![[Top]](../images/home.jpg){kind=small}
![[Contents]](../images/contents.jpg){kind=small}
![[Prev]](../images/previous.jpg){kind=small}
![[Next]](../images/next.jpg){kind=small}
![[Last]](../images/index.jpg){kind=small}
Configuring SNMP
The MAX supports SNMP on a TCP/IP network. An SNMP management station that uses the Ascend Enterprise MIB can query the MAX, set some parameters, sound alarms when certain conditions appear in the MAX, and so forth. An SNMP manager must be running on a host on the local IP network, and the MAX must be able to find that host, through either a static route or RIP. Configuring SNMP access security
There are two levels of SNMP security: community strings, which must be known by a community of SNMP managers to access the box, and address security, which excludes SNMP access unless it is initiated from a specified IP address. Following are the relevant parameters (shown with sample settings):
EthernetFor complete information about each parameter, see the MAX Reference Guide.
Mod Config
SNMP options...
Read Comm=Ascend
R/W Comm Enable=No
R/W Comm=Secret
Security=Yes
RD Mgr1=10.0.0.1
RD Mgr2=10.0.0.2
RD Mgr3=10.0.0.3
RD Mgr4=10.0.0.4
RD Mgr5=10.0.0.5
WR Mgr1=10.0.0.11
WR Mgr2=10.0.0.12
WR Mgr3=10.0.0.13
WR Mgr4=10.0.0.14
WR Mgr5=10.0.0.15
Setting community strings
The Read Comm parameter specifies the SNMP community name for read access (up to 32 characters), and the R/W Comm parameter specifies the SNMP community name for read/write access. Setting up and enforcing address security
If the Security parameter is set to No (its default value), any SNMP manager that presents the right community name will be allowed access. If you set this parameter to Yes, the MAX checks the source IP address of the SNMP manager and allows access only to those IP addresses listed in the RD MgrN and WR MgrN parameters, each of which specifies up to five host addresses. Resetting the MAX and verifying reset
You can use SNMP (sysReset object) to reset a MAX from an SNMP manager. After the Reset command is issued, a one-minute timeout (not modifiable) permits the MAX to confirm the request before the unit is reset. sysAbsoluteStartupTime is the time in seconds since January 1, 1990, and is not modified. To determine whether the MAX has actually reset, you can retrieve sysAbsoluteStartupTime and compare its value against the previous poll's value for Ascend Events Group variables. Example of SNMP security configuration
The following procedure sets the community strings, enforces address security, and prevents write access:
Ethernet
Mod Config
SNMP options...
Read Comm=Secret-1
R/W Comm Enable=Yes
R/W Comm=Secret-2
Security=Yes
RD Mgr1=10.0.0.1
RD Mgr2=10.0.0.2
RD Mgr3=10.0.0.3
RD Mgr4=10.0.0.4
RD Mgr5=10.0.0.5
WR Mgr1=0.0.0.0
WR Mgr2=0.0.0.0
WR Mgr3=0.0.0.0
WR Mgr4=0.0.0.0
WR Mgr5=0.0.0.0
Following are the parameters related to setting SNMP traps (shown with sample settings):
EthernetFor complete information about each parameter and the events that generate traps in the various classes, see the MAX Reference Guide.
SNMP Traps
Name=
Alarm=Yes
Port=Yes
Security=Yes
Comm=
Dest=10.2.3.4
To specify the community string for communicating with the SNMP manager, set the Comm parameter to the community name associated with the SNMP PDU.
The Alarm, Port, and Security fields specify whether the MAX traps respectively alarm events, port events, and/or security events, and sends a trap-PDU to the SNMP manager.
The Dest field specifies the destination address for the trap-status report. If DNS or YP/NIS is supported, the Dest field can contain the hostname of a system running an SNMP manager. If the DNS or YP/NIS is not supported, the Dest field must contain the host's address.
Example SNMP trap configuration
The following procedure creates a profile that specifies a community name, all the trap types, and the host's IP address in the Dest parameter.
