Table Of Contents
Release Notes for CiscoWorks Network Compliance Manager 1.8
Published: July 2012, OL-27498-01
These release notes are for CiscoWorks Network Compliance Manager (NCM) 1.8. It contains the following sections:
Note The Docs tab provided in the CiscoWorks NCM user interface might not include links to the latest documents. Therefore, we recommend that you access the CiscoWorks NCM documentation set using the following URL: http://www.cisco.com/en/US/products/ps6923/tsd_products_support_series_home.html
CiscoWorks NCM tracks and regulates configuration and software changes in a multivendor network environment. It provides visibility into network changes and tracks compliance with a broad variety of regulatory, IT, corporate governance, and technology requirements. CiscoWorks NCM helps IT staff identify and correct trends that could lead to problems, such as network instability and service interruption.
What's New in CiscoWorks NCM 1.8
CiscoWorks NCM 1.8 includes the following features:
•HP NNMi-Cisco NCM Integration improvements:
–The integration now supports SSL connections between NCM and NNMi.
–The NNMi nodes, interfaces, and incidents forms include new tabs containing NCM data (current device configuration, configuration history, and interface configuration) in the analysis pane.
For information on the HP NNMi-Cisco NCM integration, see the HP NNM Integration User Guide for CiscoWorks Network Compliance Manager.
•Import user data - You can now import user and user group definitions from CSV files.
•Import device data improvements - You can now import custom attributes for devices and device groups from CSV files.
•Task completion notification - You can now configure tasks to send email messages upon completion.
•Support for Oracle RAC.
–Case-insensitive search for most fields with Oracle databases. (Microsoft® SQL Server and MySQL database searches are case-insensitive by default.)
–Faster search for device configurations using the "contains (full text)" operator.
•Improved database pruning gradually reduces the size of the NCM database.
•Updated PCI (formerly Visa CISP) compliance report.
•Performance improvements, including reduced data storage
•New deployment architecture for disaster recovery using Oracle GoldenGate.
–Support for additional virtual devices
–Additional IPv6 support
–SFTP client support
–Ability to enforce the saving of configurations on a per-task basis
–Support for directory structures for the filesystem diagnostic and Software Center
–DSD_Feature_Index.html, a list of all drivers with each driver's feature matrix and a link to each driver's individual DSD
–DSD_SYSOID_Mapping_Index.html, a master list of all supported / tested sysOIDs by driver package / driver name / driver description
What's Been Fixed in CiscoWorks NCM 1.8
Table 1 describes the issues fixed in CiscoWorks NCM 1.8.
Table 2 shows the supported platforms for CiscoWorks NCM 1.8.
The following operating systems are no longer supported:
•Red Hat AS3
Note For all operating system upgrades, please see the respective vendor documentation or contact your system support personnel. Cisco is not responsible for issues that might arise during third-party product upgrades.
Table 3 shows the databases that are supported by CiscoWorks NCM 1.8.
Except for modest deployments without full enterprise scale and performance requirements, the application server and database server should be on separate physical machines. In addition, the database server should be dedicated to CiscoWorks NCM, rather than serving multiple applications.
Note CiscoWorks NCM 1.8 does not support the use of Microsoft SQL Named Instances.
The following databases are no longer supported:
•Oracle 9i and Oracle 9.2
•Microsoft SQL Server 2000
Note For all database upgrades, please see the respective vendor documentation or contact your database analyst. Cisco is not responsible for issues that might arise during third-party product upgrades.
Additional CiscoWorks NCM Configurations
If you have configured a High Availability Distributed System, the database requirements for Oracle and Microsoft SQL Server include:
If you have configured a Horizontal Scalability environment, the database requirements for Oracle and Microsoft SQL Server include:
See High Availability Distributed System Configuration Guide for CiscoWorks Network Compliance Manager for information on configuring High Availability Distributed System environment.
See Horizontal Scalability User Guide for CiscoWorks Network Compliance Manager for information on configuring Horizontal Scalability environment.
Note High Availability and Horizontal Scalability environments are not supported for MySQL.
Table 4 lists the virtual servers NCM supports.
