Re: [nv-l] NV 714 and Cisco NAT

[Michael Webb <mlwebb@us.ibm.com>]

(I work with Feroz)

We have 5 end nodes with a single IP address that have their IP addresses being translated by a Cisco NAT. During initial discovery, these devices were not discovered, probably because their true IP addresses are not reachable from the NetView server. This morning, those devices do show up on our AIX machine, but not the Windows machine (maybe I need to wait longer?). So on the Windows NetView server, I pinged the end nodes so make them show up.

As pointed out by Siraj, these nodes on the AIX machine do show up with the anticipated hostname and sysName field, and are in a separate, but expected, subnet according to the subnet of the translated IP addresses. In contrast, the Windows NetView server showed these nodes in the subnet according to the class of the IP address (class B), and not according to the true mask of the IP addresses themselves (class C).

The question originally made by Feroz is whether or not we are forced to manually ping the translated end nodes in order to get the nodes to appear. He is using a Windows machine and it appears if that is the case. I am using an AIX machine, and today they appeared on their own.

As a reminder, the the netmon.conf was modified as follows:

NV_NETMON_DISCOVER_RIBB_AND_NATDADDR=TRUE

Michael Webb, IBM Tivoli
Q1CA Distributed NetView / ITSA SVT
Email: mlwebb@us.ibm.com
Ext: (919) 224-1410, T/L: 687-1410
Paul <pstroud@bellsouth.net>

Paul <pstroud@bellsouth.net> Sent by: owner-nv-l@lists.us.ibm.com 03/26/2004 06:23 AM Please respond to nv-l

To: nv-l@lists.us.ibm.com cc: Subject: Re: [nv-l] NV 714 and Cisco NAT

If I am not mistaken, this only applies if the main address of the node
itself is not being NAT'd. Your entire device is being NAT'd hence
NetView ignores the whole thing. CNAT is the only answer save for
disabling SNMP on the device(that will also work as NetView never sees
the "incorrect" address). CNAT is not that complicated, take some time
to study the docs. In the one armed router configuration you can run it
on the NetView machine. It attaches to the kernel, so it translates the
data on the same machine before NetView ever has a chance to look at it.
You can run it on another box in the subnet too if you like.

Paul


Hasan Siraj wrote:
> Hi Paul,
>
> I am also trying to find out a way to work without using CNAT for static
> NATed addresses.
>
> If you read the following text from the NetView 7.1.4 Release Note:
>
> "When a router contains an IP address that is in a private network, for
> example, 10.0.0.0 or 198.168.0.0, and that address is translated using a
> NAT, this causes an IP address to be associated with the device that is not
> reflected in the SNMP agent on the main device.
>
> The Tivoli NetView, Version 7.1.4 has been modified to properly work with
> these IP addresses, The Tivoli NetView automatically identifies and ignores
> these addresses. However, if you want to monitor these IP addresses for
> status, a new option is provided to create separate nodes with a single
> interface to represent them. These nodes can then be monitored for status as
> usual. The SNMP sysDescr field is constructed to contain a reference to the
> SNMP sysName of the main device as follows: sysName:<sysname>."
>
> I have also read somewhere that we definitely need CNAT for dynamically
> routed NAT addresses but not for static NAT. I have not yet tried the above
> recommended solution yet.
>
> Please let me know if my understanding is not correct.
>
> Best Regards,
> Siraj
>
>
> -----Original Message-----
> From: Paul [mailto:pstroud@bellsouth.net]
> Sent: Friday, March 26, 2004 2:59 AM
> To: nv-l@lists.us.ibm.com
> Subject: Re: [nv-l] NV 714 and Cisco NAT
>
>
> Not gonna work. As soon as NetView sees that the address he contacted does
> not match what he finds in SNMP, it gets deleted. Take a look at CNAT, it
> should have shipped with NetView. This will allow you to discover NAT'd
> devices.
>
> Paul
>
>
>
> Feroz Khan wrote:
>
>>Hi,
>>
>>We have 5-10 windows boxes whose addresses are getting translated via
>>the Cisco NAT (Header only) on the router to which these nodes connect.
>>NV 714 is on the other side of the router and is unable to discover
>>these NAT devices automatically.
>>
>>Tried everything , deleting the DBs, rediscovering, demand polling,
>> deleting the router and rediscovering etc.
>>The only time these devices show up in the submap is when I ping them
>>individually from the NV box.
>>
>>Is this normal or something is missing ?
>>
>>YES, the netmon.conf was modified for
>>NV_NETMON_DISCOVER_RIBB_AND_NATDADDR=TRUE.
>>and the netmon daemon recycled after that.
>>
>>Any clues , suggestions ?
>>
>>
>>
>>- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
>>-
>>- - - - - - - - - - - - - - - - - - - - - - - - - -
>>*feroz khan* *|* *tivoli **-** quality assurance* *|* *919.224.2192* *|*
>>*_fkhan@us.ibm.com_* <mailto:fkhan@us.ibm.com>* **|** bldg 510 r3d14*
>>/Man’s way leads to* “Hopeless End”, *//Gods way leads to* “Endless
>
> Hope”*/
>
>