COMP347 Unit 8 – Network Management and Network Operations
After completing this extended tutorial, you should be able to:
Network management is the discipline of planning, organising, controlling, and monitoring network infrastructure to ensure reliable, secure, and efficient delivery of services. In modern environments, networks span enterprise campuses, data centres, cloud providers, and edge locations, making management a complex, multi‑faceted challenge. This tutorial provides a comprehensive introduction to the fundamental concepts, architectures, and processes that underpin network management.
We begin by defining network management and its key objectives, then delve into the ISO‑defined FCAPS framework – Fault, Configuration, Accounting, Performance, and Security – which remains the de facto standard for classifying management functions. We explore the role of Network Operations Centers (NOCs), the integration with service management frameworks like ITIL, and the evolution from manual CLI‑based administration to software‑defined and intent‑based operations. Throughout, we emphasise practical applications, industry standards, and the interdependence of management functions.
This tutorial serves as the foundation for the entire Unit 8 series, bridging the textbook’s coverage of network control planes (Chapters 4–5) and security (Chapter 8) with the operational realities of running production networks.
Network management encompasses all processes, tools, and protocols used to operate, monitor, and control network infrastructure. It includes:
The ultimate goal is to deliver agreed service levels to users and applications while minimising operational costs and risks.
The ISO 7498‑4 standard defines five functional areas of network management, collectively known as FCAPS. We now examine each area in detail, including its sub‑functions, key metrics, and typical tools.
Objective: Detect, isolate, and correct abnormal network behaviour to restore normal service as quickly as possible.
Key metrics: Mean Time To Detect (MTTD), Mean Time To Repair (MTTR), availability (uptime), number of incidents.
Common tools: SNMP polling, syslog servers, ping/traceroute, network monitoring systems (Nagios, Zabbix), AI‑driven anomaly detection.
Objective: Maintain consistent, known‑good configurations across all network devices and track changes over time.
Key metrics: Number of unauthorised changes, time to deploy a change, configuration drift percentage.
Common tools: NETCONF/RESTCONF, Ansible, Terraform, RANCID, custom scripts, version control (Git).
Objective: Measure resource consumption for billing, chargeback, or capacity planning.
Key metrics: Bandwidth consumed, number of sessions, cost per GB, peak utilisation.
Common tools: NetFlow/IPFIX, sFlow, RADIUS accounting, cloud provider billing APIs.
Objective: Ensure that network performance meets service‑level objectives and optimise resource utilisation.
Key metrics: Average and peak latency, packet loss percentage, throughput (bps), utilisation (%), jitter (ms).
Common tools: SNMP, telemetry (gNMI), Prometheus, Grafana, commercial NPM (e.g., SolarWinds, Riverbed).
Objective: Protect network assets and data from unauthorised access, misuse, and attacks.
Key metrics: Number of security incidents, time to detect/respond, patch compliance rate.
Common tools: Firewalls, IDS/IPS, SIEM (Security Information and Event Management), vulnerability scanners, endpoint protection.
The five areas are interconnected. For example, configuration changes (configuration management) can affect performance; security events (security management) may be triggered by faults; accounting data helps capacity planning (performance). Effective management requires holistic visibility across all domains.
A Network Operations Center (NOC) is a centralised facility where network and systems are monitored, managed, and maintained 24/7. NOCs are the heartbeat of network operations.
Organisations often assess NOC maturity using a model such as:
While network management focuses on infrastructure, service management addresses the end‑to‑end delivery of services (e.g., VoIP, cloud storage, web hosting) to users. The ITIL (Information Technology Infrastructure Library) framework is widely adopted for service management and includes processes such as:
Network management provides the data and controls that underpin these service management processes. For example, performance metrics feed into SLA reporting, and configuration management supports change management.
An information model defines the structure and semantics of management data.
The choice of information model affects the capabilities of management protocols, with YANG enabling richer configuration and telemetry.
Effective operations rely on standardised workflows. A typical incident management process (adapted from ITIL) includes:
Problem management is separate: it conducts root‑cause analysis (RCA) to prevent recurrence. This may involve “known errors” and workarounds.
Change management ensures that any modifications (hardware, software, configurations) are assessed for risk, approved, scheduled, and communicated.
We now examine three scenarios that illustrate network management challenges in different contexts:
These cases demonstrate the integration of FCAPS areas and the importance of processes, tools, and skilled personnel.
All answers are hidden; click the Show Answer button to reveal.
What does the acronym FCAPS stand for?
Which FCAPS area is responsible for detecting, isolating, and correcting abnormal network behaviour?
List three key metrics used in Performance Management.
What is the primary role of a Network Operations Center (NOC)?
Define the difference between incident management and problem management in ITIL.
Name two management information models and the protocols that use them.
What is the objective of Accounting Management?
List the four levels of NOC maturity mentioned in the tutorial (Reactive, Proactive, Predictive, Autonomous).
What are the three tiers of NOC personnel?