Table 4 NCM-Supported Virtual Servers
Virtual Server Supported Operating System Types Notes
•ESX Server 3.5
•ESX 4.0 or later minor version
•ESXi 4.1 or later minor version
•ESXi 5.0 or later minor version
•Host OS:— Windows— Linux
•Guest OS: Any of the operating systems listed in Table 2
•The virtual environment must meet the x86-64 or AMD64 hardware requirements listed in Table 5.
Microsoft® Hyper-V R2
· Host OS: Windows Server 2008 R2 x64· Guest OS: Any of the Windows operating systems listed in Table 2
Oracle Solaris Zones
If you are running NCM in a virtual environment, review the follow guidelines:
•Because NCM can be network intensive, many virtual machines sharing a virtual switch and network interface card could result in unexpected behavior, including time-outs and failed tasks.
•Each virtual environment is different and could function differently under loads with shared VM guests.
•On a virtual server, it is recommended that the Disk I/O be split. The virtual server must have two arrays:
–One array for the host operating system
–One array for the virtual machines
•Live migration (for example, using Vmotion) of the NCM application server is not recommended.
•If you plan to use virtual machines for both the NCM application and the NCM database, ensure that they are running on different guests. It is recommended to host the database virtual machine on a different array to avoid conflicting I/O on the array. Verify that the database is supported in a virtual environment.
•When configuring NCM on virtual machines in a Multimaster Distributed System environment or a Horizontal Scalability environment, the maximum number of NCM application servers is two.
•Some virtual guests time drift, which can be an issue and should be corrected. Synchronizing the guests to an external time source can solve this issue.
•Each NCM guest system must be configured with a set reservation for CPU and memory. These reservations should be at least 125% of the standalone server requirements listed in Table 5 and Table 6. Ensure that the resource pool containing the NCM guest system has adequate resources to consistently deliver the CPU and memory reservations to the NCM guest system.
To counter performance issues while running NCM in a virtual environment, do the following:
•Increase hardware resources on the physical host.
•Ensure resources are dedicated to the NCM application server guest.
•Decrease the number of guests running simultaneously.
•Add a network interface card dedicated to NCM to the virtual server.
A large number of concurrent tasks increases NCM resource demand. If performance issues arise, reduce the number of concurrent tasks or provide more resources to the NCM virtual server. (This suggestion also applies to physical servers.)
Additional Required Applications
You need to install the following applications:
•CiscoWorks NCM supports the following browsers:
–Mozilla Firefox 3.x and higher
–Internet Explorer 7.x and higher
Note Windows pop-up blockers must be disabled for the browser. Cookies must be enabled for the browser.
•Microsoft Excel 2000 or higher, if you are viewing Summary Reports from the CiscoWorks NCM server.
•Adobe® Acrobat Reader™ version 4.0 or higher if you are viewing CiscoWorks NCM documentation from the CiscoWorks NCM server.
•ActivePerl 5.8.x (for Windows).
•Perl 5.8.x (for Solaris and Linux). The CiscoWorks NCM Convert-to-Perl script feature uses Perl.
•Perl Net::SSH::Expect module (for using the Connect module with SSH)
Note Third-party products mentioned in this documentation are manufactured by vendors independent of Cisco. Cisco makes no warranty, implied or otherwise, regarding the performance or reliability of these products.
CiscoWorks NCM requires the following minimum hardware:
Table 6 Database Server Requirements
Intel Xeon or equivalent, 3.0+ GHz
16 GB RAM
512 GB, Fast SCSI
100 Mbps Fast Ethernet, full duplex
Known Problems in CiscoWorks NCM 1.8
This section contains information about the limitations and problems known to exist in CiscoWorks NCM 1.8
HP NNMi-CISCO NCM integration in the NNMi console
Bug ID : QCCR1B102485
The HP NNMi-CISCO NCM integration must be enabled and disabled in the NNMi console.The Enabled/Disabled control on the 3rd Party Integrations page controls communication from NCM to NNMi only. It does not fully control the CISCO NNMi-CISCO NCM integration.
Workaround Enable and disable the HP NNMi-CISCO NCM integration on the HP NNMi-CISCO NCM Integration Configuration form in the NNMi console.
