
\chapter{Network Element Management}
\label{ch:network}

This chapter discusses network element management. Section~\ref{sec:configuration} describes network configuration management. Section~\ref{sec:security} describes security management, including protocols and programs developed to provide security over the Internet, and network elements used to secure risky areas of networks. Section~\ref{sec:fault} studies fault management, including troubleshooting, fault localization, and testing methods.


\section{Configuration Management}
\label{sec:configuration}

\index{configuration management|textbf} Configuration management means
initializing and shutting down parts of a network (for example
routers, hubs, and repeaters) and reporting the changes. It is also
concerned with maintaining, adding and updating the relationships
among elements and the status of elements during network
operation. Network traffic patterns and identified bottlenecks that
reduce performance must be understood. Nowadays modern elements and
subsystems can be configured to support many different
applications. The same device can be configured to act either as a
router or as an end system node or both. Depending on the
configuration, the appropriate software and a set of attributes and
values are chosen for the device~\cite[page 481]{b32}. Reconfiguration
may be necessary in case of fault isolation or when the network is
expanded. 

As the network scales up in physical size (capability and complexity),
also the management capabilities must be enlarged. The aim is that
these actions could be automated. It should also be possible to make
on-line changes without affecting the entire element or
network~\cite{b24}. Large-scale network management systems must be
constructed to support diverse network elements. They must also be
extensible and flexible enough to support new elements and the rapid
deployment of new highly customized services.

Activities in network management can be divided into three groups~\cite{b10}:
\begin{itemize}
\item activities that do not affect the functioning of an element, 
\item activities that affect the functioning of an element (for example switching off an element in a subnetwork), and 
\item activities that make an element to do a desired function (for example restarting an element). 
\end{itemize}

Dynamic updating of configuration needs to be done periodically to ensure that the existing configuration is known. This is essential for fault management as well.

Configuration management tools have reporting components. When network configuration changes, users must be informed about new network elements and resources. Configuration management is well organized when all the gathered information and operations are in statistical form.

There is a risk of spending money on hardware and services that remain underutilized. On the other hand the underprovisioning usually lowers productivity, which reflects to the service level~\cite{b4}. When the network is designed, it is essential to predict the growth of the network. The network should also be prepared to varying volumes of users.

By continuously addressing the cost of maintenance (MTBF\footnote{Mean Time Between Failure}\index{MTBF} and MTTR\footnote{Mean Time To Repair}\index{MTTR} statistics, costs associated with maintaining) the network as a system can be tuned~\cite{b27}.


\subsection{TCP/IP Networks}

TCP/IP networks cause more work for system administrators than other networking systems. Administrators have to manually configure each computer for network use when it is added to the network, or when it is moved from one subnet to another. Each computer must manually be assigned a unique IP address and various configuration parameters must be set.

There is a need for tools that automatically assign addresses and set
configuration parameters. Some client/server solutions are already
available. Client hosts find the details of other hosts on the
network using the Domain Name Service (DNS)\index{DNS} protocols, and can be
told their network configuration using Bootstrap (BOOTP)
protocol\index{BOOTP}. Dynamic allocation of IP addresses to particular hosts
can be chosen over static allocation using the Dynamic Host
Configuration Protocol (DHCP)\index{DHCP}~\cite{rfc2131}.


\section{Security Management}
\label{sec:security}

\index{security management|textbf} Security management covers such areas as detecting, tracking and reporting security violations, and creating, deleting and maintaining security-related services such as encryption, key management, and access control. Distributing passwords and secret keys to bring up systems are also functions of security management~\cite[page 12]{a30}.

As computer-based communications and networks that link open systems continue to expand, security management becomes critical. Nevertheless, standardization of security properties has developed slowly. Network management must provide proactive management of security and integrate it with protocols, such as IPSec and services, like VPNs. Security of devices and networks must be compared to possible threats and risks. If the risks are high, the devices and the networks must be provided with more reliable secure properties.


