Info Mediators to an alternate Cisco Info Server. The Info Mediators have buffering capabilities that prevent information from being lost during the switch over process.
Figure 1-26 illustrates multiple Cisco Info Servers deployed at the Service Provider and customer sites, supporting the CNM capability. Figure 1-26 also provides an example of some CNM desktops developed with the Cisco Info Center system. The Administrative tools allow for custom creation of maps to reflect service-oriented views, which can then be distributed using the architecture shown in the example. The maps are developed using the Objective View editor.
Posted: Mon Sep 27 18:04:59 PDT 1999
Copyright 1989-1999©Cisco Systems Inc.