Write memory command not included in the session log
Bug ID : QCCR1B102502
If you select both of the "Force Save" and "Session Log" options on any device task page, you can expect to see the command used to save the running configuration to startup configuration in the task session log. For instance, for a Cisco device you can usually see the command "write memory" being sent to device in the session log. For certain tasks, you might not see the saving configuration command in the session log, notably the Run Diagnostic task. The command is sent to device but not logged.
Workaround To confirm that the command was sent, check the jboss_wrapper log.
HP NNMi-CISCO NCM integration: some NCM interface configurations are not available in NNMi
Bug ID : QCCR1B102518
Some NCM interface configurations are available in the NCM console but not in the NNMi console. For information about how NNMi interfaces are mapped to NCM ports, see the HP NNM Integration User Guide for CiscoWorks Network Compliance Manager.
Full-text search returns incorrect results for searches including hyphens
Bug ID : QCCR1B102520
Full-text search queries that contain a hyphen (-) might return more results than expected.
Failure while enabling case-insensitive search (Oracle)
Bug ID : QCCR1B102927
The mod oraclecaseinsensitive -option enable command sometimes returns an error message: GEN_FAILURE: Failed to modify database. In this case, case-insensitive search has not been enabled. Wait for few minutes, and then rerun the mod oraclecaseinsensitive -option enable command.
Autopass license overrides legacy license
Bug ID : QCCR1B95407
Introducing an CISCO Autopass license key prevents NCM from using a legacy license key. This issue affects customers who upgrade to NCM 1.8. It can take two forms:
•A fresh installation of NCM 1.8 that activates the Instant-On license during installation. In this case, the product runs fine until the Instant-On license expires. Upon expiration of the Instant-On license, NCM does not recognize the legacy license, so NCM is not usable.
•Application of an additional capacity Autopass license to an NCM 1.8 system that was upgraded in place from a previous version of NCM and is still using a legacy license. In this case, NCM recognizes only the newly added capacity.
Workaround In either case, the solution is to remove the Autopass license key as follows:
1.Locate the Autopass license file:
2.In a text editor, delete the contents of the lickeys.dat file, and then save the empty file.
3.Verify that an appropriate legacy NCM license (license.dat file) exists in the NCM root directory.
4.If an additional capacity Autopass license caused the issue, contact your Cisco Sales Representative to request a legacy format license key for the additional capacity, and then apply that key.
5.Restart the NCM management engine.
NCM now runs with the legacy license from the license.dat file.
Enabling cross-site scripting checks causes garbled characters in NCM 1.8 on SJK systems
Bug ID : QCCR1B91853
On a non-English system, when the "Cross site scripting check" check box is selected on the Admin > Administrative Settings > User Interface page, user-entered values, such as group, policy, and policy rule names, might include garbage characters.
Incorrect SNMPv3 Configuration Prevents Correct Device Detection
Bug ID : QCCR1B86730
For a device whose NCM configuration includes SNMPv3 settings, NCM first tries to communicate with the device using SNMPv3. NCM then tries the SNMPv1 or SNMPv2c settings. If the SNMPv3 settings are incorrect, NCM does not recognize that the SNMPv3 connection failed and detects the device as a non-active node or an unrecognized host. Therefore, NCM does not attempt SNMPv1 or SNMPv2c communication with the device.
Workaround Correct the SNMPv3 settings or remove the SNMPv3 configuration so NCM uses only SNMPv1 or SNMPv2.
Using SNMPv3 with Privacy and AES192 and AES256 Encryption
Bug ID : QCCR1D88942
Several tasks, including Detect Network Devices and Discover Driver, do not correctly use SNMPv3 with the AES192 or AES256 encryption privacy protocol.
Workaround Use a different encryption method, such as AES128.
SNMP Timeout Value Might Be Too Short for SNMPv3 Communications
Bug ID : QCCR1B87867
If you encounter frequent timeouts during communications with SNMPv3 devices, increase the value of the SNMP Timeout setting on the Device Access tab of the Administrative Settings page.
Telnet and SSH Sessions (IPv6 devices)
Bug ID : QCCR1B87641
NCM does not cache telnet or SSH sessions to IPv6 devices. Therefore, these histories are not available from the device information page.
