SNMP Management Systems and Agent

SNMP Management Systems and Agents

SNMP locates the network management component on one or more computers and locates the managed component on multiple managed devices:

• SNMP manager. An SNMP manager, also known as an SNMP management system or a management console, is any computer that sends queries for IP-related information to a managed computer, known as an SNMP agent. In some cases, the SNMP manager can send a request to an SNMP agent to change a configuration value.
• SNMP agent. An SNMP agent is any computer or other network device that monitors and responds to queries from SNMP managers. The agent can also send a trap message to the manager when specified events, such as a system reboot or illegal access, occur.

A computer on which you install SNMP management software is an SNMP manager, and a computer on which you install agent software, such as the Microsoft SNMP agent included with Windows Server 2003, is an SNMP agent. The SNMP manager displays the information it receives in a user-friendly graphical user interface. You configure SNMP options, including traps, on the SNMP agent, but the SNMP agent does not display the managed information that it sends to an SNMP manager. For more information about SNMP requests and trap messages, see “SNMP Messages” later in this section.

To enable SNMP communications between an SNMP manager and SNMP agents, you configure the SNMP manager and the SNMP agents that it manages as members of an SNMP community. The community name functions like a password to authenticate communications between the SNMP manager and agent. The SNMP community is an SNMP-defined group, not a group defined in the Active Directory directory service. For more information about SNMP communities, see “SNMP Communities” later in this section.

An SNMP manager can request the following types of information from the SNMP agents that it monitors:

• Network protocol identification and statistics
• Dynamic identification (discovery) of devices attached to the network
• Hardware and software configuration data
• Device performance and usage statistics
• Device error and event messages
• Program and application usage statistics

If you assign the SNMP manager write permission for the SNMP agent, the SNMP manager can also send a configuration request to the agent (using a Set message) to change a local parameter. However, Set requests are limited to a small set of client parameters that have read-write access defined. Most client parameters allow only read-only access.

Understanding the Management Information Base (MIB)

When an SNMP manager requests information from an SNMP agent, the SNMP agent retrieves the current value of the requested information from the Management Information Base (MIB). The MIB defines the managed objects that an SNMP manager monitors (or sometimes configures) on an SNMP agent.

Each system in a network (workstation, server, router, bridge, and so forth) maintains a MIB that reflects the status of the managed resources on that system, such as the version of the software running on the device, the IP address assigned to a port or interface, the amount of free hard drive space, or the number of open files. The MIB does not contain static data, but is instead an object-oriented, dynamic database that provides a logical collection of managed object definitions. The MIB defines the data type of each managed object and describes the object.

The MIB Tree

The SNMP-related branches of the MIB tree are located in the internet branch, which contains two main types of branches:

• Public branches (mgmt=2), which are defined by the Internet Engineering Task Force (IETF) RFCs, are the same for all SNMP-managed devices.
• Private branches (private=4), which are assigned by the Internet Assigned Numbers Authority (IANA), are defined by the companies and organizations to which these branches are assigned.

The following figure shows the structure of the SNMP MIB tree. There are no limits on the width and depth of the MIB tree.

Immediately beneath the root of the MIB tree, International Organization for Standardization (iso), is the Organization (org) branch, followed by Department of Defense (dod), and then Internet (internet). Management (mgmt), the main public branch, defines network management parameters common to devices from all vendors. Underneath the Management branch is MIB-II (mib-2), and beneath this are branches for common management functions such as system management, printers, host resources, and interfaces.

The private branch of the MIB tree contains branches for large organizations, organized under the enterprises branch. Each organization has a root branch node under this object. Each organization creates its own subset of MIB branches and objects, which must comply with a common definition of SNMP information known as Structure of Management Information (SMI). SMI defines the allowed data types for MIB objects.

MIB Objects

At the programmatic level, the definition of each MIB object that an SNMP agent manages includes the following elements:

• The object name and object identifier (also known as an OID).
• A text description of the object.
• The object’s data-type definition (such as counter, string, gauge, or address).
• The index for objects that are assigned complex data types. The index specifies the key field for the table — that is, the field that can be used to identify a row.
  
  The only complex SNMP data type that is allowed is a table, and tables cannot be nested. Examples include the list of a system’s network interfaces, a routing table, or the Address Resolution Protocol (ARP) table.
• The level of access to the object (such as read or read/write) that is allowed.
• Size restrictions.
• Range information.

