This chapter is from the book
This chapter is from the book
This chapter is from the book
Network Location and Dependencies
The location of the monitoring system within the network topology has wide-ranging architectural ramifications, so you should take some time to consider its placement within your network. Your implementation goals are threefold.
- Maintain existing security measures.
- Minimize impact on the network.
- Minimize the number of dependencies between the monitoring system and the most critical systems.
No single ideal solution exists, so these three goals need to be weighed against each other for each environment. The end result is always a compromise, so it's important to spend some time diagramming out a few different architectures and considering the consequences of each.
The network topology shown in Figure 1.2 is a simple example of a network that should be familiar to any sysadmin. Today, most private networks that provide Internet-facing services have at least three segments: the inside, the outside, and the demilitarized zone (DMZ). In our example network, the greatest number of hosts exists on the inside segment. Most of the critically important hosts (they are important because these are Web servers), however, exist on the DMZ.
)
Following the implementation rules at the beginning of this section, our first priority is to maintain the security of the network. Creating a monitoring framework necessitates that some ports on the firewalls be opened, so that, for example, the monitoring host can connect to port 80 on hosts in other network segments. If the monitoring system were placed in the DMZ, many more ports on the firewalls would need to be opened than if the monitoring system were placed on the inside segment, simply because there are more hosts on the internal segment. For most organizations, placing the monitoring server in the DMZ would be unacceptable for this reason. More information on security is discussed later in this chapter, but for this example, it's simple arithmetic.
There are many ways to reduce the impact of the monitoring system on the network. For example, the use of a modem to send messages via the Public Switched Telephone Network (PSTN) reduces network traffic and removes dependencies. The best way to minimize network impact in this example, however, is by placing the monitoring system on the segment with the largest number of hosts, because this ensures that less traffic must traverse the fire-walls and router. This, once again, points to the internal network.
Finally, placing our monitoring system in a separate network segment from most of the critical systems is not ideal, because if one of the network devices becomes unavailable, the monitoring system loses visibility to the hosts behind it. Nagios refers to this as a network-blocking outage. The hosts on the DMZ are children of their firewall, and when configured as such, Nagios is aware of the dependency. If the firewall goes down, Nagios does not have to send notifications for all of the hosts behind it (but it can if you want it to), and the status of those hosts will be flagged unknown in availability reports for the amount of time that they were not visible. Every network will have some amount of dependency, so this needs to be considered in the context of the other two goals. In the example, despite the dependency, the inside segment is probably the best place for the monitoring host.