Cisco Prime Nerk 43 User Guide

							 
B-27
Cisco Prime Network 4.3.2 User Guide
Appendix B      Permissions Required to Perform Tasks Using the Prime Network Clients
  Technologies and Services Permissions
Permissions for Managing GPON Technology
GPON Technology—NEs in User’s Device Scope
Viewing the ADSL/ADSL2+ physical inventory details 
for a device
Viewing the DSL Bonding Group configuration details Task Viewer Operator OperatorPlus Configurator Administrator
Task Viewer Operator OperatorPlus Configurator Administrator
Viewing the Profile Configurations X X X X X
Viewing the Class of Service Configuration X X X X X
Viewing the Link Aggregation Group Configuration X X X X X
Viewing the Firmware Configuration X X X X X
Viewing the OLT Services and Bridges Configuration X X X X X
Viewing the Physical Inventory of the ONU and OLT X X X X X
Viewing the DHCP Relay Agent Configuration for OLT X X X X X
Viewing the Routing Entities Configuration for OLT X X X X X 
						

							 
B-28
Cisco Prime Network 4.3.2 User Guide
Appendix B      Permissions Required to Perform Tasks Using the Prime Network Clients
  Technologies and Services Permissions 
						

							C-1
Cisco Prime Network 4.3.2 User Guide
APPENDIX
 
C
Event Correlation Examples
The following topics provide examples of how Prime Network correlates events: 
Correlation Scenario Overview, page C-1
Correlation Scenarios, page C-2
Root Cause Across Frame Relay, ATM, or Ethernet Clouds, page C-46
MPLS Fault Scenarios, page C-47
Correlation Scenario Overview
The following scenarios demonstrate Prime Network correlation functionality. Figure C-1 shows the lab 
setup for the scenarios described in these topics. The lab simulates a service provider (SP) network. The 
core is based on MPLS and uses OSPF as the Interior Gateway Protocol (IGP). 
The P-network is topologically contiguous, whereas the C-network is delineated into a number of sites 
(contiguous parts of the customer network that are connected in some way other than through the VPN 
service). Note that a site does not need to be geographically contained.
The devices that link the customer sites to the P-network are called customer edge (CE) devices, whereas 
the service provider devices to which the CE routers connect are called provider edge (PE) devices. 
Where the provider manages an Ethernet access network, the CE devices are connected to the PE 
devices, which are usually LAN switches with Layer 3 capabilities.
The access network can be any Layer 2 technology.
In this lab there are two Layer 2 technologies in the access network:
Ethernet
Frame Relay
The access network in the lab is unmanaged (a cloud).
In most cases, the P-network is made up of more than just the PE routers. These other devices are called 
P-devices (or, if the P-network is implemented with Layer 3 technology, P routers). Similarly, the 
additional Layer 3 devices at the customer sites that have no direct connectivity to the P-network are  
						

							 
C-2
Cisco Prime Network 4.3.2 User Guide
Appendix C      Event Correlation Examples
  Correlation Scenarios
called C routers. In this example, C-routers are not part of the lab setup and are not managed by 
Prime Network. 
The CE devices are located at the customer site and can be managed by the SP. All other devices (PEs, 
Ps, and RRs) are located at the SP site. These devices are maintained by the SP.
An end-to-end MPLS VPN solution is, like any other VPN solution, divided into the central P-network 
to which a large number of customer sites (sites in the C-network) are attached. The customer sites are 
attached to the PE devices (PE routers) through CE devices (CE routers). Each PE router contains several 
VRF tables, at least one per VPN customer. These tables are used together with multiprotocol BGP to 
run between the PE routers to exchange customer routes and to propagate customer datagrams across the 
MPLS network. The PE routers perform the label imposition (ingress PE router) and removal (egress PE 
router). The central devices in the MPLS network (P routers) perform simple label switching.
There are BGP processes running on the PE devices, and each PE is a neighbor to both RR devices. This 
way, the lab has a backup if one RR is down.
All the devices are managed inband. The management access point is Ethernet 0/0 on PE-East. To enable 
access to the CE devices, a loop was created between two ports on PE-East.
Figure C-1 Correlation Scenarios Lab Setup
Correlation Scenarios
The following topics describe specific alarms that use correlation logic on top of the root cause analysis 
flow: 
Device Unreachable Correlation Scenarios, page C-3
Multiroute Correlation Scenarios, page C-11 
						

