Network Management: Accounting and Performance Strategies
The definitive guide to collecting usage information from Cisco networks
Benoit Claise, CCIE® No. 2868
Ralf Wolter
Understanding network performance and effectiveness is now crucial to business success. To ensure user satisfaction, both service providers and enterprise IT teams must provide service-level agreements (SLA) to the users of their networks–and then consistently deliver on those commitments. Now, two of the Cisco® leading network performance and accounting experts bring together all the knowledge network professionals need to do so.
Network Management: Accounting and Performance Strategies imparts a deep understanding of Cisco IOS® embedded management for monitoring and optimizing performance, together with proven best strategies for both accounting and performance management.
Benoit Claise and Ralf Wolter begin by introducing the role of accounting and performance management in today’s large-scale data and voice networks. They present widely accepted performance standards and definitions, along with today’s best practice methodologies for data collection.
Next, they turn to Cisco devices and the Cisco IOS Software, illuminating embedded management and device instrumentation features that enable you to thoroughly characterize performance, plan network enhancements, and anticipate potential problems and prevent them. Network standards, technologies, and Cisco solutions covered in depth include Simple Network Management Protocol (SNMP) and Management Information Bases (MIB), Remote Monitoring (RMON), IP accounting, NetFlow, BGP policy accounting, AAA Accounting, Network Based Application Recognition (NBAR), and IP SLA (formerly known as SAA). For each, the authors present practical examples and hands-on techniques.
The book concludes with chapter-length scenarios that walk you through accounting and performance management for five different applications: data network monitoring, capacity planning, billing, security, and voice network performance.
Network Management: Accounting and Performance Strategies will be indispensable to every professional concerned with network performance, effectiveness, or profitability, especially NMS/OSS architects, network and service designers, network administrators, and anyone responsible for network accounting or billing.
Benoit Claise, CCIE® No. 2868, is a Cisco Distinguished Engineer working as an architect for embedded management and device instrumentation. His area of expertise includes accounting, performance, and fault management. Claise is a contributor to the NetFlow standardization at the IETF in the IPFIX and PSAMP Working Groups. He joined Cisco in 1996 as a customer support engineer in the Technical Assistance Center network management team and became an escalation engineer before joining the engineering team.
Ralf Wolter is a senior manager, consulting engineering at Cisco. He leads the Cisco Core and NMS/OSS consulting team for Europe, works closely with corporate engineering, and supports large-scale customer projects. He specializes in device instrumentation related to accounting and performance management.
- Compare accounting methods and choose the best approach for you
- Apply network performance best practices to your network
- Leverage built-in Cisco IOS network management system components to quantify performance
- Uncover trends in performance statistics to help avoid service degradation before it occurs
- Identify under use of network paths, so you can improve overall network efficiency
- Walk through hands-on case studies that address monitoring, capacity planning, billing, security, and voice networks
- Understand Cisco network performance, deliver on your SLAs, and improve accounting and billing
This book is part of the Networking Technology Series from Cisco Press®, which offers networking professionals valuable information for constructing efficient networks, understanding new technologies, and building successful careers.