\subsection{Protocols and Programs for Network Security}

\index{S-HTTP}
Table~\ref{tab:protocolsandprograms} describes protocols and programs,
that are developed to provide security over the Internet. Secure-HTTP
(S-HTTP) is an application-level protocol that provides security
services across the Internet. It provides confidentiality,
authenticity, integrity, and non-repudiability. S-HTTP is limited to
the specific software that is implementing it, and it encrypts each
message individually~\cite{b30}. 

\begin{table}[htb]
\small
\begin{tabular}{|c|c|}\hline
\textbf{Level} 		&	\textbf{Protection Used}\\\hline
Application-level 		&	S-HTTP, SSH, stelnet, S/MIME\\\hline
Transport-level (TCP, UDP) 	&	SSL, PCT\\\hline
Network-level (IP) 		&	IPSec\\\hline
\end{tabular}
\caption{Protocols and programs developed to provide security over the Internet}
\label{tab:protocolsandprograms}
\end{table}

\index{SSH}\index{stelnet}\index{secure telnet|see{stelnet}} Secure Shell (SSH) and Secure telnet (stelnet) are programs that allow you to log in to remote systems and using an encrypted connection. SSH uses public-key cryptography to encrypt communications between two hosts, as well as for user authentication.

\index{S/MIME} Secure Multipurpose Internet Mail Extension (S/MIME) is an encryption standard used to encrypt electronic mail, or other types of messages on the Internet. It is an open standard developed by RSA Data Security Inc.

\index{SSL} Secure Socket Layer (SSL) is an encryption method developed by Netscape to provide security over the Internet. SSL is a protocol layer that is located between the network layer and applications, so that, in theory, it can be used with any application. However, it is vulnerable to poor application design. It provides data encryption, server authentication, message integrity, and optional client authentication for a TCP/IP connection~\cite{b30}.

\index{PCT} The Private Communication Technology (PCT) protocol is developed by the Microsoft Company to be used mainly in their Internet Explorer browser.

\index{IPSec}IP Security Architecture (IPSec) provides a standard
security mechanism and services to the currently used IP version 4
(IPv4) and to the new IP version 6 (IPv6). IPSec is less dependent of
individual applications than SSL. It provides IP-level encryption by
specifying two standard headers: IP Authentication Header (AH)
\index{IPSec!IP authentication header (AH)} and IP Encapsulating
Security Payload (ESP)\index{IPSec!IP encapsulating security payload
(ESP)}. IP Authentication Header provides strong integrity and
authentication. It computes a cryptographic authentication function
over the IP datagram and uses a secret authentication key in the
computation. IP Encapsulating Security Payload provides integrity and
confidentiality for IP datagrams. It encrypts the data to be protected
and places it in the data portion of the IP Encapsulating Security
Payload. However, these mechanisms do not provide security against
traffic analysis. Any specific protocol for key management is not
provided by the architecture, only requirements for such systems to be
used in conjunction are described~\cite{b35}. 

\index{ISAKMP}\index{IKE} IPSec requires a key management
protocol. IETF\index{IETF} has standardized Internet Security Association \& Key
Management Protocol (ISAKMP) and Internet Key Exchange (IKE) for this
purpose. ISAKMP defines the procedures for authenticating a
communicating peer, creation and management of Security Associations,
key generation techniques and threat mitigation (e.g. denial of
service and replay attacks). These are necessary to establish and
maintain secure communications in an Internet environment. Security
Association (SA)\index{SA} is a security-protocol-specifistic set of parameters
that defines the services and mechanisms necessary to protect traffic
at that security protocol location.  

ISAKMP separates the details of security association management and
key management from the details of key exchange. It provides a
framework for Internet key management, but it does not define session
keys by itself. IKE is a protocol that defines key exchange functions
for ISAKMP.

Protocols and programs discussed in this subsection are further studied in~\cite{b30}. IPSec is defined in~\cite{rfc2401}, ISAKMP in~\cite{rfc2408} and IKE in~\cite{rfc2409}.


