Chapter 2. Policy-Based Network Management | Performance and Fault Management: A Practical Guide to Effectively Managing Cisco Network Devices (Cisco Press Core Series)

Routers have become quite complex when compared to their original task of simply routing. To name a few features: routers now provide QoS, firewall, packet-encryption, tunneling, filtering and web-caching capabilities. These features require that multiple routers be configured similarly in order to be able to deliver a consistent level of capabilities. If QoS packet coloring and queuing features, for example, are not implemented consistently through your network, packets will not be colored and queued similarly as they travel through the network.

Likewise, Layer 2 LAN switches have become more complex since their original bridging intentions. Some Catalyst switches now make forwarding decisions based on Layer 3 network and Layer 4 transport portions of a packet. Consistent implementation across your network of features, such as portfast/uplinkfast/backbonefast, dynamic port VLAN membership, Layer 3 protocol filtering, and QoS becomes increasingly difficult.

What these router and switch features provide, though, is the capability to control how traffic is passed through the network. Time-sensitive applications such as voice over IP and video require that packets make it to their destination on time. Additionally, network managers want to limit bandwidth for some applications (such as file transfers and backups) in order to let other traffic through.

Unfortunately, configuring these features and determining whether they actually do what you configured them to do can be difficult. Also, as configuration changes take place in the network and new applications are introduced, previous network device configurations may no longer meet their original objectives.

Traditionally, the configuration of router or switch features has been done on a device-by-device basis. If you wanted to restrict access to various parts of a network to a particular group, you had to configure the access lists from the device command line for each device that the group's traffic may traverse.

More recently, network management tools have shifted (or attempted to shift) their focus away from device-centered management to network-centered management (also called policy-based management). This chapter discusses three areas of policy-based management that pertain to the fault and performance management of your network:

Defining network policies
Baselining the network to determine network policy suitability
Using service level agreements to measure and report on the effectiveness of policies

The chapter concludes with an example scenario in which these aspects of policy-based management are applied to a network.