							 
C-3
Cisco Prime Network 4.3.2 User Guide
Appendix C      Event Correlation Examples
  Correlation Scenarios
BGP Neighbor Loss Correlation Scenarios, page C-14
EFP Down Correlation Scenarios, page C-29
HSRP Scenarios, page C-31
IP Interface Failure Scenarios, page C-32
GRE Tunnel Down/Up, page C-40
Q-in-Q Subinterface Down Correlation Scenarios, page C-43
VSI Down Correlation Scenarios, page C-45
Device Unreachable Correlation Scenarios
Device reachability is measured by management protocol connectivity. Connectivity tests are used to 
verify the connection between VNEs and the managed network elements. The connectivity is tested on 
each protocol a VNE uses to poll a device. Prime Network-supported protocols for connectivity tests are 
SNMP, Telnet, and ICMP. 
The following topics describe the scenarios in which device reachability issues occur: 
Device Unreachable on Device Reload or Device Down Event, page C-3
Device Unreachable on Another Device Unreachable Event, page C-6
Device Unreachable on Link Down Event, page C-9
Device Unreachable on Device Reload or Device Down Event
Figure C-2 illustrates the lab setup for Device Unreachable on Device Down or Device Reload event.
Figure C-2 Lab Setup for Device Unreachable on Device Down or Device Reload Event 
						

							 
C-4
Cisco Prime Network 4.3.2 User Guide
Appendix C      Event Correlation Examples
  Correlation Scenarios
Description of Fault Scenario in the Network
CE-5 goes down or is reloaded.
Related Faults
The port S.1/2 of CE-5 operationally goes down (between CE-5 and PE-East).
The port S.2/3 of PE-East operationally goes down (between PE-East and CE-5).
CE-5 is unreachable from the management subnet.
NoteOther related faults might occur due to the CE-5 down or reload. Syslogs and traps corresponding to 
network faults are also reported. Additional faults, other than for the connectivity issue of CE-5 and the 
Link Down with the PE-East device, might be reported but are not described in this section. This topic 
relates specifically to Device Unreachable events.
Prime Network Failure Processing
Event Identification
The following service alarms are generated by the system:
[Device Unreachable, CE-5] event. 
The device unreachability event means that no other information can be collected from this device 
by the VNE.
[Link Down on Unreachable, PE-East < > CE-5] event. 
The Link Down event is issued by the PE-East VNE (active) as a result of the link down negotiation 
process.
Possible Root Cause
1.Prime Network waits two minutes. For more information, see How Prime Network Correlates 
Incoming Events, page 10-4.
2.After two minutes, the following occurs:
–The [Device Unreachable, CE-5] event triggers the CE-5 VNE to initiate an IP-based flow to 
the management IP address:
Flow Path: CE-5 > PE-East > management subnet
–The [Link Down on Unreachable, PE-East < > CE-5] event triggers the CE-5 VNE to initiate 
local correlation.
Root Cause Selection
For the event [Device Unreachable, CE-5]:
Collected Events: [Link Down on Unreachable, PE-East < > CE-5].
NoteOther possible events are also collected, such as Interface Status Down events.
Root Cause: There is no root cause (opens a new ticket in the gateway). 
						

							 
C-5
Cisco Prime Network 4.3.2 User Guide
Appendix C      Event Correlation Examples
  Correlation Scenarios
NoteThe root cause selection process activates special filtering for the event [Device 
Unreachable, CE-5] for which the event [Link Down on Unreachable] cannot be selected as 
the root cause; therefore, the event [Link Down on Unreachable, PE-East < > CE-5] is not 
selected as the root cause.
For the event [Link Down on Unreachable, PE-East < > CE-5]:
Collected Events: [Device Unreachable, CE-5].
Root Cause: Correlates to [Device Unreachable, CE-5].
Figure C-3 shows how the events are correlated in this scenario.
Figure C-3 Device Unreachable on Device Down
Clearing Phase
When a down or reloaded device comes up again and starts responding to polling requests made by the 
corresponding VNE, the device is declared reachable, thus clearing the unreachable alarm. Other related 
alarms are cleared in turn after the corresponding VNEs verify that the malfunctions have been resolved.
Variation
In a device reload scenario, the following additional events are identified by the system (in addition to 
the device down scenario):
Reloading Device syslog.
Cold Start trap.
For the event [Device Unreachable, CE-5]:
Additional Collected Event: [Reloading Device syslog, CE-5].
Root Cause: Correlates to [Reloading Device syslog, CE-5].
Figure C-4 shows how the event are correlated in this scenario.
Device unreachablece-5-IOU-161
370855
PE-East-IOU-161#0:Serial2/3ce-5-IOU-161#0:Serial1/2
PE-East-IOU-161 VRF vrfB IP:Serial2/3 : 169.254.161.223
PE-East-IOU-161 VRF vrfB IP:Serial2/3
PE-East-IOU-161 VRF vrfB IP:Serial2/3
Event Correlation HierarchyLocation
Link down on unreachable
OSPF neighbor down syslog
Interface status down
Line down syslog 
						

