The present claimed invention relates generally to the field of computer network systems. More particularly, embodiments of the present claimed invention relate to address translation in a system/network management environment.
Information Technology organizations face difficult challenges in managing the availability of applications and computing resources within the enterprise. The growth of networks and distributed systems has led to an increasingly complex heterogeneous environment, encompassing a broad spectrum of hardware, software and operating systems.
Today, systems range from PCs and technical workstations on user's desktops, to small and mid-size servers in departments, all the way up to large enterprise servers and mainframes in the corporate data-center. Computing resources may be geographically dispersed across a business campus or around the world to support global business operations. The proliferation of LANs and WANs means that users can access corporate information assets almost anywhere, any time of day or night.
In recent trends in distributed corporate computing, the use of mission-critical applications has blossomed, helping companies to become more competitive and conduct business more effectively. The mission-critical nature of these applications, however, is aggravating an already difficult system management task. Users are demanding systems and applications that are continuously accessible and available with expectations for improved levels of service that are constantly on the rise.
As the demands for acceptable service levels and the complexity of the computing environment have increased, administrators have responded by standardizing procedures and adopting network-aware tools. While limited in functionality, many of these tools have helped address the need for remote network management. Still other tools allow administrators to monitor individual systems and hardware components.
To meet the rising demands for better levels of service, it is crucial both to manage and monitor the availability of applications and data, as well as the availability of individual systems and networks. However, administrators still lack an integrated way of doing so. While the job of managing systems, applications and data is becoming increasingly complex, IT managers must still control costs and provide non-interrupting services to their clients on a 24/7 basis. This calls for the system administrator to not only monitor and manage the availability of systems, but also to ensure that when a system goes down, the recovery time is kept to a minimum.
The console layer 101 comprises multiple consoles serving multiple users for the network management system 100. The consoles provide visual representations of managed objects (for example, hosts and networks) to users of the network management system 100. The consoles also provide users with the ability to manipulate attributes and properties associated with the managed objects and the ability to initiate management tasks (for example, dynamic reconfiguration of a host or a device).
The server layer 110 accepts requests from users through the console layer 101 and passes these requests to the appropriate agents. The server 110 then relays the response from the agent back to the user. For example, if a user wants information on the number of users accessing a agent, the server 110 receives this request from any one of consoles in the console layer 101, and sends the request to that particular agent. The host finds the requested information and passes it back to the server which then transmits the information to the user via the console layer 101. The server 110 also provides the console with a secure entry point to interface with the agents in the agent layer 120.
The agents in the agent layer 120 perform the actual tasks of information gathering, monitoring and management of objects on the nodes managed by the network management system 100. The server 110 interacts with the agents to gain access to managed objects on the network. Each of these layers typically run on different machines in a network.
With the explosion of the Internet, Network Address Translation is becoming very important in customer environments. Network Address Translation (NAT) is also becoming increasingly prevalent in a system management environment as that described in
There are two types of NAT: dynamic and static. Dynamic NATs are typically for streaming communication that is initiated by only one party and whose endpoint addresses and ports are not scrutinized.
In a static NAT environment where all the appropriate mappings already exist, the system management tool can be made to operate properly, although it will be subject to certain complexities and constraints.
The use of NAT has significant ramifications in a system management environment, such as the Sun Microsystems™ system management product SunMC™, which makes assumption that an IP address and port of a managed node can be used to uniquely identify and communicate with the managed node by the management server. The system/network management system makes extensive use of IP addresses in both its core operation and its management functionality.
Specifically, network addresses are used in the following areas of the system/network management system: communication; network entity discovery; identification of managed nodes, managed property contents, etc. In an environment where the customer networks operate one or more NATs, the assumptions regarding the uniqueness and accessibility of the local IP addresses and ports of managed nodes break down. Furthermore, the use of local IP addresses to identify managed nodes in a NAT environment may no longer be intuitive since users may be more familiar with the node's public IP address.
The breadth of use of IP addresses in the system management environment depicted in
Furthermore, the console, server or agent components of one system management system could potentially communicate to components of another system/network management framework on another network. All of this contributes to the complexity of providing an address translation solution to the environment depicted in
Because of these issues and the relative costs of the various solutions approaches of the prior art, a simple solution which is viable to implement with minimal expense and which provides minimal complexity and maximum usability to the end user is needed. A solution that provides a self consistency and avoids complex or error-prone translations mechanisms is also needed. A system/network management system address translation solution that provides backward compatibility with existing system/network management systems is also needed.
Accordingly, there is provided a multi-host, network system comprising a system/network management software system having a network address translation system for translating host addresses in the network.
What is described herein is a computer system/network management system having a network address translation software for translating network address of host agents managed by management servers on the network. Embodiments of the present invention allow users to define and specify logical identifiers for host agents connecting to the underlying network and wishing to communicate with a server layer in the network. The logical identifiers enable the server layer to resolve the addresses of connecting host agents to the IP addresses stored and recognized by the server layer.
Embodiments of the present invention also include a logical identifiers generation unit that generates logical identifiers to uniquely identify the systems where the system management components are running. For example, the logical identifiers generated by an agent must be resolvable to a valid IP address on the system where the management server is running in order to enable any communication between the management server and the agent. The logical identifiers may be qualified host names of the agent.