Alternate Driver Discovery (IPv6 devices)
Bug ID : QCCR1B87801
Alternate driver discovery incorrectly interprets the first colon (:) of an IPv6 address as indicating a port on the device.
Users Without Permissions to All Partitions Might Not Be Able to Compare Device Configurations
Bug ID : QCCR1D94263
Users with access to some, but not all, partitions do not see the options for comparing devices on the Configuration Changes tab of the Devices page.
Bug ID : QCCR1B86671
NCM enables you to define custom diagnostics to capture specific information that is useful in your environment. If the name of a custom diagnostic is longer than 80 characters, the Device Diagnostic page shows the content of the most recent diagnostic. However, the Diagnostics History table at the bottom of the page does not appear due to a rendering error.
Bug ID : QCCR1D86308
Users with Admin permissions can view the full list of policies on the Policies page and segment polices into separate policy tags. However, users with Full Access permissions cannot filter policies based on policy tags when there is more than one site partition.
NCM-NNMi Integration (IPv6 devices)
Bug ID : QCCR1B86228
NCM-NNMi integration does not support synchronizing IPv6 devices. Only IPv4 devices are supported.
Using the mod authentication command
Bug ID : QCCR1D116666
When there are no device specific authentication records to modify for a device the mod authentication command reports the following error:
GEN_FAILURE : The Device Password Information for Device you requested can not be found. It may have been deleted.
Workaround You can use the add authentication command to create a new entry.
Bug ID : QCCR1D113667
Network diagrams can be viewed in either Visio, static JPEG, or interactive JPEG format. When installing NCM 1.8 on Windows Server 2008, JPEG formatted network diagrams do not contain icons.
Memory Allocation Error
Bug ID : QCCR1D114717
If you have installed NCM on a Linux platform, you might see the following error in the log messages or within the results of failed NCM tasks:
Caused by: java.io.IOException: error=12, Cannot allocate memory
Note This error occurs when the JVM (Java process) attempts to run an external shell script, such as a custom action or memory monitor. To run the external shell script, the system must fork its process--a mechanism that requires the parent process to copy itself for the child process. Making a copy of the parent process could send a request to the system kernel for more memory than the system can allocate. (Note that this can occur on either a 64-bit or 32-bit server.)
Workaround : As root, run the following command at the root shell prompt:
echo 1> /proc/sys/vm/overcommit_memory
Using API calls to move sites and tasks
Bug ID : QCCR1D112938
Currently, NCM 1.8 does not support failover scripts when a NCM Core goes down in a Distributed System or Horizontal Scalability environment.
Workaround : NCM provides API calls for moving sites and tasks from a down NCM Core to an up NCM Core.
Note : (Be sure to move the sites before you move the tasks.)
Bug ID : QCCR1B103211
If the current NCM is 64-bit and was upgraded from 32-bit NCM, the NCM uninstaller does not work.
Workaround If you upgrade a 32-bit NCM platform to a 64-bit NCM platform, check the NCM install directory. If there is a directory named "jre_old", do the following before uninstalling NCM:
1.Stop NCM services (this includes TFTP, Syslog, SWIM, and FTP).
2.Rename <NCM install dir>/jre.
3.Rename <NCM install dir>/jre_old to <NCM install dir>/jre.
4.Run the NCM uninstaller.
FTP Service (Starting)
Bug ID : QCCRID114411
If you restart NCM through the CLI on a Linux or Solaris platform, the FTP service will not start. You must start the FTP service via the NCM Web UI after the NCM has been started.
Note There are cases where FTP configuration is changed and the FTP service needs a restart to reflect the changes. In this case, you must do this via the NCM Web UI.
Bug ID : QCCR1D112098
The NCMUserManager class utilizes a configuration option to identify the username and password of the authorized FTP account. There is only one FTP account at this time. If the NCM administrator changes the configuration value in NCM, the FTP server will not be aware of the change until it has been restarted because the FTP server does not reload configuration options before performing a user check.
Workaround The FTP server runs as a separate process outside of NCM and is not notified when changes to the .rcx files are made. Restart the FTP server if the FTP account username or password is changed.