							 
C-6
Cisco Prime Network 4.3.2 User Guide
Appendix C      Event Correlation Examples
  Correlation Scenarios
Figure C-4 Device Unreachable on Device Reload 
Device Unreachable on Another Device Unreachable Event
Figure C-5 illustrates the lab setup for Device Unreachable on another Device Unreachable event.
Figure C-5 Lab Setup for Device Unreachable on Another Device Unreachable Event
Description of Fault Scenario in the Network
P-North device is reloaded.
Related Faults
P-North is unreachable from the management subnet.
The links of P-North operationally go down and, as a result, the surrounding devices go down.
RR2, accessed by the link P-North, RR2 (also known as L3) is unreachable.
Reloading device syslogce-5-IOU-161
370856
PE-East-IOU-161 VRF vrfB IP:Serial2/3 : 169.254.161.223 
PE-East-IOU-161 VRF vrfB IP:Serial2/3
PE-East-IOU-161 VRF vrfB IP:Serial2/3
ce-5-IOU-161
PE-East-IOU-161#0:Serial2/3ce-5-IOU-161#0:Serial1/2
Event Correlation Hierarchy Location
OSPF neighbor down syslog
Interface status down
Line down syslog
Device unreachable
Link down on unreachable 
						

							 
C-7
Cisco Prime Network 4.3.2 User Guide
Appendix C      Event Correlation Examples
  Correlation Scenarios
Prime Network Failure Processing
NoteThis scenario is similar to the one described in Device Unreachable on Device Reload or Device Down 
Event, page C-3, except that in this scenario the L3 Link Down is not discovered because both connected 
devices (RR2 and P-North) are unreachable by Prime Network. Therefore, the VNE is unable to detect 
the Link Down problem. 
Event Identification
The following service alarms are generated by the system:
[Device Unreachable, P-North] event.
The device unreachability event means that no other information can be collected from this device 
by the VNE.
[Device Unreachable, RR2] event.
Possible Root Cause
1.Prime Network waits two minutes.
2.After two minutes, the following occurs:
The [Device Unreachable, P-North] event triggers the P-North VNE to initiate an IP-based flow to 
the management IP subnet:
Flow Path: P-North > PE-East > management subnet
The [Device Unreachable, RR2] event triggers the RR2 VNE to initiate an IP-based flow to the 
management IP.
Flow Path: RR2 > P-North > PE-East > management subnet
Root Cause Selection
For the event [Device Unreachable, P-North]:
–Collected Events: [Reloading Device syslog, P-North].
–Root Cause: Correlates to [Reloading Device syslog, P-North].
For the event [Device Unreachable, RR2]:
–Collected Events: [Device Unreachable, P-North] and [Reloading Device syslog, P-North].
–Root Cause: Correlates to [Reloading Device syslog, P-North] (as this has a higher weight than 
the event [Device Unreachable, P-North]). 
						

							 
C-8
Cisco Prime Network 4.3.2 User Guide
Appendix C      Event Correlation Examples
  Correlation Scenarios
Figure C-6 displays the events identified by the system in this scenario.
Figure C-6 Device Unreachable on Other Device Unreachable
Clearing Phase
When a reloaded device comes up again (along with the L3 link that is vital for the RR2 management), 
the RR2 starts responding to polling requests from the RR2 VNE. The device is declared as reachable, 
thus clearing the Device Unreachable alarm.
Reloading device syslogP-North-IOU-161
PE-East-IOU-161
PE-East-IOU-161 IP:Serial2/2 PE-East-IOU-161
PE-East-IOU-161 IP:Serial2/2
PE-East-IOU-161 : 169.254.161.216
PE-East-IOU-161
PE-East-IOU-161 : 169.254.161.224
RR1-IOU-161
P-West-IOU-161
ce-1-IOU-161
RR2-IOU-161
PE-South-IOU-161
P-South-IOU-161
P-North-IOU-161
P-North-IOU-161#0:Serial1/3PE-East-IOU-161#0:Serial2/2
PE-East-IOU-161
PE-East-IOU-161
370857
Event Correlation Hierarchy Location
LDP neighbor down
LDP neighbor down syslog
BGP neighbor down syslog
BGP neighbour loss
BGP neighbor down syslog
Device unreachable
Device unreachable
Device unreachable
Device unreachable
Device unreachable
Device unreachable
Device unreachable
Link down on unreachable
LDP neighbor down
Line down syslog
Interface status down
LDP neighbor down syslog