SNMP references each MIB variable by using its unique object identifier, which identifies the location of a given managed object within the MIB namespace. The object identifier reflects the object’s position within the hierarchy of the MIB tree, containing a sequence of subidentifiers that begin at the root of the MIB tree and end at the object (leaf node). Subidentifiers are separated with a period.

To reference a MIB object, you can use either numeric or text subidentifiers. For example, the following text-based object identifier is interchangeable with its numeric counterpart, shown beneath it. The value of this object identifier, in either format, identifies the current operational state of a network adapter.

Interacting with MIB Objects

To understand how SNMP interacts with MIB objects, you must first understand that the SNMP agent consists of a master agent and one or more subagents, also known as extension agents, which are the dynamic link libraries (DLLs) that SNMP uses to process a request received from an SNMP manager.

When the SNMP service starts, it loads each SNMP extension agent that is listed in the registry. When the master agent receives a request from the SNMP manager, it passes the request to an extension agent, which accesses the appropriate MIB and returns the current value of the relevant MIB object to the SNMP master agent. The SNMP agent then returns the information to the SNMP manager. An SNMP agent can also send unsolicited MIB information to the SNMP manager in response to an event that has been defined as an SNMP trap (unexpected event). In some cases, the SNMP agent changes (or sets) the value of the MIB object.

For example, in order to assess the network load at a particular point in your network, you can use SNMP to retrieve the value of a counter that tracks the number of packets sent over a link to the SNMP agent. Or you might use SNMP to retrieve the value that represents the amount of disk space available for storage. Although SNMP is used less commonly to set the value of a MIB object, to ensure that a link is not used, you might use SNMP to set the link state value of a MIB object to a disabled state.

Compiling a New or Updated MIB File by Using Mibcc.exe

As explained earlier, the SNMP-related branches of the MIB tree are located in the internet branch of the tree. The internet branch contains public branches that are defined by the IETF and private branches that are defined by large organizations. When an organization creates its own subset of MIB branches and objects, or updates an existing MIB file, the new or updated MIB file must be created in compliance with SMI-prescribed data types.

If your organization adds or updates a new MIB file, use the Mibcc.exe tool to compile the MIB file so that the SNMP Management API (Mgmtapi.dll) can use the MIB objects in the new or updated MIB file. After you compile the MIB file, you can reference objects by their text object identifiers instead of their numeric object identifiers. The ASN.1 language is used to define the formats of the protocol data units (PDUs) that are exchanged by SNMP entities and to define the objects that are managed through SNMP. Mibcc.exe converts the ASN.1 MIB description into the binary Mib.bin file, which the Management API then uses to map text-based object names to numeric object identifiers.

You can find Mibcc.exe in the C:\Program Files\Resource Kit folder when you install the Windows Server 2003 Resource Kit companion CD. The Mib.bin file is located in systemroot on Windows Server 2003

SNMP And its Working

Simple Network Management Protocol

Use Simple Network Management Protocol (SNMP) management software to monitor any network device configured with SNMP agent software. The SNMP agent, which is an optional component of Windows Server 2003, interacts with third-party SNMP management software to enable the flow of network status information between monitored devices and applications and the management systems that monitor them.

You can use SNMP in environments that include large networks with hundreds or thousands of nodes that would otherwise be difficult and costly to monitor. SNMP allows monitoring of network devices such as servers, workstations, printers, routers, bridges, and hubs, as well as services such as Dynamic Host Configuration Protocol (DHCP) or Windows Internet Name Service (WINS).

SNMP Architecture

To perform its monitoring services, SNMP uses a distributed architecture of management systems and agents and several related components. Windows Server 2003 provides an SNMP agent that is designed to be capable of interacting with any SNMP manager. The following components are the building blocks of SNMP and the Windows Server 2003 SNMP agent:

• SNMP management systems and agents
• Management Information Base (MIB)
• SNMP Messages
• SNMP Communities
• The communication process between SNMP managers and agents 
• 

The internal architecture of the Windows Server 2003 implementation of SNMP is divided into management and agent functions, which, in some cases, overlap. The following figure illustrates how the Windows Server 2003 SNMP structure fits into the layers of the underlying TCP/IP protocol architecture.