Ethernet
SNMP Traps
Name=security-traps
Alarm=Yes
Port=Yes
Security=Yes
Comm=Ascend
Dest=10.2.3.4
Alarm events
Alarm events (also called error events) use trap types defined in RFC 1215 and 1315, as well as an Ascend enterprise trap type. The MAX provides the following trap types:
Port state change events
Port state change event traps are effective on a port-by-port basis for each port pointed to by ifIndex. The hostPort objects are used to associate a change with ifIndex objects.
Security events
Security events are used to notify users of security problems and track access to the unit from the console. The MIB-II event authenticationError is a security event. The other security events are Ascend-specific. The include:
Supported MIBs
You can download the most up-to-date version of the Ascend Enterprise MIB by logging in as anonymous to ftp.ascend.com. (No password is required.) In addition to the Ascend MIB, the MAX also supports objects related to Ascend functionality in the following Internet standard MIBs:
anonymous to ftp.ds.internic.net. (No password is required.)
Configuring Syslog
You can configure the MAX to send messages containing call and system events to an IP host running a syslog daemon.
Configuring the MAX to send Syslog messages
To configure the MAX to send messages to a syslog daemon:
syslog daemon.
The
syslog daemon can receive messages from several devices, and it groups the messages. If the daemon receives messages from devices that specify the same log facility, it stores them in the same file.
syslog daemon on a UNIX host, you need to modify the host's /etc/syslog.conf file. This file specifies a specific action the daemon performs when it receives messages with a particular Log Facility number. For example, if you set Log Facility to Local5 in the MAX, and the syslog daemon should store messages from the MAX in the file /var/log/MAX, add the following line to the /etc/syslog.conf file:
local5.info tab /var/log/MAX
/etc/syslog.conf file, you must direct the UNIX
host to reread the file.
Syslog message format
MAX units generate Syslog messages in the following format:
date time router_name ASCEND: messagewhere:
date is the date the message was logged by the syslog daemon. The MAX does not datestamp the Syslog messages.
time is the time the message was logged by the syslog daemon. The MAX does not timestamp the syslog messages.
router_name is the name of the MAX sending the message.
message is the specific activity that caused the MAX to send the Syslog packet.
In a Syslog message,
slot x port y indicates that action occurred in a session with the module (slot card) located in slot x. Because slot cards support multiple simultaneous sessions, the MAX assigns the session to a specific port. For modem calls, port indicates a specific modem on a modem slot card. For digital calls, port typically indicates an HDLC channel on an Ethernet card or Ether-Data card, although port can indicate a port on a slot card supporting inverse multiplexing.
The MAX has received a call on channel m of line n. The MAX has assigned it an identification number of xxxxxxxxxxx. The MAX has not assigned a slot card to the call.
MBID xxx.
The call has connected.
Port y on the module in slot x answers the call. The MAX has assigned another identifier (
call n.) to the session. For data service, 56K indicates that the call is a 56Kbps call, and VOICE indicates an analog call.The session has successfully completed authentication, the MAX displays the username, and the connection is complete.
The MAX displays the following messages in the order shown:
The MAX has cleared the user's session. If the user gracefully closes down the PPP connection, the MAX indicates a valid slot number and port number.
The call that was connected to port y on the module in slot x terminated. Typically, the dial-in client has terminated the call. The MAX begins clearing the resources that it had allocated for the call.
The MAX has freed all the remaining internal resources that were used by the call.
The session for
username, identified by call n, is disconnecting. The MAX supplies disconnect and progress information about the call. The disconnect code n details why the call disconnected. The progress code m indicates the last action the MAX logged before the disconnect occurred. For detailed information, see Disconnect codes and progress codes.
u=
username does not appear.
The call that was connected to port
y on the module in slot x terminated. The dial-in client has terminated the call. The MAX begins clearing the resources that it had allocated for the call.The MAX has cleared the user's session. Because the user ended the session ungracefully, the call disconnected before the resources could be completely cleared. The MAX does not require the call to be active while freeing software resources, and records the slot and port as 0 (zero).