CLI driver discovery via Bastion Host does not work for some devices
Bug ID : QCCR1D105486
When configuring a device to use a Bastion Host server with SSH, the Discover Driver task fails with the following error message: This task did not complete
In addition, the Session Log is not stored for the failed task.
Workaround Discover the driver without the Bastion Host or manually assign the driver.
Oracle Database Log Files
Bug ID : QCCR1D1114453
Oracle database users could encounter the following error in their log files, associated with a failed query:
java.sql.SQLException: ORA-00600: internal error code, arguments: [kglhdgn_1], [0xA000000], , , , , , 
This is an Oracle internal error, normally handled by the DBA and Oracle Support. The error is shown below:
ORA-00600 internal error code, arguments: [string], [string], [string], [string], [string], [string], [string], [string]
This is the generic internal error number for Oracle program exceptions. It indicates that a process has encountered a low-level, unexpected condition. Causes of this message include:
•Failed data checks in memory
•Hardware, memory, or I/O errors
•Incorrectly restored files
The first argument is the internal message number. Other arguments are various numbers, names, and character strings. The numbers may change meanings between different versions of Oracle.
Workaround Report this error to your DBA or Oracle Support Services.
Bug ID : QCCR1D102754
VLAN searches saved in NCM 1.4 or earlier are not valid in NCM 1.8 because of VLAN features added in NCM 1.5.01. If you attempt to view a saved VLAN search, you could see the following error message:
Error executing query VLAN: PortInVlanName is not a valid field name for this query.
Workaround Remove and re-create the VLAN search.
Uploading Large Image Files
Bug ID : QCCR1D99027
Currently, NCM is limited to uploading device configurations no greater than 1GB.
Provision Device Task
Bug ID : QCCR1D102620
Although the Provision Device task enables you to select more than one device, the task only works with one device (or when using a .csv file for multiple devices). Attempting to select more than one device, or a device group, using the Device Selector will cause an error.
Bug ID : QCCR1D101509
If you cancel a task that is currently communicating with a device, NCM could mark subsequent attempts to run the task (or similar tasks) as "skipped". This could happen even if communication between the task and the device seem to be hung and you are waiting for a timeout.
This issue can occur because NCM is looking for a clean opportunity to end communication between the task and the device before actually canceling the task. As a result, NCM will continue to execute the task until that point is reached. Any attempt to rerun the task before it is canceled will appear to NCM as if the task is already in progress. As a result, NCM will mark the new task as "skipped". You must give NCM ample time to finish with the canceled task. Once that has occurred, NCM will be able to rerun the task.
Using the $tc_device_enable_password$ variable in command scripts
Bug ID : QCCR1D100314
When using the $tc_device_enable_password$ variable in a command script, if the device enable password contains an at sign (@) character, the @ character will be preceded by a backslash (\) character.
Device Managed IP Addresses Page
Bug ID : QCCR1D101755
When making changes to the Device Managed IP Address, because NCM attempts to remember a connection path, the change might not take effect.
Workaround On the Device Managed IP Addresses page, click the "Reset last used IP" link.
Setting Parent Task Priority
Bug ID : QCCR1D98393
When changing a parent task's priority that is currently running, any existing child tasks that are in the "Pending" or "Waiting" state will appropriately change their priority to that of the parent task. However, child tasks that have not been created yet or are in another state, such as "Running" or "Paused" will retain the parent task's original priority. If a parent task is not running and its priority is changed, all of the parent task's child tasks take on the new priority.
Testing OpenLDAP User Authentication
Bug ID : QCCR1D99664
When configuring NCM to use OpenLDAP for NCM user authentication, save the configuration before using the test function to verify the settings.
Using LDAP Servers
Bug ID : QCCR1D99663
If you are using a LDAP server for external user authentication, you might need to modify certain LDAP related options in the appserver.rcx file. The default settings will work with the Active Directory server under most situations. However, for other types LDAP servers (depending on the LDAP schema configurations), you might need to customize the following settings if you are experiencing issues with the default settings:
<!-- Attribute mapping for Generic LDAP server-->
<option NCMme="ldap_server/attr_mapping/Generic/group_search">group,organizatioNCMlunit, container,groupOfUniqueNCMmes</option>
<option NCMme="ldap_server/attr_mapping/Generic/member_search">member,uniqueMember </option>
<option NCMme="ldap_server/attr_mapping/Generic/userNCMme_search">samAccountNCMme,uid,cn </option>
Ignore the following settings. They are not used at this time.