Where is Proxy Server used??

Where is a Proxy server used?

Proxy servers are used for several purposes. If it is used as a caching web proxy, it can dramatically improve performance of a web response. When a request is made by a client, a caching proxy returns response directly from its cache if the document already exists. Otherwise, it makes the request to the real server, returns the result, and save it in its cache for later use.

Proxy servers are also used as "web proxies" to filter web page contents. An organization or company may use a proxy server to block offensive web contents from viewed by the users. Considering the growing need within organizations to prevent employees from accessing specific websites, such as facebook.com, proxy servers are being deployed across the computers connected to the intranet. Some web proxies are able to reformat web pages to suit a specific set of audience, or cater certain organizational or personal internet usage purposes. Further, web proxies can be used to prevent the attack of computer viruses and malware, as well as other hostile content transferred across the internet web pages. However, users can also use web proxy servers to access those blocked sites indirectly. These web proxies are built with PHP or CGI to implement the proxying functionality, and provide web access to those sites blocked by corporation and school proxies. Moreover, Internet Service providers (ISPs) may also use proxies to block computer viruses and other offensive contents.

There are several advantages of Proxy servers. We intend to provide some of the most basic uses of proxy servers.

Performance Improvement:

Proxy servers also contribute to improved web performance since the results of the user requests are saved in cache memory for a set period of time. This is achieved with the help of a caching proxy server, which could save a large amount of time while catering to the requests from a vast user load. A caching proxy server maintains a local copy of frequently requested web content. Hence, it can accelerate service requests by retrieving content from the cache memory, if it had already been requested by another client on the same network. This feature contributes to a significant reduction in upstream bandwidth usage and costs for large organizations with thousands of employees.

Monitoring and Filtering User Requests:

As discussed earlier, web proxies can be used to filter user requests, and block certain content or web pages from being accessed. This can be achieved with the help of a content-filtering web proxy server that differentiates the users’ level of control over the content, based on the user type - Guest or Administrator.

Content-filtering proxies are generally used in organizations and educational institutions with strict internet-usage policies. Blocking certain websites, and restricting access to specific key words and censoring undesirable content are some of the basic features provided by content-filtering or web-filtering proxies. However, there are certain web proxies that are used to bypass geo-restrictions and censorship regulations by using certain advanced services that help access resources from blacklisted web locations.

Anonymous Browsing:

An anonymous proxy server is another type of web proxy that anonymizes users' online activities. This type of proxy server directs the user requests to a destination server, which ultimately has no knowledge of the source of the request. Only the proxy is aware of the source of the request, including the user IP address and location.

Advertisements targeting specific geographical regions Web Proxies can also be used to validate and verify geo-targeted advertisements. Servers of such ads validate the source IP address of the user request, and determine the geographic location of the request with the help of a geo-IP database. The user requests are responded via proxy servers that are located within the respective geographical location, to ensure that advertisements displayed are purely relevant to the users’ location.

Translation:

Considering the global audiences, translation proxies have been developed to localize/translate the content of a source website into a local language of the client computer. Responses for requests sent by local users are replaced with translated content from the source website, and passed back through the proxy server. Some translation proxies also provide additional services such as excluding source content or substituting source content with original local content.

Conclusion

The most popular proxy server used today is a Web Proxy, and it is used to filter contents and allow anonymous browsing. Being able to unblock geo-restricted content is also a wide used application for using public web proxies. Although proxies provide anonymous browsing and content filtering, they are mostly limited to web browsing and also lack security. For secure and encrypted communication with privacy protection, we recommend VPN solution.

Proxy Server and its uses

A proxy or proxy server is basically another computer which serves as a hub through which internet requests are processed. By connecting through one of these servers, your computer sends your requests to the proxy server which then processes your request and returns what you were wanting. In this way it serves as an intermediary between your home machine and the rest of the computers on the internet. Proxies are used for a number of reasons such as to filter web content, to go around restrictions such as parental blocks, to screen downloads and uploads and to provide anonymity when surfing the internet.

Why Use a Proxy?

