-
Cisco DDoS Multi-Device Management System Configuration Guide (Software Release 1.5)
-
Index
-
Preface
-
Product Overview
-
Getting Started
-
Managing Devices on the MDM Network
-
Resolving Conflicts and Synchronizing Zones
-
Creating and Configuring Zones
-
Managing Zone Filters
-
Managing Zone Policy Templates
-
Managing Zone Policies
-
Learning Zone Traffic and Taking Snapshots
-
Activating Anomaly Detection and Zone Protection
-
Monitoring Zone and Device Operations
-
Troubleshooting Problems with the MDM
-
Table Of Contents
Managing Devices on the MDM Network
Preparing the Device for Operation with the MDM
Configuring a Device to Connect with the MDM
Adding a Device to the MDM Device List
Displaying the MDM Device List
Displaying Device Resource Information
Exchanging Certificates and Keys
Enabling or Disabling Communication with a Device
Managing Devices on the MDM Network
This chapter describes how to prepare and manage the Detector and Guard devices that you want to include in the Cisco DDoS MultiDevice Manager (MDM) network. Some of the initial action items described in this chapter involve using the device's CLI to configure device-side operational attributes prior to configuring the MDM with the device information.
Note
This guide refers to the Cisco Traffic Anomaly Detector Module and the Cisco Traffic Anomaly Detector appliance as Detector and the Cisco Anomaly Guard Module and the Cisco Guard appliance as Guard. When referring to both the Detector and the Guard, this guide uses the term device.
This chapter contains the following sections:
•
•
•
•
•
•
•
Preparing the Device for Operation with the MDM
Before you can use the MDM to manage your Detector and Guard devices, you must first ensure that your devices are installed and configured as described in the appropriate device configuration guide (see the "Related Documentation" section in the Preface). Perform the initial device configuration process using the CLI.
Note
Verify that you have configured the following items on each device to ensure proper network operation and communication with the MDM:
•
•
•
•
Configuring a Device to Connect with the MDM
Use the device's CLI to enable the MDM service and to permit network access to the device from the MDM. You must log on as a user with either administration or configuration user privilege level rights to make the necessary configuration changes. For detailed information on accessing and using the device CLI, see the appropriate configuration guide listed in the "Related Documentation" section of the Preface.
Caution
To enable the MDM service and permit network access, follow these steps:
Step 1
Step 2
admin@DEVICE# configureStep 3
admin@DEVICE-conf# service mdmStep 4
admin@DEVICE-conf# mdm server ip-addr [ip-mask]The ip-addr and ip-mask arguments define the IP address of your MDM server.
The following example shows how to configure the network access for an MDM that connects from IP address 192.168.30.32:
admin@DEVICE# configureadmin@DEVICE-conf# service mdmadmin@DEVICE-conf# server mdm 192.168.30.32After configuring the network access for the MDM on the device, you may exit the CLI. The device is now ready for you to add to the MDM device list.
Adding a Device to the MDM Device List
The MDM device list defines the devices that the MDM is to manage and associate with the zone configurations. To allow the MDM to communicate with a device on the list, you must enable the MDM service and define the MDM server on the device (see the "Configuring a Device to Connect with the MDM" section).
Caution
To add a device to the MDM device list, follow these steps:
Step 1
•
•
The Network Summary menu and screen appear.
Step 2
Step 3
Step 4
Step 5
After adding a device to the device list, you need to initiate a certificate exchange so that the MDM and the device can establish an SSL session (see the "Exchanging Certificates and Keys" section).
Displaying the MDM Device List
The MDM device list provides you with a summary view of the devices that you have associated with the MDM. From this screen, you can determine the status of each device listed, such as whether the MDM is communicating with the device, the number of zones configured on the device, memory usage, and so on.
To display the MDM device list, follow these steps:
Step 1
•
•
The Network Summary menu and screen appear.
Step 2
Table 3-2 describes the fields of the Device List table.
Displaying Device Resource Information
You can monitor the resources associated with a specific device listed in the MDM Device List screen. The MDM Device Resources table lets you monitor the resource and status information for the specified device.
Note
To display the MDM Device Resources table, follow these steps:
Step 1
•
•
The Network Summary menu and screen appear.
Step 2
Step 3
Step 4
Table 3-3 describes the fields of the Device Resources table.
Table 3-3 MDM Device Resources Table Fields
Host CPU1
Percentage of CPU time for CPU1 in user mode, system mode, niced tasks (tasks with a nice value, which represents the priority of a process, that is negative), and idle. Niced tasks are also counted in system time and user time so that the total CPU utilization can be more than 100 percent.
Host CPU2
(Field visible in Detector or Guard appliance only) Percentage of CPU time for CPU2 in user mode, system mode, niced tasks (tasks with a nice value, which represents the priority of a process, that is negative), and idle. Niced tasks are also counted in system time and user time so that the total CPU utilization can be more than 100 percent.
Disk Space Usage
(Field visible in Detector or Guard appliance only) Percentage of the allocated disk space that the monitored device (Detector or Guard) is using. When the disk space usage reaches approximately 75 percent of the disk or flash maximum capacity (device dependent), the device displays a warning message in its syslog and sends a trap. If the disk space reaches 80 percent, follow the guidelines described in the associated CLI configuration guide (see the "Related Documentation" section in the Preface for a list of the related documentation).
Flash Space Usage
(Field visible in Detector or Guard module only) Percentage of the allocated disk space that the monitored device (Detector or Guard) is using. When the disk space usage reaches approximately 75 percent of the disk or flash maximum capacity (device dependent), the device displays a warning message in its syslog and sends a trap. If the disk space reaches 80 percent, follow the guidelines described in the associated CLI configuration guide (see the "Related Documentation" section in the Preface for a list of the related documentation).