The MAX has cleared up all the internal resources that were used for the call.
The MAX received a call on modem
y in the module in slot x. The call has failed either because authentication failed, or because the IP address of the user did not match the IP address configured in the user's profile.The MAX dialed a phone number that was busy.
There was no response from the far end unit when the MAX dialed.
All channels on the MAX are either supporting active calls or are disabled.
The outgoing call requested more channels than the MAX has available.
The called unit did not have an available channel on which to answer the call.
The telephone network has reported a protocol error.
The telephone network notified the MAX that the calling unit has disconnected the call.
A user attempted to initiate a remote management session, which was denied by the far end unit.
The MAX dialed an outgoing call that was refused by the far end unit, or the MAX answered an incoming call, then immediately disconnected. The latter event might be due to of incorrect line provisioning.
The MAX received an incoming Net-2-Net call.
The MAX dropped the call because the call had exceeded the configured maximum system DS0 minutes.
The MAX dropped the call because the call had exceeded the maximum port DS0 minutes specified in the Port profile.
During a Bit Error Rate Test (BERT), the MAX detected a high number of bit errors.
During a Bit Error Rate Test (BERT), the MAX detected a normal number of bit errors.
The MAX has no active WAN links.
A WAN link has gone down.
A WAN link has become active.
The Ethernet interface of the MAX has become active or been reinitialized. This message is logged when the Ethernet interface first comes up, or on the basis of a change to the Ethernet interface.
The MAX received a call configured for callback. The initial call cleared. The MAX is preparing to call back to the user.
A user attempted to initiate a login service with an invalid IP address.
The MAX could not initiate a TACACS+ session.
The MAX received a TCP Close packet before the TACACS+ TCP session was established.
The MAX experienced a low memory condition while processing TACACS+ session.
The MAX experienced an unexpected end to a TACACS+ session.
The MAX timed out while waiting to connect to the TACACS+ server.
The MAX has no available entries in its TACACS+ entry table.
The MAX received an illegal response from the TACACS+ server.
Backoff-queue overflow has resulted in silent discarding of the oldest entry. When a RADIUS accounting event occurs, the MAX (the NAS) sends an Accounting-Request message to the RADIUS Accounting server, which sends back an Accounting-Response message to acknowledge receipt. The NAS is required to buffer the event until it receives an acknowledgment. The NAS employs a simple exponential backoff algorithm between reattempts. The backoff algorithm is:
backoff_time = 3 * backof_time
backoff_time = [1..N]
Once the NAS sends an accounting request, if no response is received from the Accounting server, the NAS enters backoff mode.
If the backoff queue is not empty when an accounting event occurs (a new user logs in or an existing user logs out), the event goes directly onto the backoff queue.
A maximum of 100 entries is allowed on the backoff queue. If the queue overflows. the oldest entry is silently discarded, and the MAX sends the Syslog message.
The backoff queue can be cleared by setting Acct = None on the MAX or by resetting
the MAX.
When you see this Syslog message, your Accounting Server is not functioning properly. If Acct = RADIUS on the MAX, verify that you are using the correct Port number (e.g. 1646) and that the Acct Key matches the password in the clients file on the RADIUS server. Also, be aware that the default location for your accounting records is
/usr/adm/radacct. You have to create the radacct directory. RADIUS will automatically create a subdirectory with the name or IP address of the MAX (depending on your entry in the clients file) and will then write to the detail file. You can redirect your accounting output by starting RADIUS with the -a option (for example, radiusd -a /usr/adm/ascendlog).
Disconnect codes and progress codes
When a call disconnects, the MAX typically sends the following message:
callwhere:nCL OK u=usernamec=np=m
n specifies a disconnect code indicating why the call disconnected.
m specifies a progress code indicating how far the call had progressed when it disconnected.
Progress codes and their meanings
Following are the progress codes and their meanings:
Copyright © 1998, Ascend Communications, Inc. All rights reserved.