Network Management and Monitoring Design
What to monitor and how
Management and monitoring design defines what is observed, how it is collected, and who acts on it. Know the protocols: SNMP (polling and traps; v3 for auth/privacy), syslog (centralized logging with severity levels), NetFlow/sFlow/IPFIX (traffic telemetry), streaming telemetry (push-based, high-frequency), and NTP (accurate timestamps are essential for correlation). Also know configuration management (backups, versioning, templating) and fault versus performance management.
Baselines, thresholds, and alerting
Design starts with a baseline of normal behavior, then thresholds and alerts tuned to avoid noise. Define KPIs (interface errors, utilization, latency, AP client counts, rogue APs) and SLAs for response. Understand out-of-band versus in-band management and why OOB survives production outages.
Traps to watch
- Forgetting NTP - logs and events without synchronized time cannot be correlated.
- Using SNMPv1/v2c in a design that requires authentication and privacy (use v3).
- Alerting on everything, causing alarm fatigue; thresholds need baselining.
- Assuming in-band management is sufficient - if the production path fails, management is lost too.
Rule of thumb
Design monitoring around the question "how would we know, and how fast?" Worked example: to detect a degrading uplink, poll interface error and utilization counters via SNMPv3, baseline normal values, alert on sustained deviation, and forward syslog to a central collector with NTP-synced clocks so events correlate across devices.