If you are wanting to surf the web anonymously then proxies can provide you with a means to hide your home IP address from the rest of the world. By connecting to the internet through proxies, the home IP address of your machine will not be shown but rather the IP of the proxy server will be shown. This can provide you with more privacy then if you were simply connecting directly to the internet. There are number of proxies that can provide you with service. You can find a list of these simply by typing "Proxy List" into any search engine. There are some proxies which are free and some which charge money, the choice is up to you but we have found that the paid proxies are more reliable, faster and more secure.

What is a proxy server?

Proxy server is a computer that sits between a client computer and the Internet, and provide indirect network services to a client. It may reside on the user's local computer, or at various points between the user's computer and destination servers on the Internet. A proxy server intercepts all client requests, and provide responses from its cache or forwards the request to the real server. A client computer is connected to the proxy server, which acknowledges client requests by providing the requested resource/data from either a specified server or the local cache memory. Client requests include files or any other resources available on various servers.

Types of Proxy Servers

Proxy servers are classified into several types based on purpose and functionality. Some of the most common types and their uses can be described as below:

Web Proxy is the most common type of proxy application, which responds to the user requests by accessing resources from cached web pages and files available on remote web servers. This facilitates quick and reliable access to data for local network clients. If the requested resource is not found in the cache, then a web proxy fetches the file from the remote server, and saves a copy in the cache before returning it to the client.

Transparent Proxy is mostly used for caching websites and overcoming simple IP bans. However, such proxies do not provide any user anonymity since user’s original IP address is exposed. Transparent proxies are not specifically configured on the client computers.

Anonymous proxies do not hide the original IP address of the user; however, they provide adequate anonymity to most users. Anonymous proxies are easily detectable.

A distorting proxy, identifies itself as a proxy server, and modify the HTTP headers to disguise the original IP address.

Tunneling proxies are capable of passing client requests and return responses without making any modifications. These are also referred to as gateway proxies.

A forward proxy responds to client requests by retrieving data from a wide range of sources on the internet. It is also referred to as an Internet-facing proxy.

Open proxies belong to the category of forwarding proxy servers, which are accessible by any internet user since they can receive and return requests from any client computer. Meanwhile, anonymous open proxies are used for user anonymity to conceal the IP address.

Reverse proxies, also known as surrogates, usually receive requests from the Internet and forward them to internal network servers. A reverse proxy server forwards requests to one or more proxy servers, whose response is returned to the client computer, the user of which has no knowledge on the origin of the response.

Configure Network Load Balancing (NLB) based cluster of VPN Servers

How network load balancing cluster enhances scalability of vpn server?

To create a NLB VPN cluster each host runs Remote Access (VPN) Service & NLB Service. NLB allows all of the computers in the cluster to be addressed by the same cluster IP address. NLB distributes incoming client requests across the vpn servers in the cluster. The load weight to be handled by each vpn server can be configured as necessary. You can also add a vpn server dynamically to the cluster to handle increased load. In addition, NLB can direct all traffic to a designated single vpn server, which is called the default host.

How network load balancing cluster ensures high availability of vpn server?

When a vpn server fails or goes offline, active connection to the failed or offline server are lost. But new connection request is automatically redistributed among the vpn servers that are still operating. However, if you bring a host down intentionally, you can use “drainstop” command to service all active connection prior to bringing the computer offline. Drainstop allows the host to continue surviving active connections but disables all new traffic to that host.

How to configure a NLB cluster?

To configure the Network Load Balancing (NLB) cluster, you must configure three types of the parameters:

• Host parameters, which are specific to each host in a NLB cluster.
• Cluster parameters, which apply to an NLB cluster as a whole.
• Port rules, which control how the cluster functions. By default, a port rule equally balances all TCP/IP traffic across all servers.

In the following section we will describe step by step guide to deploy an nlb cluster of vpn servers for test lab.

Verification step to make sure vpn server is configured properly before installing nlb:

1. Assign satic ip to vpn-server1 (say 201.0.0.1), vpn-server2 (say 201.0.0.2) [Note: NLB does not support DHCP. NLB disables DHCP on each interface that it configures, so the IP addresses must be static]

2. Ensure client is able to make vpn connection to both the servers for different tunnel types (PPTP, L2TP, SSTP or IKEv2).

Install & Configure NLB in vpn-servers:

3. Install NLB in vpn-server1 & vpn-server2.

4. Create a new cluster using the NLB manager [Open nlbmgr.msc (in Administrative tools)] of vpn-server1 according the steps mentioned below. Add host to the cluster, choose priority of the host & assign cluster IP (say 201.0.0.11).

a) Add new host to the cluster:

Give host name or ip address and select the interface of the host for configuring cluster.