<!-- Attribute mapping for SunLDAP server-->
<!-- Attribute mapping for OpenLDAP server-->
The "group_search" option specifies the list of LDAP entries to search for in the LDAP groups.
This information is used in Step 3 of the LDAP Setup Wizard, where you define the LDAP groups to specify the members are allowed to login to NCM.
Consult with your organization's LDAP Administrator to ensure that the list contains all necessary group attributes. For example, it might be necessary to add "groupOfName" to the list for the LDAP group search to work.
The same concept applies to "username_search" and "member_search". Both of these are used during the NCM login process to positively identify the user and to determine the user's group memberships. If the default LDAP attribute names do not match your LDAP schema configuration, change them accordingly.
The "group_name" option specifies the attribute names that usually contain the group name. If the attribute name for the LDAP group is not "name", "cn", and "commonName", you must modify them accordingly. You rarely need to change this option, however.
After you make the appropriate changes, save the appserver.rcx file and restart the NCM server.
Bug ID : QCCR1D100298
Scripting to a vSwitch is done via direct API calls to the containing ESX server. As a result, there is no way to prevent scripts from modifying ESX server settings outside those that pertain to the vSwitch.
This is true even in cases where MSP permissions are being granted to the vSwitch, but not the containing ESX server.
Including URLs in Policies
Bug ID : QCCR1D98621
When creating a policy and including a vendor solution URL and/or a vendor advisory URL, the URL must start with the "http://" prefix, otherwise the link might not be correctly interpreted by the browser.
Note Note that if the URL field is left blank, when selected, the link could open the NCM Home page.
Running NCM on a Solaris Platform
Bug ID : QCCR1D99873
When starting the NCM server on a Solaris platform, there is a remote chance that the NCM server will crash due to an error in the native frame_sparc.cpp file. This is due to a bug in the Solaris JVM Biased Locking feature.
Workaround Add the following VM argument to the jboss_wrapper.conf file located in NCM_INSTALLED_DIR/server/ext/wrapper/conf:
Where # is the next number in sequential order of all the parameters. For example, if the jboss_wrapper conf file has the following arguments, the workaround VM argument would be #6.
Viewing VLAN Information for a Port/Interface
Bug ID : QCCR1D98139
When viewing device MAC Addresses details on the MAC Address Details page, the VLAN field is not populated.
Workaround To display VLAN information for a port/interface, click the Port Name link for that port on the MAC Address Details page. The Interface Details page opens. Scroll down to the Member VLANs field to view VLAN information.
Using Active Directory
Bug ID : QCCR199633
If you are using Active Directory, you must modify the corresponding options in the appserver.rcx file to include the correct attributes in the search mapping session.
•In the appserver.rcx file, locate <!-- Attribute mapping for Generic LDAP server--> session.
•Make sure that:
"groupOfName" is included in the "group_search".
"uid" is included in the "username_search".
"member" is included in the "member_search".
•Save the changes to the appserver.rcx file.
•Restart the NCM server.
Java Plug-in Version
Bug ID : QCCR1D88659
If the Connect function fails and the NCM server hangs, check the version of Java running on your Windows system. This is problem with the Java Plug-in to your Web browser. The issue is not with the NCM server.
To check what version of Java you are running:
Step 1 Go to Start > Control Panel.
Step 2 Double-click Java.
Step 3 In the General tab, click About.
The Java version will be displayed
If you have Version 6 Update 11 or later, you must install an older JRE on your Windows system. Version 6 Update 10 and earlier are known to work.
Using the Device Group Selector
Bug ID : QCCR1D98865
Some Chinese characters will not be displayed when using the Device Group Selector.
Creating advanced Perl scripts
Bug ID : QCCR1D101541
While creating an advanced Perl script, remember that NCM treats $some_text$ as reserved variables. If you use '$' pairs in the script that are not NCM variables, ensure you separate them with a space.