Embodiments of the present invention also include an address mapping unit that provides guideline for mapping logical identifiers to valid IP address in the server.
Embodiments of the network system management address translation system of the present invention also include a configuration unit that provides a mechanism for configuring server side address. For example, the configuration unit configures logical identifiers presented by an agent in such a way that the logical identifiers of the agent must be in both the server's addressing realm and the agent's addressing realm. The configuration unit further allows the system management software to handle address management (translation) for multiple agents on the network.
Embodiments of the network system management address translation system of the present invention further include a host address mapping unit that adds logical identifiers to the agents or portions of the network to the host maps in all the relevant addressing realms where the system management components are operating.
Embodiments of the network system management address translation system of the present invention further include address translation unit that specifies the type of logical identifiers to IP address translation that may be processed in a particular network.
These and other objects and advantages of the present invention will no doubt become obvious to those of ordinary skill in the art after having read the following detailed description of the preferred embodiments which are illustrated in the various drawing figures.
The accompanying drawings, which are incorporated in and form a part of this specification, illustrate embodiments of the invention and, together with the description, serve to explain the principles of the invention:
Reference will now be made in detail to preferred embodiments of the invention, examples of which are illustrated in the accompanying drawings. While the invention will be described in conjunction with the preferred embodiments, it will be understood that they are not intended to limit the invention to these embodiments.
On the contrary, the invention is intended to cover alternatives, modifications and equivalents, which may be included within the spirit and scope of the invention as defined by the appended claims. Furthermore, in the following detailed description of the present invention, numerous specific details are set forth in order to provide a thorough understanding of the present invention. However, it will be obvious to one of ordinary skill in the art that the present invention may be practiced without these specific details. In other instances, well-known methods, procedures, components, and circuits have not been described in detail as not to unnecessarily obscure aspects of the present invention.
The embodiments of the invention are directed to a system, an architecture, subsystem and method to process network addresses in a computer network system. In accordance with an aspect of the invention, a system for translating network host addresses of host agents in a system/network management framework.
The console layer 310 comprises multiple consoles serving multiple users for the network management system 300. The consoles provide graphical visual representations of managed objects (for example, hosts and networks) to users of the network management system 300. The consoles also provide users with the ability to manipulate attributes and properties associated with the managed objects and the ability to initiate management tasks (for example, dynamic reconfiguration of a host or a network) with graphics interface tools.
The management server layer 320 accepts requests from users through the consoles and passes these requests to the appropriate agents in the agent layer 330. The management server 320 provides a set of system management services. The management server 320 further provides a secure centralized point of access for all system management operations. All requests from the console layer 310 are funneled through the server.
The management server 320 recognizes duplicate requests intelligently consolidating them for a higher network and system efficiency. The management server 320 also enforces the security models, authenticating users and handling all user session management. The management server 320 receives all requests from clients. The management server 320 then relays the response from the agents 340 back to the user. For example, if a user wants information on the number of users accessing services over the network, the management server 320 receives this request from any one of consoles 310 in the console layer, and sends the request to that particular agent. The agent 340 finds the requested information and passes it back to the server 320 which then transmits the information to the user via the consoles. The server 320 provides the consoles with a secure entry point to interface with the agents.
The agent layer 340 represents managed objects in the network. The agents 340 provides basic services: networking, snmp protocol translations, authentication, etc. The agents 340 further provide a platform to plug management object modules. The agents 340 perform management tasks through use of management modules that are extensible and customizable. The agent layer 340 includes default modules that provided the infrastructure for the network services.
The agent layer 340 further comprises one embodiment of a network/system address translation system (NSMAT) 350 of the present invention that allows logical identifiers to be used in place of IP addresses to uniquely identify and access nodes managed by the system/network management software in a NAT environment. In NAT environments, these identifiers can be fully qualified host names of managed nodes, allowing the system management software to leverage off existing hostname to IP address mapping infrastructure in IP-based systems.
In one embodiment of the present invention, in environments where the use of fully qualified hostnames are not appropriate or feasible, any logical name that is unique and resolvable from the agent and server layer addressing realm may be used. In one embodiment of the present invention, in non-NAT environments, the logical identifiers can default to IP addresses for backward compatibility with previous versions of the system management software.
In one embodiment of the present invention, the NSMAT 350 assumes that the logical identifiers of the present invention must be unique and that these logical identifiers can be resolved to valid IP addresses that can be used to access managed nodes in the network.
The logical identifiers generation unit 410 generates logical identifiers that are used in place of IP addresses to uniquely identify and access nodes managed by the system management software. In one embodiment of the present invention, the logical identifiers must be unique. The logical identifiers can be resolved to an IP address that can be used to access a managed node. In one embodiment of the present invention, users are able to use the logical identifiers to identify and view managed nodes intuitively.
In another embodiment, by default, the logical identifiers can be the fully qualified host names of the managed nodes which allows the system management software 340 to leverage off the existing hostname to IP address mapping infrastructure found in all IP-based systems. In environments where fully qualified hostnames are not appropriate or feasible, any logical name that is unique and resolvable to valid IP addresses in an agent and a server layer address realm may be used.