Why is change management important in network operations?
What is the relationship between network management and service management?
Describe the purpose of configuration backup and restore in Configuration Management.
What are the “three pillars” of observability?
Explain how telemetry differs from traditional SNMP polling.
Which FCAPS area is directly concerned with the establishment and enforcement of access control policies?
What does the acronym AIOps stand for and what is its main goal?
What is the difference between synthetic monitoring and real‑user monitoring?
In the context of fault management, what is meant by event correlation?
Describe one challenge of network management in a multi‑vendor environment.
What is the role of a runbook in a NOC?
Explain the term intent‑based networking (IBN).
Which management area would you use to track the cost of bandwidth consumed by each department?
What is the purpose of a post‑incident review?
How does software‑defined networking (SDN) change traditional network management?
What is the difference between availability and reliability in network management contexts?
Sample solutions are hidden – click to reveal.
You are a NOC technician monitoring a large enterprise network. You receive an alert that a core router is unreachable via ICMP ping. List the steps you would take for initial triage, and explain what additional information you would need to determine the severity of the incident.
Severity is determined by impact: number of affected users, criticality of services, and whether there is redundancy.
Draw a diagram showing the relationship between the five FCAPS areas and typical network devices (routers, switches, firewalls, servers). For each FCAPS area, list at least two example management tasks.
Diagram: devices at the bottom, arrows to five boxes labelled Fault, Configuration, Accounting, Performance, Security.
Given a scenario where users in a branch office complain about sluggish application response times, which FCAPS areas would you investigate first? Justify your answer and outline a diagnostic plan.
Primary: Performance Management – check latency, packet loss, and throughput on the WAN link. Also Fault Management – look for errors or flapping interfaces. Security Management – consider DDoS or bandwidth‑hogging threats.
Diagnostic plan:
Identify three Key Performance Indicators (KPIs) that a NOC might track for a WAN link. For each, explain why it matters and what thresholds would trigger an alert.
Research and write a brief paragraph on how a large cloud provider (e.g., AWS, Azure, GCP) implements network management at scale. Mention at least three tools or services they offer for monitoring and operations.
Cloud providers use highly automated management with APIs, telemetry, and centralised controllers. AWS offers CloudWatch for metrics and logs, AWS X‑Ray for tracing, and AWS Config for configuration compliance. They also leverage AI/ML for anomaly detection. Their networks are software‑defined, enabling rapid provisioning and global monitoring.
Describe the difference between reactive, proactive, and predictive NOC operations. Give an example of each.
You are tasked with implementing a change to improve security by updating firewall rules. Outline the change management process you would follow, including approval steps and rollback plan.
Compare and contrast centralised and distributed management architectures. In which scenario would you choose one over the other?
Centralised: Single manager, simple, consistent view, but single point of failure and scalability limits. Best for small/medium networks.
Distributed: Multiple managers, fault‑tolerant, scalable, but complex coordination. Best for large enterprises and service providers.
Define observability and explain why it is considered an evolution beyond traditional monitoring.
Observability is the ability to infer the internal state of a system from its external outputs (metrics, logs, traces). It goes beyond monitoring by enabling exploration of unknown unknowns – you can ask new questions without pre‑defining every metric. It is data‑centric and supports debugging complex distributed systems.
Describe a scenario where accounting management data is used for capacity planning. What data would you collect and how would you analyse it?
Collect traffic volumes per link and per application over a long period (e.g., 6 months). Analyse trends to forecast growth. Use this to decide when to upgrade links, add new circuits, or adjust QoS policies.
How does a SIEM system support Security Management? List its main functions.
A SIEM (Security Information and Event Management) collects and correlates security events from various sources (firewalls, IDS, servers). Functions:
Write a short essay (200‑300 words) arguing whether network management is becoming more or less important with the rise of cloud computing and managed services.
Although cloud providers take on some management responsibilities (e.g., underlying hardware and virtual networks), network management remains critical. Enterprises must manage multi‑cloud connectivity, security policies, hybrid networks, and application performance. The shift to automation and observability makes network management more strategic – focusing on policies, SLAs, and business outcomes rather than low‑level device configuration. Thus, its importance persists, albeit with a different skill set.
Sample answers are hidden; use them to guide your study.
Compare and contrast the FCAPS framework with the ITIL service lifecycle. How do they complement each other in a modern IT organisation? Provide specific examples.
FCAPS is a functional model for network management; ITIL is a service management framework. FCAPS maps primarily to ITIL's Service Operation (Fault, Performance) and Service Transition (Configuration). They complement each other by linking network infrastructure management to business service goals. For example, ITIL's Incident Management uses fault management data; ITIL's Capacity Management uses performance metrics; ITIL's Change Management uses configuration management. Together they ensure that network management supports end‑to‑end service quality.
Design a high‑level organisational structure for a NOC that supports a large enterprise with three data centres, a hybrid cloud, and 50 branch offices. Define roles, responsibilities, and escalation paths.