Incorrect: my($host,$port,$user,$pass) = ('localhost','$tc_proxy_telnet_port$', '$tc_user_username$','$tc_user_password$');
Correct: my($host, $port, $user, $pass) = ('localhost','$tc_proxy_telnet_port$', '$tc_user_username$','$tc_user_password$');
Error when viewing results for diagnostics with single quotes in their name
Bug ID : QCCR1D95468
When creating a diagnostic with single quotes in its name, such as "Ana's Diagnostic", after running the diagnostic against a device, the diagnostic results are not displayed.
Workaround Do not use single quotes in diagnostic names.
Diagnostic Name Limit
Bug ID : QCCR1D96090
When naming a diagnostic, you are able to enter up to 100 characters. However, when running the diagnostics, the name is limited to 50 characters.
Workaround Limit diagnostic names to 50 or less characters.
Using SCP with devices in remote Realms
Bug ID : QCCR1D87003
Devices in remote Realms cannot use the Secure Copy (SCP) Transfer Protocol because in most cases, the remote Gateway Satellite Agent cannot use SSH/SCP port 22, since the Gateway OS is already using the port.
Workaround Disable SCP for devices in remote Realms.
Solaris and SecurID
Bug ID : QCCR1D86370
Configuring NCM to use SecurID as the authentication method can cause the management service to crash. The SecurID libraries provided by RSA are the source of the problem. Currently, the problem can occur on Solaris 10 with a version string of "SunOS 5.10 Generic_118833-22", while version "SunOS 5.10 Generic_120011-14" works fine. Please update your OS to at least this version if you are experiencing problems with SecurID on Solaris until this issue can be resolved.
Using SCP on Linux and Solaris
Bug ID : QCCR1D82379
The Secure Copy (SCP) Transfer Protocol enables you to securely transfer files between a local and remote host or between two remote hosts using the Secure Shell (SSH) protocol. When using SCP on a Linux platform, you will need to modify your system's SSH daemon (SSHD) to run on an alternate port and restart the SSHD service. Port 8022 is recommended.
Once the system's SSHD is reconfigured, you can restart NCM so that it can bind to Port 22. System administrators will need to 'ssh -p 8022 userNCMme@host' to login via the system's SSHD after the change is made.
Note Use 'ssh userNCMme@host' for a direct connection to the NCM proxy.
When logged-in to NCM, you can NCMvigate to the Device Access page (Admin ' Administrative Settings ' Device Access). Scroll down to the SSH Device Access field. Enter a SSH User and SSH Password. The device driver will use this information when copying files to the NCM server.
Note The device specific settings must be configured to eNCMble SCP and SSH to function properly. In addition, the device and the device driver must support SCP to use the NCM SSH server for SCP.
1 To use SCP with remote Realms, the SCP connection must be made back to the managing NCM server. A SCP connection to the NCM Gateway will not succeed because the NCM Gateway runs the Linux and Solaris system SSHD. The NCM Gateway sets the host to the NCM Gateway and not the managing NCM Core. This can be overridden by setting an access variable (TFTPServer) to the IP address of the managing NCM Core. Refer to the Satellite User Guide for CiscoWorksNetwork Compliance Manager for detailed information.
Bug ID : QCCR1D80180
The SSH protocol runs on port 22. Secure Copy (SCP) is a data transfer mechanism that uses the SSH protocol. By default, Linux and Solaris installs run on port 8022. Windows installs run on port 22. For Windows installs, if the port is switched to 8022, there could be connectivity issues. (Because most devices do not allow for the specification of an alternate port, this issue if uncommon.)
Note SCP will not work if the device is in a remote Realm and access to the device is managed via a NCM Satellite. You must run the NCM SSHD proxy on port 22. If you use port 8022 on any platform, SCP copies from a device to NCM will not work. Refer to the NCM Satellite Guide for information on configuring NCM Satellites.
Bug ID : QCCR1D86391
If you login to NCM as a limited access user and attempt to connect to a device via the proxy interface, the connection will be dropped at the username/password prompt.
Bug ID : QCCR1D75228
Using SNMP device discovery over networks with latency can cause SNMP timeouts. To resolve this issue:
1.Login to NCM.