The host address mapping unit 420 provides guidelines for mapping host logical identifiers to corresponding IP addresses on both the server and the agent. For example, the NATS 350 requires that logical identifiers of nodes managed by the system management environment agents be based on names (e.g., hostnames, fully qualified hostnames or logical names) that can be resolved to valid IP addresses in the agent, management server and console addressing realms.
The NSMAT 350 also requires that the server layer hostnames specified for an agent must be resolvable to a valid IP address in the agent, management server and console address realms. In one embodiment of the present invention, if the system management software 340 is unable to resolve a logical name of an agent to a valid IP address, the system 340 reports this as an error stating that the logical name is not valid and effectively aborts the translation operation.
The compatibility unit 430 enables the NSMAT 350 to be configured in such a way that the system/network management framework would be compatible with previous versions of network agents.
The configuration unit 440 configures logical identifiers in such a way that changes to the logical identifiers of a managed node (agent) must be preformed in both the server and agent addressing realms. The configuration unit 440 further includes logical addressing mode configuration. In one embodiment of the present invention, the system management components support the ability to operate in one or two addressing modes that control the formats of the component's logical identifiers. In one embodiment, the logical identifiers may be based on IP addresses or logical names (e.g., host names, logical name, etc.).
Still referring to
In one embodiment of the present invention, the management server 510 has a DNS entry that maps the logical identification information provided by the agent 530 to a valid IP address. The monitoring server 520 may be independently setup to monitor the agent 530.
After checking to ensure that the agent 620 is communicating on the underlying network protocol, the management server 610 checks to determine whether the agent software is running. The agent 620 then transmits its logical identification information to the management server 610 for storage in the database 630. In one embodiment of the present invention, the system/network management framework provides alternate way to discover the agent 620 on the network 600.
In one method of discovery, the management server 610 issues a discovery (“search”) command that searches the network 600 to identify the agent 620. In another example, the agent 620 may be created with a specific logical identifier and an IP address. This information, once created, may be used to directly locate the agent 620 on the network 600.
In an exemplary embodiment of the present invention, an agent boots up and loads all the modules that it requires. Once all the modules are loaded, the NSMAT 350 checks to see if the agent is configured in IP or name mode. If the agent is configured in name mode, it sends userConfig trap with its logical name in the varbind of the trap. If the agent is configured in IP mode, it sends its local IP address in the varbind of the trap. The server then retrieves either the IP address or logical name from the trap and if it is a logical name converts it to an IP address. It then stores the IP address as a location for the agent.
The host A console 701, host B server 702 and agent C 703 are deployed in the exemplary 192:168:0:0 network. Host D console 721 and host E agent 722 and host F agent 723 are deployed in the exemplary 192:168:1:0 network. The address translation/firewall 711 is deployed between two networks. The management agents located on either side of the NAT/firewall are managed by the management server layer on host B 702.
In one embodiment of the present invention, the system management components are configured to operate in the logical name node. As such, all agents configured with host B 702 as their management server layer. The two remote agents 722 & 723 are made accessible from the exemplary 192:168:0:0 network using a static addressing translation mapping. Furthermore, the logical identifiers of host E 722 and host F 723 must also be resolvable to valid IP addresses in the exemplary 192:168:0:0 network. This is accomplished, in one embodiment, through host mappings for host E 722 and host F 723 in the exemplary 192:168:0:0 network. To allow the agents 722 & 723 to use management server 702, a host map entry for host B 702 is specified in the exemplary 192:168:1:0 network host map.
Thus, in the example in
Furthermore, in the example illustrated in
2. On agent hosts (hosts C, E, & F), the host mapping for the server host (Host B) are specified.
3. On the console host (host A) the host mapping for the server host (host B) and the agent hosts (host C, E, &F) are required.
In the exemplary network environment 800, the 192.168.0.0 network is in-front of the NAT/firewalls (NAT) 811 and 812. The 192.168.1.0 and 192.168.2.0 networks are behind the NAT/firewall 811 & 812. The NAT/firewall 811 provides the 192.168.0.0 network with access to the hosts on the 192.168.1.0 network. The NAT/firewall 812 provides the 192.168.0.0 network with access to hosts in the 192.168.2.0 network.
In one embodiment of the present invention, Static NAT mappings are assumed. Host maps in the three addressing realms provide hostname resolution for all hosts on which the system management server and agent components are deployed. All the system management components are assumed to be configured with the logical name addressing mode. In one embodiment of the present invention, the following system management configurations is assumed:
The foregoing descriptions of specific embodiments of the present invention have been presented for purposes of illustration and description. They are not intended to be exhaustive or to limit the invention to the precise forms disclosed, and obviously many modifications and variations are possible in light of the above teaching. The embodiments were chosen and described in order to best explain the principles of the invention and its practical application, to thereby enable others skilled in the art to best utilize the invention and various embodiments with various modifications are suited to the particular use contemplated. It is intended that the scope of the invention be defined by the claims appended hereto and their equivalents.