\subsection{Access Control Tools}
\label{subsec:accesscontroltools}

Hubs\index{hubs}, routers\index{routers} and firewalls can be used to
limit access to networks or to parts of the networks.  These security
level operations can be restricted to a date or to a time period.

\begin{itemize}

\item \textbf{Hubs} used in LANs are provided with simple security properties. Hubs protect sensitive data on the network by checking destination addresses on each packet and sending readable packets only to authorized nodes. Hubs automatically detect and/or disable unauthorized log-on attempts and record the events at the management station. Hubs also track changes involving users and devices on the network, giving the manager a complete record. These security level operations can be restricted to a date or a time period.

\item \textbf{Routers} are provided with security properties as well. A router handles packets up through the IP layer. The router forwards each packet based on the packet's destination address, and the route to that destination is indicated in the routing table~\cite{b33}. Routers can improve network security, but also introduce new problems: Routing protocols are susceptible to security attacks, and routing mistakes may allow the entrance of unauthorized personnel into the network. Unlicensed remote and local operations of routers must be prevented by using usernames.

Traffic can be controlled with packet filtration based on the access
control lists. On the access control lists it is defined what
addresses and protocols to each interface can be routed. Properties
such as NAT\index{NAT}\footnote{Network Address Translation is a method of
connecting multiple computers to the Internet using one IP address.},
PAT\index{PAT}\footnote{Port Address Translation is a method of translating all
local private addresses to a single globally registered IP address.},
and logging of events and alarms can be attached to the
router. However, it has not been possible to expand the capacity of
traditional routers as cost-effectively as the capacity of PC
workstations or the network traffic volume~\cite{b12}.

\item \textbf{Firewall systems} control connections between closed networks and outside world. There are two major approaches used to build firewalls: packet filtering\index{firewalls!packet filtering} and proxy services\index{firewalls!proxy services}. Packet filtering systems route packets between internal and external hosts, but they do it selectively. They allow or block certain types of packets in a way that reflects a site's own security policy. The type of router used in a packet filtering firewall is known as a screening router.

Proxy services are specialized application or server programs that run on a firewall host: either a dual-homed host with an interface on the internal network and one on the external network, or some other bastion host that has access to the Internet and is accessible from the internal machines. These programs take users' requests for Internet services (such as FTP\index{FTP} and Telnet) and forward them, as appropriate according to the site's security policy, to the actual services. The proxies provide replacement connections and act as gateways to the services. For this reason, proxies are sometimes known as application-level gateways~\cite{b57}.
\end{itemize}

There are three ways to put various firewall components together:

\begin{itemize}
\item 

\index{firewalls!dual-homed host architecture} A \textbf{dual-homed host architecture} is built around the dual-homed host computer, a computer that has at least two network interfaces. Such a host could act as a router between the networks these interfaces are attached to; it is capable of routing IP packets from one network to another. Systems inside the firewall can communicate with the dual-homed host, and systems outside the firewall (on the Internet) can communicate with the dual-homed host, but these systems can not communicate directly with each other. IP traffic between them is completely blocked.

Figure~\ref{fig:firewall1} shows the network architecture for a dual-homed host firewall. The dual homed host sits between, and is connected to, the Internet and the internal network~\cite{b57}.

\begin{figure}[htb]
\begin{center}
\epsfxsize.7\textwidth
\epsfbox{kuvat/firewall1}
\caption{Dual-homed host architecture}
\label{fig:firewall1}
\end{center}
\end{figure}

\item\index{firewalls!screened host architecture} Whereas a dual-homed host
architecture provides services from a host that is attached to
multiple networks (but has routing turned off), a \textbf{screened host
architecture} provides services from a host that is attached only to
the internal network, using a separate router. In this architecture,
the primary security is provided by packet filtering. For example,
packet filtering is what prevents people from going around proxy
servers to make direct connections. Figure~\ref{fig:firewall2} shows the
network architecture for the screened host architecture~\cite{b57}. 