Structure: NOC Manager, Shift Leads (24x7), Tier 1 technicians (monitoring, basic triage), Tier 2 engineers (troubleshooting, configuration), Tier 3 architects (design, complex problem resolution). Include specialised teams for cloud, security, and automation. Escalation: Tier 1 → Tier 2 (after 15 min) → Tier 3 (if unresolved after 1 hour). On‑call rotation for off‑hours.
Research an industry‑standard network management tool (e.g., SolarWinds, Nagios, or Prometheus). Which FCAPS areas does it primarily address? What are its limitations in terms of Configuration or Accounting?
Nagios excels in Fault and Performance management (monitoring, alerting). It can be extended for reporting but lacks built‑in configuration management and accounting. Prometheus focuses on Performance (metrics) with some fault detection via alerts. Neither is designed for configuration backup/change management; they require integration with other tools (e.g., Ansible, Git).
Discuss the challenges of network management in a multi‑vendor environment. How can standards like SNMP, YANG, and NETCONF help?
Challenges: inconsistent CLIs, proprietary MIBs, different capabilities, varying support for automation standards. Standards like SNMP (monitoring), YANG (data modelling), and NETCONF (configuration) provide a common language and interface, enabling unified management tools and reducing vendor lock‑in. However, not all vendors implement them uniformly.
Write a one‑page white paper on the evolution of network management from CLI‑based approaches to intent‑based networking. Include key milestones and drivers (e.g., scale, cloud, DevOps).
Evolution: CLI and scripts (manual) → SNMP‑based monitoring (automated data collection) → web dashboards and centralised NMS → SDN controllers and automation (NETCONF, APIs) → intent‑based networking (declarative policies, closed‑loop verification). Drivers: network scale, application agility, cloud migration, and DevOps practices. Intent‑based networking reduces human error and aligns network behaviour with business intent.
Explain how synthetic monitoring can be used to proactively detect performance issues in a global enterprise network. Provide an example deployment.
Synthetic monitoring uses simulated transactions (e.g., HTTP GET, DNS lookup, VoIP call) from distributed agents to measure performance. It can detect problems before users are affected. Example: deploy agents in each regional office that periodically ping and fetch a test page from central servers, measuring RTT and response time. Alert if thresholds are exceeded, enabling proactive troubleshooting.
Evaluate the suitability of centralised management for a 5G mobile network core. What are the constraints and alternatives?
5G requires low latency, high reliability, and massive scale (millions of devices). Centralised management may face latency and single‑point‑of‑failure issues. Alternatives: distributed and hierarchical management with edge computing and network slicing. Management functions can be distributed across regional data centres and edge nodes to reduce latency and improve resilience.
Design a management architecture for a large enterprise with 10,000 devices, multiple data centres, and a global WAN. Include redundancy and scalability considerations.
Architecture: hierarchical with regional NOCs (Americas, EMEA, APAC) and a central NOC. Each regional NOC manages its devices; central NOC handles global policies and reporting. Use federated management domains. Redundancy: multiple management stations with load balancing and failover, replicated databases, and backup links. Automation: use APIs and tools like Ansible for consistent provisioning.
Describe the role of network management in a zero‑trust security architecture. How does Configuration and Security Management support zero‑trust principles?
Zero‑trust assumes no implicit trust; every access request is verified. Network management supports this by enforcing strict access controls (Security Management), continuously monitoring for anomalous behaviour (Performance and Fault), and maintaining device compliance (Configuration Management). Automated configuration ensures that only authorised policies are applied, and telemetry helps detect deviations.
Research and summarise the TM Forum’s eTOM framework. How does it relate to FCAPS? Provide an example of how a service provider would use both.
eTOM (enhanced Telecom Operations Map) is a business process framework for service providers, covering operations, strategy, and infrastructure. FCAPS is a functional model for network management. eTOM includes processes like Fulfillment, Assurance, and Billing that rely on FCAPS activities. For example, the Assurance process uses Fault and Performance management to monitor SLAs; Fulfillment uses Configuration management to provision services; Billing uses Accounting data. Together they bridge operations and business.
This extended tutorial has provided a comprehensive introduction to network management, covering definitions, the FCAPS framework, NOC structures, service management integration, standards, operational workflows, and modern trends. We have examined how each FCAPS area contributes to reliable, secure, and performant networks, and how management architectures and processes must evolve to meet the demands of cloud, SDN, and automation.
The quiz, exercises, and homework have been designed to reinforce understanding and encourage critical thinking. Mastery of these fundamentals is essential for the subsequent tutorials, which will delve into specific management protocols (SNMP, NETCONF, RESTCONF), telemetry, configuration management, security operations, and emerging technologies like AIOps.
In the next tutorial, we will explore network management architectures and frameworks in greater detail, including centralised, distributed, and hierarchical models, and examine how they are implemented in practice.
COMP347 Unit 8 – Extended Tutorial 1 • TrustOpen University • Last updated: August 2026