Table of Contents:
Part I Data Collection and Methodology Standards 3
Chapter 1 Understanding the Need for Accounting and Performance Management 5
Definitions and the Relationship Between Accounting and Performance
Management 11
Defining Accounting Management 11
Defining Performance Management 13
The Relationship Between Accounting and Performance 17
A Complementary Solution 20
The Purposes of Accounting 22
Network Monitoring 22
User Monitoring and Profiling 24
Application Monitoring and Profiling 26
Capacity Planning 31
Traffic Profiling and Engineering 34
Peering and Transit Agreements 37
Billing 43
Security Analysis 57
Purposes of Performance 61
Device Performance Monitoring 62
Network Performance Monitoring 65
Service Monitoring 66
Baselining 68
Fault Management 70
Applying the Information to the Business 74
Summary 80
Chapter 2 Data Collection Methodology 85
Data Collection Details: What to Collect 86
What Are the Keys? 89
What Are the Values? 89
What Are the Required Versus Nice-to-Have Types of Data? 93
Data Types List 93
Example: Application Monitoring 94
Example: Traffic Matrix 98
Example: SLA Monitoring 99
Defining the User 100
Metering Methods: How to Collect Data Records 102
Active Versus Passive Monitoring 103
Passive Monitoring Concepts 104
Active Monitoring Concepts 120
Best Practice: How to Position Active and Passive Monitoring 128
Outlook: Passive Monitoring for One-Way Delay Analysis 129
Metering Positions: Where to Collect Data Records 130
Network Element Versus End Device Collection 130
Edge Versus Core Collection 132
Embedded Versus External Device Collection 136
Ingress Versus Egress Collection 138
Flow Destination or Source Lookup 140
Technology-Dependent Special Constraints 141
Collection Infrastructure: How to Collect Data Records 144
Pull Versus Push Model 144
Event-Based Model 145
Export Protocols 146
Network Design for the Collection Infrastructure 151
Communication Concepts 152
Collection Server Concepts 154
Mediation Device Functionality: How to Process Data Records 157
Filtering 157
Estimation from Sampling 159
Threshold Monitoring 159
Data Aggregation 160
Data Record Correlation and Enrichment 164
Flow De-Duplication 165
Data Record Formatting and Storage 165
Security Considerations: How to Ensure Data Authenticity and Integrity 167
Source Authentication 167
Ensuring Data and Device Integrity 168
Denial-of-Service (DoS) Attacks 169
Summary 170
Chapter 3 Accounting and Performance Standards and Definitions 173
Understanding Standards and Standards Organizations 173
Architectural and Framework Standards: The TMN/FCAPS Model (ITU-T) 176
Fault Management 180
Configuration Management 181
Accounting Management 181
Performance Management 182
Security Management 183
The TMN Framework 184
Architectural and Framework Standards: the eTOM Model (TMF) 185
Informational IETF Standards 189
IETF RFC 2924, Accounting Attributes and Record Formats 189
IETF RFC 2975, Introduction to Accounting Management 189
Information Modeling 190
Data Collection Protocols: SNMP, SMI, and MIB 191
Internet Management Model and Terminology 191
MIB Modules and Object Identifiers 193
SMI Definitions 194
SNMP Versions 196
References for SMIv1 and SMIv2 199
Data Collection Protocols: NetFlow Version 9 and IPFIX Export Protocols 201
NetFlow Version 9 Export Protocol 202
IPFIX 208
Data Collection Protocols: PSAMP 212
PSAMP Protocol Specifications 212
PSAMP References 213
Data Collection Protocols: AAA (RADIUS, Diameter, and TACACS+) 214
RADIUS 214
TACACS+ 216
Diameter 216
Data Collection Protocols: IPDR 217
Data Collection Protocols: CMISE/CMIP and GDMO 218
Service Notions 219
Summary 222
Part II Implementations on the Cisco Devices 225
Chapter 4 SNMP and MIBs 227
MIBs 228
IOS Support for SNMP Versions 229
net-snmp Utilities 229
CLI Operations and Configuration Example for SNMPv2c 230
SNMPv2c Configuration Example 230
SNMPv2c Data Retrieval 231
Displaying SNMPv2c Statistics 231
CLI Operations and Configuration Examples for SNMPv3 231
authNoPriv SNMP Example 233
