Policy Based Network Management Networks example essay topic

Table of Contents Abstract 3 Policy Based Network Management 3 Policy-Based Management Framework 4 Advanced Directory 5 Policy Server 5 Policy Clients 5 Policy Enabled Network Elements 6 Key Enabling Technologies 7 Directory Enabled Networks (DEN) 7 I 802.1 p Priority Classes 7 The X. 500 Directory Project and LDAP 8 Policy Transaction Protocols 8 PBN in Action 9 Shortcomings of Policy Based Networking 10 The Future of PBN Technology 11 Glossary of Acronyms 14 References 15 Abstract Today's business requirements have driven the development of new mission-critical applications. Policy-based networking (PBN) technology enables network managers to reliably optimize the performance of any application, traffic type, or bandwidth. The need for policy-based networking is growing rapidly as organizations build complex intranets and extranets and open their networks to more users and applications. PBN is an emerging technology and many vendors are involved in developing hardware and software to facilitate its implementation. This paper focuses on a basic description of PBN technology, its functional elements, its shortcomings and current and future potential. Policy Based Network Management Networks are expanding at an unprecedented rate, and with the increased use of the Internet, companies are experiencing the need to interconnect all of their isolated LANs into unified intranets and / or extranets.

As businesses decide to exploit new e-commerce and e-business applications, network managers are under increasing pressure to make information available across multiple platforms. The diversity of technologies requires that network managers find a way to connect these different technologies both physically and logically. Then, network managers have the problem of balancing the conflicting bandwidth demands between the various applications. "The enterprise needs a mechanism of mixing and matching global needs of all enterprise applications so the appropriate service is maintained consistently while minimizing the cost of providing those services". (Enterasys, 2001). In other words, the challenge is to balance various claims on network resources, and to satisfy demands by users, network managers, and application developers for higher levels of network security, predictability and availability.

Policy-based networking (PBN) is a way of solving the various claims on network resources. It is a set of automated rules that controls network congestion. It governs which users and applications receive specified network bandwidth at any given time (Walker, 1999). PBN can: SS Deliver tiered bandwidth and differentiated services according to customer needs and service level agreements (SLAs) SS Determine user access and bandwidth requirements for access to the Internet SS Prioritize mission-critical applications SS Manage voice, video and data demands on Service Provider and corporate networks, and SS Manage the overall traffic flow through internal and external networks (NetPolicy).

How PBN enables companies to satisfy these business needs is the subject of this discussion. Policy-Based Management Framework Policy management is the implementation of a set of rules or policies which dictate the access and use of resources on a per user, application, or company-wide basis to meet established business objectives. It is focused on providing end-to-end quality of service (QoS) by addressing bandwidth, latency and priority, and implementing security authentication, authorization and auditing. There are four major components to a policy based management system.

Advanced Directory An advanced directory consolidates and links disparate directories that have emerged over time, into a single, global directory. Policies, user information, network configuration data and network addresses all become part of this "central" logical directory or policy database. Several vendors have introduced directory products designed to enable policy based networking. Some of them are Netscape's Directory Server, Novell's Directory Service, and Microsoft's Active Directory (Rybczynski, 1999). Policy Server This is the center of a policy management system.

The policy server gathers all of the relevant information, makes a decision based on the administrator's policies and then communicates that decision to the network via a policy transaction protocol. "The goal of the policy server is to develop responses consistent with the policy, retrieving other data such as network availability or utilization, time-of-day, or service level agreement (SLA) information as appropriate" (Rybczynski, 1999). Then the response is transmitted to a policy enforcement device such as a switch / router. Policy Clients Policy enabled clients interact with policy servers. Policy clients in edge devices recognize only IP addresses, so policy management is closely tied to IP address management. An example that Tony Rybczynski uses states "an IP address management tool can be used to bind a user to an IP address and, through support of the Dynamic Host Connection Protocol (DHCP), keep this address dynamically updated" (1999).

This way, administrators can define policies by user or application, and the information is translated to an IP address that the edge device will recognize. Policy Enabled Network Elements A policy-based network consists of switches and routers that provide transport of traffic at the required priority level and enforce the policy for that traffic. Each device along the path ensures that the policy is enforced, relying on a policy server to coordinate the end-to-end policy. Simply said, once rules are defined using the advanced directory, they are stored in a central repository (the policy server).

The policy server receives traffic requests from switches, firewalls and important applications (policy enabled network elements). The server then culls policy information from the directory and dynamically configures the network based on the defined policies through policy clients (Walker, 1999). See figure below from web These policy-based networking concepts evolved because of the enabling technologies defined by various work groups. Key Enabling Technologies Directory Enabled Networks (DEN) The Distributed Management Task Force (DMTF) sponsored the DEN initiative.