\begin{figure}[htb]
\begin{center}
\epsfxsize.7\textwidth
\epsfbox{kuvat/firewall2}
\caption{Screened host architecture}
\label{fig:firewall2}
\end{center}
\end{figure}

\item

\index{firewalls!screened subnet architecture} The \textbf{screened subnet
architecture} adds an extra layer of security to the screened host
architecture by adding a perimeter network that further isolates the
internal network from the Internet. There are two screening routers,
each connected to the perimeter net. The perimeter network is another
layer of security, an additional network between the external network
and the protected internal network. The perimeter net offers an
additional layer of protection between attackers and the internal
system. One screening router sits between the perimeter net and the
internal network, and the other sits between the perimeter net and the
external network (usually the Internet). To break into the internal
network with this type of architecture, an attacker would have to get
past both routers. Figure~\ref{fig:firewall3} shows the network architecture
for the screened subnet architecture~\cite{b57}. 

\begin{figure}[htb]
\begin{center}
\epsfxsize.7\textwidth
\epsfbox{kuvat/firewall3}
\caption{Screened subnet architecture}
\label{fig:firewall3}
\end{center}
\end{figure}

\end{itemize}


\section{Fault Management}
\label{sec:fault}

Physical network problems account more than half of all network
problems. Locating the origins of such problems as a fiber cut, an
incorrect earthing, broken or incorrectly connected adapters, costs
network providers time and money. Network management systems have also
traditionally focused on the logical connection between the end user
and the network destination, since many network problems have been a
result of errors created by software applications~\cite{b24}. Finding
and repairing failures of software applications is usually difficult,
for example in such a case that the workstation sends but does not
receive packets, too many collisions occur or frames are too short or
too long.

\index{fault management|textbf} Fault management means troubleshooting, fault localization, isolation and correction. Today, the process of fault management needs to be automated. Rapid and accurate correction of network problems has to be created by the network or by the end user. Even if the entire network was violated, the network management application should work.

\index{expert systems} Expert\label{expertsystems} systems provide an efficient and cost effective way of automating network fault management. By automating fault management, problems and possible diagnosis can be done faster and more efficiently. However, real-time performance represents a problem for expert systems~\cite{b8}. Bounds on response times are difficult to establish. There are also risks pushing the limits of automation through the introduction of new or only partially proven technologies.


\subsection{Transferring information}

\index{polling}\index{alarms} There are two mechanisms of transferring network management information from a managed entity to a manager: \textbf{polling} and \textbf{sending alarms} (messages are initiated by managed network elements). Advantages and disadvantages exist within both methods. Most network management systems use an optimal combination of alarms and polling in order to maintain advantages of each and eliminate disadvantages of pure polling~\cite{rfc1224}.

Most systems poll the managed objects, search for error conditions and
illustrate the problem in graphical format or as a textual
message. Disadvantages of polling are the response time of problem
detection and the increased volume of network management
traffic. Having to poll many management information base (MIB)
\index{MIB} variables per element on a large number of elements is
itself a problem. The ability to monitor such a system is
limited. Polling many objects on many elements increases the amount of
network management traffic flowing across the network. It is possible
to minimize this through the use of hierarchies (polling an element
for a general status of all the elements it polls). Anyway, the
response time will be a problem~\cite{rfc1224}.

If a system fails shortly after being polled, there may be a significant delay before it is polled again. During this time, the manager must assume that a failing system is acceptable. While improving the mean time to detect failures, it might not greatly improve the time to correct the failure. The problem will generally not be repaired until it is detected.

There are problems attached also to the second method, sending alarms: There is a possibility to lose of critical information and to over-inform the manager. An ideal management system would generate alarms to notify its management station of error conditions. However, alarms cannot usually be delivered when the managed entity fails or the network experiences problems. It is important to remember that failing elements and networks can not be trusted to inform a manager that they are failing. The manager should periodically poll to ensure connectivity to remote stations, and to get copies of alarms that were not delivered by the network~\cite{rfc1224}.