authPriv SNMP Example 235
MIB Table Retrieval Example 235
MIB Functional Area Comparison Table 237
General-Purpose MIBs for Accounting and Performance 239
MIB-II (RFC 1213), IF-MIB (RFC 2863), and CISCO-IF-EXTENSION-MIB 240
CISCO-PING-MIB 241
CISCO-PROCESS-MIB 242
CISCO-ENVMON-MIB and CISCO-HEALTH-MONITOR-MIB 244
CISCO-MEMORY-POOL-MIB 244
CISCO-DATA-COLLECTION-MIB 244
Advanced Device Instrumentation 247
Technology-Specific MIBs for Accounting and Performance 247
Frame Relay 247
IPv6 251
Multicast 252
VLAN 253
Traffic Management and Control 255
Telephony 257
Creating New MIB Objects: EXPRESSION-MIB 265
EXPRESSION-MIB Examples 266
EVENT-MIB Associated with EXPRESSION-MIB 268
Obtaining MIBs 269
Chapter 5 RMON 273
RMON 1 and RMON 2 MIBs 273
RMON Principles 277
Supported Devices and IOS Versions 277
Cisco NAM Modules 278
CLI Operations 279
SNMP Operations 280
Examples 282
DSMON MIB 284
DSMON MIB Principles 286
Supported Devices and IOS Versions 286
CLI Operations 286
SNMP Operations 286
Examples 287
SMON MIB 287
Supported Devices and IOS Versions 288
CLI Operations 288
SNMP Operations 288
Examples 289
Collection Monitoring 289
APM MIB and ART MIB 289
Supported Devices and IOS Versions 291
CLI Operations 291
SNMP Operations 291
Examples 291
Collection Monitoring 291
Applicability 292
Further Reading 293
Chapter 6 IP Accounting 297
IP Accounting (Layer 3) 298
IP Accounting (Layer 3) Principles 298
Supported Devices and IOS Versions 299
CLI Operations 299
SNMP Operations 300
Examples (CLI and SNMP) 301
IP Accounting Access Control List (ACL) 303
IP Accounting ACL Principles 304
Supported Devices and IOS Versions 304
CLI Operations 304
SNMP Operations 305
Examples (CLI and SNMP) 305
IP Accounting MAC Address 308
IP Accounting MAC Address Principles 308
Supported Devices and IOS Versions 309
CLI Operations 309
SNMP Operations 310
Examples (CLI and SNMP) 311
IP Accounting Precedence 312
IP Accounting Precedence Principles 313
Supported Devices and IOS Versions 313
CLI Operations 314
SNMP Operations 314
Examples (CLI and SNMP) 315
Applicability 317
Chapter 7 NetFlow 319
Fundamentals of NetFlow 322
Flow Definition 322
Cache Concept 325
Aging Flows on a Router 327
Aging Flows on a Catalyst 328
Export Version and Related Information Elements 329
Supported Interfaces 339
Export Protocol: UDP or SCTP 340
NetFlow Device-Level Architecture: Combining the Elements 342
Cisco NetFlow Collector 344
CLI Operations 345
SNMP Operations with the NETFLOW-MIB 346
Example: NetFlow Version 5 on a Router 347
Example: NetFlow Configuration on the Catalyst 348
Example: NetFlow Version 8 350
Example: NetFlow Version 9 350
New Features Supported with NetFlow Version 9 351
SCTP Export 351
Sampled NetFlow 353
NetFlow Input Filters 358
MPLS-Aware NetFlow 360
BGP Next-Hop Information Element 362
NetFlow Multicast 363
NetFlow Layer 2 and Security Monitoring Exports 365
Top Talkers 366
Flexible NetFlow 370
Deployment Guidelines 385
Supported Devices and IOS Versions 387
Chapter 8 BGP Policy Accounting 389
Input BGP Policy Accounting 390
Output BGP Policy Accounting 391
Summary of All Four BGP Policy Accounting Combinations 392
Fundamentals 393
BGP Policy Accounting Commands 394
SNMP Operations 395
Examples (CLI and SNMP) 396
Initial Configuration 396
Collection Monitoring 397
Destination-Sensitive Services 398
Destination-Sensitive Billing 398
Destination-Sensitive Traffic Shaping (DSTS) 399
Applicability 400
Chapter 9 AAA Accounting 403
Fundamentals of AAA Accounting 405
High-Level Comparison of RADIUS, TACACS+, and Diameter 406
RADIUS 407
RADIUS Attributes 409
RADIUS CLI Operations 415
Voice Extensions for RADIUS 416
Diameter Details 428
Chapter 10 NBAR 433
NBAR Functionality 434
Distributed NBAR 435
NBAR Classification Details 435
NBAR Packet Description Language Module (PDLM) 437
NBAR Scope 438
Supported Devices and IOS Versions 438
NBAR Protocol Discovery (PD) MIB 439
NBAR Supported Protocols 440
NBAR Protocol Discovery Statistics 440
NBAR Top-N Statistics 441
NBAR Protocol Discovery Thresholds, Traps, and History 442