The DEN specification, completed in August 1998, sets standards for improving network management by using a directory service to consistently apply policies for accessing network resources (Connolly, 2000). DEN correlates all LAN directories and integrates them into a single centralized logical entity. They facilitate network management based on the business processes of the organization and / or the application demands, not on the physical details of the hardware. DEN allows prioritization of network resources for specific applications or users. This could, for example, allow payroll data or an urgent customer order to be prioritized over an employee accessing a Web site. I 802.1 p Priority Classes At the core of policy-based network management is the 802.1 p specification in the I's 802.1 Q virtual LAN (VLAN) standard.

The standard, defined in 1998, describes a tag that Layer 2 switches, Layer 3 switches (routers), and hosts can add to data packets for identifying packet priority. The 802.1 p specification defines eight priority classes. Traffic on a policy-managed network will be routed according the priority tag attached to it. The X. 500 Directory Project and LDAP X. 500 is a series of standard-based protocols defining a model for connecting multiple directory services to form one distributed global directory. However, the X. 500 standard is so massive and resource intensive that a stripped down version called Lightweight Directory Access Protocol (LDAP) was developed. According to an Enterasys white paper, LDAP is fully compatible with standard X. 500 and has been adopted by all major directory vendors, forming the infrastructure for true directory interoperability (pg. 5).

Policy Transaction Protocols Policies are defined and deployed from the policy server to the policy-decision point (PDP). They are further translated and downloaded to various network devices or policy-enforcement points (PEPs). This process also works in reverse. Two Internet Engineering Task Force (IETF) standard protocols facilitate policy communication.

LDAP grants access to X. 500 style directory trees. LDAP communicates between the policy server and the PDP. Common Open Policy Service (COPS) is a simple query-response protocol for exchanging policy information between the PDP and PEP. COPS is the standard that lets the policy server control and receive feedback from network devices. Using the COPS protocol, network devices can be automatically reconfigured by remote processes to implement new network services, enforce updated administrative policies or handle customer requests for network services on the fly (Durham, 2001). See figure below from web To summarize the technology, policy management refers to the dynamic allocation of necessary bandwidth and network resources based on predetermined criteria.

Such policies can give priority to designated users, groups, or applications based upon the state of the network and available bandwidth at a given time. Policies are determined by a combination of users and network managers and are maintained in directories. These directories are accessed through a standard access protocol, LDAP. Policy enabled networking makes use of policy managers or decision points in the network that communicate policy information to network devices. Communication between the policy manager and enforcement points (routers, switches, etc.) is done via bidirectional protocols, the most popular of which is COPS (Racioppi, 1999).

PBN in Action The enterprise needs a way of providing network resources in the most efficient and economical way possible. For example, consider the problem that the Widget Corporation is facing. Widget is an international organization that has monthly meetings of its eighteen branch vice presidents. Since the cost of air travel is high and it is difficult for executives to travel around the world for these meetings, another solution is needed.

The IT department has just finished testing a PC-based videoconferencing system that can run over the company's existing global network. However, because of the high bandwidth requirement of video, data packets have to be given top priority. Widget needs to find a way to give the senior executives' traffic top priority around the world, through many parts of their network, once per month on an arbitrarily scheduled basis, just for the duration of the teleconference, the length of which cannot be predicted. The solution?

Policy-based networking enables the enterprise network to give the highest priority to this single application on the dates and times specified. When the conference is over, the global network reverts to its normal operation. Widget's finance department also requires priority network usage at the end of each month when financial statements are being generated. Again, policy-based networking facilitates this need by giving accounting department users priority access to network resources for the time they require at month-end. However, while policy based networking offers companies cost and performance advantages, there are some drawbacks that are being addressed as the technology evolves. Shortcomings of Policy Based Networking The main obstacle facing true policy-based networking is interoperability.

Although most switching vendors have policy applications, most of them only work with those vendors' equipment. Few existing networks are composed of one vendor's gear making acceptance of policy-enabled networking a slow process. However, according to a comparison of 13 vendors by the University of Wisconsin in November, 1999, "Cisco's solution, based on the COPS protocol, builds a foundation that will let the vendor integrate not only its own products, but also most other products on the network" (pg. 1). A related problem with policy-based networking is the lack of standards in the industry. According to David Drucker's article in InternetWeek, "standards such as the Distributed Management Task Force's Directory Enabled Networks initiative as well as other interoperability measures are still far off". Christy Walker agrees, "Once the standards are in place, it will be easier to integrate several vendors' products, but the implementations of such standards will continue to be significantly different" (pg. 2).