Alarms in a failing system can be generated so rapidly that they impact functioning resources. An "open loop" system in which the flow of alarms to a manager is fully asynchronous can result in an excess of alarms being delivered. There may be a situation where all available network bandwidth into the manager is saturated with incoming alarms, thus preventing the manager from disabling the mechanism generating the alarms. Methods are needed to limit the volume of alarm transmission and to assist in delivering a minimum amount of information to a manager. Alarm correlation is done by filtering secondary alarms, e.g. using expert systems\footnote{Expert systems are discussed briefly on page~\pageref{expertsystems}}.

Many management tools also \textbf{log} events with different formats and different sources. These events should later be correlated using time stamp to identify the source of the problem. Also topology information is needed to identify the precise location of the problem.

\index{logs} Many devices have buffers reserved for logs. When a buffer becomes full, new logs are written over the oldest ones. If the buffer becomes full quickly, some important logs may disappear before they are noticed.  Buffers also consume disk space that could be used for other purposes.


\subsection{Troubleshooting and Fault Localization}

Several diagnostic tools are used for troubleshooting and fault localization purposes. These include ifconfig, arp, netstat, ping, nslookup, dig, ripquery, traceroute, and etherfind~\cite[pages 260--262]{b33}.

\index{ping}\index{packet inter net groper|see{ping}}The \textbf{ping
(Packet InterNet Groper)} program is used with TCP/IP internets to test
reachability of destination hosts by sending an ICMP\index{ICMP} (Internet Control
Message Protocol) echo request and waiting for a reply. Ping can only be
used to determine whether the target IP address is available or not. Since
echo request and response to the request may use different routes, the
violated route cannot be determined. Another usage of ping is to measure
the response times of different packet sizes~\cite[page 33]{b4}.

\index{traceroute} Unlike ping, \textbf{traceroute} forces every
router to send back an ICMP-control message. Most traceroute
applications send a sequence of User Datagram Protocol (UDP)-packets
to a randomly selected UDP-port~\cite[page 202]{b2}. Sometimes the
firewalls filter these packets from the main traffic, in which case
the tracing ends. 

After detecting a fault, operators should as soon as possible find the
root cause of the problem. Clearly defining the problem helps to
isolate the root cause from symptoms~\cite{b22}. Operators must also
determine what troubles it causes and to whom.

At first it is useful to find the parts of the network, where the
fault can not be, by eliminating processes. These parts can be
neglected. If the problem is very serious and difficult, the network
can be divided into smaller parts to be inspected one by
one. Connectivity tests are also used to find the violated devices. At
the same time it can be detected whether the fault is local or
widespread. It can be found out by testing data integrity if some of
the packets are lost in transmission. Delays are also to be tested,
because some faults result from excessive delays~\cite[page 198]{b2}.


\subsection{Testing}

\textbf{Measuring the accessibility} of devices helps us to collect information about the status of the network. A few devices are chosen usually from the network, and the functionality of the connections is measured from them to other devices. Measurements are done by a control device. After measurements, the results are interpreted.

Measuring the accessibility is not a perfect method, for example, in the case where only routers are controlled. If the router has been set up so that it gives preference to packet switching, it will send packets normally even if it is heavily loaded and perhaps can not answer to messages of the controlling device. Another example is that two devices that can be reached might not have a connection with each other.

Another method of testing is to \textbf{control routing tables}. Routing should change only when the topology of the network changes. If there are changes at other times, there is probably
something wrong with the network~\cite[pages 183--189]{b2}.

\index{routing tables} Routing tables express the topology of the network. Finding out the network topology from routing tables is more difficult than controlling accessibility. In order to get information from routing tables of routers, routers must be Simple Network Management Protocol (SNMP)\index{SNMP} compatible, dynamic routing tables must support sending request or routing information must be tapped from a routing protocol. These requirements are not necessarily realized although SNMP is a commonly used protocol. Analysis of the routing tables can concentrate on the parts of the network which are most susceptible to failures.