NBAR Configuration Commands 443
NBAR show Commands 443
NBAR Examples (CLI and SNMP) 445
Basic NBAR Configuration 445
Custom Application Example 446
Limiting Peer-to-Peer Traffic 447
HTTP Requests Payload Inspection 447
NBAR Applicability 449
Chapter 11
IP SLA 451
Measured Metrics: What to Measure 453
Network Delay 454
Jitter 454
Packet Loss 455
Measurement Accuracy 455
TCP Connect 456
DHCP and DNS Response Time 456
HTTP Response Time 456
Linking Metrics to Applications 456
Operations: How to Measure 457
Operations Parameters 457
MPLS VPN Awareness 459
IP SLA Responder 459
Operation Types 463
IP SLA CLI Operations 480
SNMP Operations with the CISCO-RTTMON-MIB 482
Application-Specific Scenario: HTTP 483
Application-Specific Scenario: VoIP 486
Advanced Features 488
Scheduling 488
Distribution of Statistics 491
History Collection 494
Thresholds and Notifications 495
Enhanced Object Tracking for IP SLA 499
Implementation Considerations 501
Supported Devices and IOS Versions 501
Performance Impact 503
Accuracy 504
Security Considerations 506
IP SLA Deployment 507
Chapter 12 Summary of Data Collection Methodology 515
Applicability 515
Part III Assigning Technologies to Solutions 523
Chapter 13 Monitoring Scenarios 525
Network Blueprint for Monitoring 525
Device and Link Performance 526
Network Connectivity and Performance 530
Application Monitoring 534
Service Monitoring and Routing Optimization 536
Chapter 14 Capacity Planning Scenarios 541
Link Capacity Planning 541
Network Blueprint for Capacity Planning 543
Problem Space 544
Capacity Planning Tools 546
Methods for Generating the Core Traffic Matrix 548
NetFlow BGP Next Hop ToS Aggregation 551
Flexible NetFlow 552
MPLS-Aware NetFlow 553
BGP Passive Peer on the NetFlow Collector 554
BGP Policy Accounting 555
Other Methods 556
Additional Considerations: Peer-to-Peer Traffic 557
Summary 557
Chapter 15 Voice Scenarios 559
Network Blueprint for IP Telephony 560
Voice Performance Measurement 561
Standards and Technology 561
Network Elements in the Voice Path 564
Cisco CallManager (CCM) 565
Application Examples 570
Voice Accounting 573
Standards and Technology 573
Network Elements in the Voice Path 574
Gateway, Gatekeeper, Multimedia Conference Manager 575
Cisco CallManager (CCM) 575
Application Example 575
Is Your Network Ready for IP Telephony? 577
Chapter 16 Security Scenarios 579
Network Blueprint for Security Management 580
Security Management Process 582
Preparation 583
Identification 584
Classification 587
Trace Back 591
Reaction 593
Postmortem 594
Summary 596
Chapter 17 Billing Scenarios 599
Network Blueprint for Billing 600
Billing Approaches 602
Time-Based Billing 602
Volume-Based Billing 603
Destination-Sensitive Billing 606
Time- and Distance-Based Billing 606
Service-Based Billing 607
Enterprise Departmental Charge Back 608
Flat Rate Billing 609
Summary 609
About the Author :
Benoit Claise, CCIE No. 2686, is a Cisco Distinguished Engineer working as an architect for embedded
management and device instrumentation. His area of expertise includes accounting, performance,
and fault management. Claise is a contributor to the NetFlow standardization at the IETF in the IPFIX
and PSAMP working groups. He joined Cisco in 1996 as a customer support engineer in the Technical
Assistance Center network management team. He then became an escalation engineer before joining the
engineering team.
Ralf Wolteris a senior manager, Consulting Engineering at Cisco Systems. He leads the Core and NMS/OSS consulting team for Europe and works closely with corporate engineering, as well as supporting
large customer projects. His special field of interest is device instrumentation, related to
accounting and performance management. He joined Cisco in 1996 as a systems engineer. He has provided
technical leadership for many large network management projects in Europe, the Middle East,
and Africa. Before his current position, he worked as a networking consultant at AT&T/NCR, focusing
on the design and management of data networks.