In addition, the process of defining and implementing policies across a network can be daunting. Rules are based on business priorities that are set by business managers. In addition to business managers, network administrators and applications managers must be involved in the implementation of a policy-based network. There are no simple rules for defining network management policies and the problem is in the complexity of the process. The Future of PBN Technology Despite these drawbacks, the future of policy-based network management is bright.

Some vendors are meeting the policy management challenge by developing integrated frameworks to allocate resources across multi-vendor networks. Others like Allot Communications are developing solutions that allow both the enterprise and service providers to coordinate end-to-end policies. Using NetEnforcer, network managers can define policies and allocate network resources according to the needs of the organization. The NetEnforcer can interpret traffic flows and "signal" a service provider of the priority and resource demands of an application and the service provider can deliver the bandwidth the customer needs, billing accordingly (Policy, 2001). Using Allot's products, the service provider has a complete system for providing service level agreements (SLAs); the IS manager can offer customers guarantees for specific traffic types and applications; and network managers can guarantee mission critical applications and limit the flow of non-critical traffic. As for the future of PBN, Intel Corporation's article "Managing Enhanced Network Services: A Pragmatic View of Policy-Based Management" sums up the issues that will not be resolved until policy-based management matures industry wide.

"Industry standards (primarily IETF and DMTF) in the areas of policy-based directory schemas, QoS technologies (e. g., DiffServ, RSVP, MPLS), and policy and directory communication protocols (e. g., COPS, LDAP) are still under development and may delay full vendor adoption... Additionally, policy scalability, QoS and security conflict resolution, and interoperability will further influence IT strategies and the adoption of PBM" (pp. 11-12). In summary, policy-based networking makes providing quality of service and other network resources a dynamic process. It allows IP intranets and extranets to meet the demands of converged voice, video and data. By developing and implementing a policy-enabled network, users and businesses can feel confident that their mission-critical applications and voice-based traffic will be managed in the most bandwidth-efficient and cost-effective manner. Moreover, according to John Vincente of Intel, "We anticipate continued convergence in the directory arena, as this technology should serve as the foundation for the success of PBM.

A widely deployed solution will depend on the eventual integration of alternative technology. The move to e-Business and Internet-based computing will force organizations as well as ISP's to focus on and speed the delivery of a policy-driven approach to managing Internet-based IT infrastructure and enhanced network services" (p. 12). Glossary of Acronyms COPS Common Open Policy Service DEN Directory Enabled Network DHCP Dynamic Host Connection Protocol DMTF Distributed Management Task Force I Institute of Electrical and Electronics Engineers IETF Internet Engineering Task Force LDAP Lightweight Directory Access Protocol MPLS Multi-Protocol Label Switching PBM Policy-Based Management PBN Policy-Based Network PDP Policy Decision Point PEP Policy Enforcement Point QoS Quality of Service RSVP Resource Reservation Protocol SLA Service Level Agreement VLAN Virtual Local Area Network

Bibliography

Connolly, P.J. (2000, Mar.
27). Boost your bandwidth efficiency - Directory-enabled networking reduces your LAN management costs. InfoWorld [Online]. web [2001, Oct.
28]. Conover, Joel. (1999, Nov.
29). Policy-based network management. Network Computing [Online]. web [2001, Dec.
4]. Drucker, David. (1999 Dec.
1). Lucent enters policy networking fray. InternetWeek [Online]. web [2001, Nov.
8]. Durham, David. (2001, Nov.
A new paradigm for policy-based network control. Intel Developer Update Magazine [Online]. web [2001, Dec.
5]. Enterasys Networks. (2001).
Directory enabled networking: A technology guide. White paper [Online]. web [2001, Oct.
26]. Harvey, David and Santa lesa, Rich. (1999, Sept.
9). Policy-based networking. Enterprise [Online]. web [2001, Nov.
7]. NetPolicy Data Sheet. (No date). Policy-based management system. Products Specifications [Online]. web [2001, Nov.
8]. Policy Based Networking Solution. (2001).
Whitepaper [Online]. web [2001, Dec.
5]. Walker, Christy. (1999, May 24).
Policy-based networking. ComputerWorld [Online]. web [2001, Nov.
7]. Racioppi, Elizabeth. (1999, Jan).
Quality of service: Traffic management on the IP network. CTI Magazine [Online]. web [2001, Nov.
7]. Rybczynski, Tony. (1999, Jan.
Policy-enabled networking: What's it all about? Vincente, John, et al. (2000, Mar).
Managing enhanced network services: A pragmatic view of policy-based management. Intel Technology Journal [Online]. web [2001, Dec.