Select cluster operation mode as unicast to specify that a unicast media access control (MAC) address should be used for cluster operation. In this mode, the MAC address of the cluster is assigned to the network adapter of the computer, and the built-in MAC address of the network adapter is not used. Unicast is the default setting for Cluster operation mode.

 5) Configuring Port Rules:

· Select Affinity Single or Network to ensure that all network traffic from a particular client is directed to the same host.

· Select Filtering mode to Multiple hosts or Single host considering the following:

 The Multiple hosts parameter specifies that multiple hosts in the cluster will handle network traffic for the associated port rule. This filtering mode provides scaled performance and fault tolerance by distributing the network load among multiple hosts. You can specify that the load be equally distributed among the hosts or that each host will handle a specified load weight.

 The Single host parameter specifies that network traffic for the associated port rule be handled by a single host in the cluster according to the specified handling priority. This filtering mode provides port specific fault tolerance for handling network traffic.

6. Ensure both the server got same MAC Address for that interface & Cluster IP. [Note: NLB automatically instructs the driver that belongs to the cluster adapter to override the adapter’s unique, built-in network address and to change its MAC address to the cluster’s MAC address. This is the address used on all cluster hosts.]

Verification after configuring nlb cluster for vpn server:

7. Make Connection from the client using Cluster IP. Connection should succeed & it should be connected to high priority server (vpn-sever1 in this case).

8. Give nlb drainstop on vpn-server1.

9. Drainstop allows the host to continue surviving active connections but disables all new traffic to that host. All new connections should go to vpn-server2.

10. Give nlb drainstop on the vpn-server2.

11. Now all new connections should fail since both the servers are in “drainstop” mode.

12. Give nlb start.

13. Client should be able to connect to vpn-server1.

VPN configurations for Firewall

When designing a virtual private network (VPN) remote access solution that involves network firewalls, you typically choose between the following two options for server placement. Each option has different design requirements.

• VPN server behind a firewall.The firewall is attached to the Internet, with the VPN server between the firewall and the intranet. This is the placement used in a typical perimeter network configuration, in which one firewall is positioned between the VPN server and the intranet and another firewall is positioned between the VPN server and the Internet.
  
  
• VPN server in front of a firewall. The VPN server is connected directly to the Internet, with the firewall between the VPN server and the intranet.

VPN server behind a firewall

In the configuration shown in the following figure, the firewall is connected to the Internet and the VPN server is an intranet resource on the perimeter network. The perimeter network is an IP network segment that typically contains resources available to Internet users, such as Web servers and FTP servers. The VPN server has an interface on both the perimeter network and on the private intranet.

In this approach, the firewall must be configured with input and output filters on its Internet and perimeter network interfaces to allow the passing of tunnel maintenance traffic and tunneled data to the VPN server. Additional filters can allow the passing of traffic to Web servers, FTP servers, and other types of servers on the perimeter network. As an added layer of security, the VPN server should also be configured with Point-to-Point Tunneling Protocol (PPTP), Secure Socket Tunneling Protocol (SSTP), or Layer Two Tunneling Protocol (L2TP)/Internet Protocol security (IPsec) packet filters on its perimeter network interface as described in “VPN server in front of a firewall” in this topic.

Because the firewall does not have the encryption keys for each VPN connection, it can only filter on the plaintext headers of the tunneled data, meaning that all tunneled data passes through the firewall. However, this is not a security concern because the VPN connection requires an authentication process that prevents unauthorized access beyond the VPN server.

Packet filters for a VPN server behind a firewall

If the VPN server is behind a firewall, packet filters must be configured for both an Internet interface and a perimeter network interface. In this scenario, the firewall is connected to the Internet and the VPN server is an intranet resource that is connected to the perimeter network. The VPN server has an interface on both the perimeter network and the Internet.

VPN server in front of a firewall.

With the VPN server in front of the firewall and connected to the Internet, as shown in the following figure, administrators need to add packet filters to the Internet interface that allow only VPN traffic to and from the IP address of the VPN server’s interface on the Internet.