Accelerator Card Memory Usage
Percentage of memory that the accelerator card is using. If the monitored device is either the Guard module or the Detector module, the memory usage is specified on a per-port basis: 1 port for 1-Gbps operation; 2 ports for 2-Gbps operation (Detector module only); 3 ports for 3-Gbps operation (Guard module only).
If the accelerator card memory usage is higher than 85 percent, the Detector or Guard generates an SNMP trap. A high value may indicate that the device is monitoring a high volume of traffic.
Accelerator Card CPU Utilization
Percentage of the accelerator card CPU utilization. If the monitored device is either the Guard module or the Detector module, the CPU utilization is specified on a per-port basis: 1 port for 1-Gbps operation; 2 ports for 2-Gbps operation (Detector module only); 3 ports for 3-Gbps operation (Guard module only).
If the accelerator card CPU utilization is higher than 85 percent, the Detector or Guard generates an SNMP trap. A high value may indicate that the device is monitoring a high volume of traffic.
Top Proxy Usage
(Guard devices only) Percentage of the proxy ports being used on a per-device port basis. The Guard module can operate at two different bandwidth performance levels: 1 Gigabit per second (Gbps) or 3 Gbps.
Anomaly Detection Engine Used Memory
Specifies the percentage of memory that the Detector or Guard statistical engine uses. The anomaly detection engine memory usage is affected by the number of active zones, the number of services each of the zones monitors, and the amount of nonspoofed traffic that the device is monitoring.
If the anomaly detection engine memory usage is higher than 90 percent, we strongly recommend that you lower the number of active zones.
Dynamic Filters Used
Total number of dynamic filters that are active in all the zones. The Detector or Guard displays the number of active dynamic filters and the percentage of dynamic filters that are active out of the total number of dynamic filters that the device supports, which is 150,000. If the number of active dynamic filters reaches 150,000, the Detector or Guard generates an SNMP trap with a severity level of EMERGENCY. If the number of active dynamic filters reaches 135,000, the device generates an SNMP trap with a severity level of WARNING.
A high value may indicate that the Detector or Guard is monitoring a high traffic volume of a DDoS attack.
Number of Zones
Number of zones configured on the device.
Number of Attacked Zones
Number of zones configured on the device currently under attack.
Number of Active Zones
Number of zones configured on the device that are currently performing any of the following operations:
•
•
•
The MDM displays a value of N/A if it does not have an established communication path with the device as indicated by the State field.
Exchanging Certificates and Keys
Communication between the MDM and the devices is performed using Secure Sockets Layer (SSL). SSL provides a secure means for exchanging data between a device (the client) and the MDM server through privacy, authentication, and data integrity. SSL relies upon certificates and private-public key pairs for this level of security. The keys used for data encryption and the certificates provide proof of identity. To establish an SSL session, the device and the MDM server perform an SSL handshake, during which they exchange their public keys and self-signed certificates.
After adding a new device to the MDM device list, you must initiate a certificate exchange to allow the MDM and the device to perform an SSL handshake and exchange self-signed certificates and public keys. You can only initiate the certificate exchange process on one device at a time.
To initiate a certificate exchange, follow these steps:
Step 1
•
•
The Network Summary menu and screen appear.
Step 2
Step 3
Step 4
Step 5
Step 6
After the MDM and the device complete the SSL handshake, the MDM initializes the device, the MDM performs the following:
•
•
–
–
–
While the MDM initializes the device, the device state changes to Initializing. When initialization is complete, the state changes to Connected. To display the changes to the device state, you must refresh the MDM window.
Note
The MDM maintains a periodic update mechanism that is performed once every five minutes to coordinate the time difference between the MDM and the devices across the network. This periodic update is performed to prevent a time mismatch between the MDM and a device in case a time change has occurred.
Pinging a Device
From the Device List page, you can use the ICMP Ping option to test the communication path between the MDM and a device on the device list.
To ping a device, follow these steps:
Step 1
•
•
The Network Summary menu and screen appear.
Step 2
Step 3
Step 4
Enabling or Disabling Communication with a Device
To manage the ability of the MDM to communicate with the device, you can enable or disable the communication channel between the MDM and a device. Disabling communication with a device does not affect the current operating state of the device. For example, if you disable communication with a Guard that currently has Protect active for a zone, the Guard continues to protect the zone.
Note
To enable or disable the communication channel between the MDM and a device, follow these steps:
Step 1
•
•
The Network Summary menu and screen appear.
Step 2
Step 3
Step 4
•
•
Step 5
Deleting a Device
When you delete a device from the MDM device list, you remove the device from the MDM database and the device is no longer associated with any zone. Once you delete the device from the database, you can no longer manage the device with this user interface. The device, however, will continue to perform according to its current operating state. For example, if you delete a Guard that currently has Protect active for a zone, the Guard continues to protect the zone.
Note
To delete a device from the MDM device list, follow these steps:
Step 1
•
•
The Network Summary menu and screen appear.
Step 2
Step 3
Note
Step 4
Where to Go Next
After adding a device to the MDM device list, where you go to next in this guide depends on whether the device was configured with zone configurations at the time that you added the device, or if you are experiencing communication problems with a device. Use the following guidelines to determine where to go next:
•
Make sure that all of the devices that you plan to configure with the same zone information are on the device list, and then see Chapter 5, "Creating and Configuring Zones," to begin creating zone configurations.
•
•
