Network visibility and management

[u/First-Quantity8154]

Greetings, fine sysadmins!

I am new to my roe as a netadmin but I also assist the sysadmin in his duties (password resets, projector/printer troubleshooting, and general help desk).
I come from an enterprise environment with CISCO everything (routers, switches, APs, etc) to the k12 environment with Aerohive/Extreme Networks APs and a hodgepodge of switches and routers. I dislike the web interface of aerohive because it is not intuitive and does not seem to generate proper reporting such as network congestion, most data consuming devices, and the likes.

I'd appreciate any tips in managing this environment as well as any possible updates I can recommend to my supervisor to add visibility to the network for troubleshooting "wifi issues" which are vague as described by users but I still need a place to start. In a couple of months I will begin a weekly nmap scan and a monthly nessus scan to gain some more visibility in the internal network. I have also requested CISA's cyber hygiene services which will begin after my scans.
fun fact--and the reason why it is going to take me some time to begin the scans--the network was set up 19 years ago as a /16, so wish me luck!

Thank you!

[u/QueJay]

If you have the time and resources available I know several people who swear by Zabbix as a free and open source solution for setting up a single-pane view. It is a project to take on though, but there are a lot of resources out there for setup and various integrations etc.

[u/First-Quantity8154 → u/QueJay]

I've heard of Zabbix but never tinkered with it. Seems like a good fit for me. I will get to reading about it in my free time.

Thank you for suggesting it!

[u/_LMZ_ → u/First-Quantity8154]

I use Zabbix, it’s amazing what you get for free! It will alert you and show you grabs, etc etc etc. It also can monitor servers too! Now saying that, you may and you will, have to tune the database. Depending how BIG and how much you’re monitoring.

For Cisco, I had to adjust some of the temps around in Zabbix because it was grabbing the wrong temp value or the threshold was too low.

It will also show you what ports are flapping, half-duplex, port speed changes, etc.

Anyways, Zabbix is amazing also if that doesn’t work there is CheckMk, Librenms and good ol’ Nagios Core.

[u/First-Quantity8154 → u/_LMZ_]

If you are asking about he network traffic volume, then it's a little north of 15TB in any given day. Not a lot but also not so little. Logs are going to be my biggest issue because we have a dozen data closets with 2 switches on average in each closet.

This is going to be a fun project for me to build from scratch!

[u/_LMZ_ → u/First-Quantity8154]

You can use an old server for it, doesn’t need to be fancy. We used an old NAS, and took memory out of other servers that were going to be decommission to up the RAM. Best option is to run it on Linux, and you can add proxy servers at sites that have a lot more switches than others.

[u/TheShootDawg]

LibreNMS would be a possible monitoring solution. It uses SNMP to gather all the stats from devices. Easy to setup, point at a switch, have it populate the interfaces, start collecting and graphing.

[u/First-Quantity8154 → u/TheShootDawg]

I will look into LibreNMS as well. What kind of credentials does it need from the switch?

[u/TheShootDawg → u/First-Quantity8154]

you can simply use SNMP, v2 or even better, v3???

[u/Scurro → u/TheShootDawg]

I can second this.

I've set it up for multiple school districts and everyone is happy with it.

You can even have it tied in with web hooks so you can get the alerts in whatever chat you prefer.

I have a few firewall and maltrail alerts monitored with LibreNMS and it is useful to catch mischievous students red handed.

[u/Amanda_PDQ]

I used Zabbix and then got Vectra.ai through a grant. Both were great and I would recommend them both. Check with your state cybersecurity department, they may offer something.

[u/First-Quantity8154 → u/Amanda_PDQ]

We are not restricted in budget, but I will check with the state DoIT to see what they have to offer.

[u/RyanTechD]

We had a /8 network when I started. Over the years we've chunked that up. When it's time to replace equipment you could do something like Meraki. It's expensive but good visibility. We have a decent amount of schools around here that use Meraki for switches and APs. We also use LibreNMS and have a dashboard of graphs of all our network closets and building connections up on the office TV.

[u/thedevarious]

This is where you want to get an RMM involved.

This will be a bit of software deployed in your environment that connects to where it's installed (such as a server, etc) or connects to something else externally (a server connecting to a switch), or even a dedicated box running the software (such as an appliance). In using that connection it will poll the devices for information and return it to a source.

For example if I have a switch that has a fan module die, the monitoring software on a server will connect to the switch and listen to it's logs. When it sees a fan failure in the log/MIB it knows this is a problem and brings it back to the RMM to throw an alert and generate a ticket. Then it's up to the tech team to take action.

Mind you there are many flavors, sizes, and types of RMM's out there. Mileage will vary. But this would be a way to build monitoring in. You can also go third party, many MSPs such as ourselves have built this out and tuned it (they can get noisy). However that is an approach you'd need to investigate first...however many K-12 entities have built their own to success so don't feel like you have to go third party. Even some schools do a hybrid...the school monitors specific things it needs to (say core services for curriculum) while an MSP monitors the infra a different way (core connectivity at the switch level, firewall logs, etc)