For inbound traffic, when the tunneled data is decrypted by the VPN server, it is forwarded to the firewall, which uses its filters to allow the traffic to be forwarded to intranet resources. Because the only traffic that is crossing the VPN server is traffic generated by authenticated VPN clients, firewall filtering in this scenario can be used to prevent VPN users from accessing specified intranet resources.

Because the only Internet traffic allowed on the intranet must go through the VPN server, this approach also prevents the sharing of intranet resources with non-VPN Internet users.

Packet filters for a VPN server in front of a firewall

When a VPN server is in front of a firewall and connected to the Internet, inbound and outbound packet filters on the VPN server must be configured to allow only VPN traffic to and from the IP address of the VPN server’s Internet interface. Use this configuration if the VPN server is in a perimeter network, with one firewall positioned between the VPN server and the intranet and another between the VPN server and the Internet.

Which VPNs Are The Best?

Which VPNs Are The Best?

When we ran our recent Hive Five on VPN service providers, we heard from VPN providers begging to be included, angry CEOs who claimed their company was maliciously left out, and others accusing some of the contenders of illegal or unethical behavior. We took at look at the poll and the claims, and while there's no definitive proof the poll was gamed, we decided to come up with our own top five, based on our own research rather than reader feedback, that are great whether you're the privacy advocate, the student, or the downloader.

Private Internet Access

Supports: Windows, OS X, Linux, iOS, Android
Protocols: SSL, PPTP, IPSec, and L2TP. You can also configure Private Internet Access to work on your DD-WRT or Tomato router (via SSL/OpenVPN) for constant security.
Home Country: United States, and has exit servers in the US, Canada, the UK, Switzerland, Romania, and the Netherlands.
Logging Policies: The service keeps no logs of your activity whatsoever (in fact, the only things they do keep are your email address and payment information,) uses shared IPs, and has committed to keeping your data private.

proXPN

Supports: Windows, OS X, iOS
Protocols: SSL, PPTP.
Home Country: United States, with exit servers in the US, The Netherlands, Singapore, and the UK.
Logging Policies: proXPN keeps minimal logs of your activity. proXPN collects your email address, payment information (if you're a premium user,) bandwidth usage, connection duration, and login/logout times. They've committed to only keeping those logs for 14 days or less, and promise to never share their logs with anyone, period.

TorVPN

Supports: Windows, OS X, Linux, iOS, Android
Protocols: SSL (they often refer to it as OpenVPN), PPTP, and full SSH tunneling.
Home Country: Hungary, with exit servers in Hungary.
Logging Policies: The service doesn't log your connection aside from bandwidth usage to compare against your quota, and your payment details. They also are committed to your privacy, and specifically say they won't surrender their data without a Hungarian court order.

TorGuard

Supports: Windows, OS X, Linux, and iOS and Android via built-in VPN
Protocols: SSL (OpenVPN), PPTP, and L2TP, (with 256 bit security)
Home Country: Panama, with exit servers in The Netherlands, Romania, Ukraine and Panama.
Logging Policies: TorGuard wholeheartedly supports privacy, so you can feel a bit more secure that your connection is secure and anonymous. They purge their logs daily, and only keep payment information and registration info. They don't even keep login/logout times.

WiTopia

Supports: Windows, OS X, Linux, iOS, Android, webOS, Chromebooks.
Protocols: SSL, PPTP, IPSec, and L2TP (with 256 bit security)
Home Country: United States, with exit servers in 10 US cities, and countries in Latin and South America, Asia, Australia, Europe, Africa, and the Middle East—way too many to list here.
Logging Policies: WiTopia does not log information that can be attributable to individual users, purges logs weekly, and only saves registration information and payment details when you sign up.

Alternatively, Roll Your Own VPN

We've shown you how to roll your own VPN using Hamachi, and even how to set up Privoxy to secure your web browsing once you have your personal VPN set up. Hamachi isn't the only option: you can also download and configure OpenVPN (a free SSL VPN) on your own home server,, or if you have a router that supports it, enable OpenVPN on your home router so you can connect back to it when you're abroad. Combined with Privoxy, you get the privacy and anonymity benefits of a VPN without spending a dime.

Both of these options put control in your hands, and while they're not quite as anonymous as subscription methods or offer international exit locations, they do give you the the most important benefits of a VPN: security, privacy, and anonymity while you're away from home.