2.On the menu bar under Admin, select Administrative Settings and click Device Access. The Administrative Settings - Device Access page opens.
3.Scroll down to the Detect Network Devices and Port Scan Task Settings section and set SNMP Timeout to a higher value, for example 2500 (milliseconds).
Bug ID : QCCR1D79600
When Workflow is enabled, attempting to run a CLI or API task with the -sync option will fail with a "No such directory' error.
Bug ID : QCCR1D61595
Any NCM user input cannot contain multiple dollar signs ($$). As a result, if the password you use to connect to the database contains multiple dollar signs, you must modify the password before installing NCM.
Bug ID : QCCR1D78975
The IPv4 address range 169.254.0.0/16 is reserved for link-local usage (referred to as APIPA: Automatic Private Internet Protocol Addressing, by Microsoft) and is not applicable addressing for a network application server such as NCM. For more information, refer to http://www.ietf.org/ (rfc 3330 and rfc3927).
Bug ID : QCCR1D78861
NCM 1.4 introduced a new set of keys for SSH communication. In releases earlier than NCM 1.4, NCM used one Digital Signature Algorithm (DSA) key for all installations. When you upgrade to NCM 1.4 or NCM 1.5, NCM creates two, new 1024 bit keys. The first key uses the DSA algorithm. The second key uses the RSA algorithm. These keys are used when you connect to NCM via SSH.
Custom Data Setup
Bug ID : QCCR1D77153
Custom data fields enable you to assign useful data to specific devices, configurations, users, and so on. This gives you added flexibility and enables you to integrate NCM with other applications.
To add custom data, on the menu bar under Admin click Custom Data Setup. The Custom Data Setup page opens. Custom data field can include alphanumerics and underscores. While you can use dashes, custom data field names with dashes cannot be used with tc_device_custom device variables in custom scripts.
Advanced ACL Scripts
Bug ID : QCCR1D74295
Selecting the "Update Script" button when specifying an advanced ACL script can lock-in values. As a result, running (or re-running) the script could result in variables not being updated properly.
Workaround Avoid using the "Update Script" button with advanced ACL scripts.
Use of Dollar Signs ($) in Scripts
Bug ID : QCCR1D69342
If generating a script from a Telnet/SSH session log, the script will fail or perform in unexpected ways if the session contains dollar signs ($) in the executed commands.
OS Analysis Task
Bug ID : QCCR1D67566
When using NCM in an environment with overlapping IP addresses, the OS Analysis task is not supported for devices behind remote Realm gateways. OS Analysis tasks run on devices in the locally reachable network. This could result in an image recommendation being incorrect for devices behind the gateway. Keep in mind that NCM will report OS recommendations for a device in the default Realm instead of a remote Realm if they share an IP address.
Email Report Task
Bug ID : QCCR1D69342
When scheduling an Email Report task, if you select a report other than Summary Reports in the "Reports to run" field, the task is reported as failed. However, the report is successfully emailed to the recipient. You can disregard the error message.
Bug ID : QCCR1D70552
When using template scripts (i.e., Batch insert line into ACL by handle), selecting the Run Again option will rerun the same script. Attempting to change fields will not change the script that is run.
NCM Core Gateways
Bug ID : QCCR1D68751
You cannot configure redundant NCM Core Gateways in the same NCM Realm as a single NCM Core.
Workaround Edit the adjustable_options.rcx file and add the other NCM Core Gateways' IP address(es):
Oracle database errors cause failed tasks and other issues
Bug ID : QCCR1D69094
Oracle database errors cause failed tasks and other issues due to a bug in the JDBC Oracle driver. As a result, it is possible for the driver to cause database errors-causing tasks to fail and other issues. The error message information is OALL8 is in an inconsistent state.
Workaround It is recommended that you update your version of Oracle Database Server.
Potential for task failure when using reserved NCM characters in device prompts
Bug ID : QCCR1D70102
There are eleven characters with special meanings to NCM:
•Opening square bracket ( [ )
•Opening round bracket and the closing round bracket ( ( ) ).
•Backslash ( \ )
•Caret ( ^ )
•Dollar sign ( $ )
•Period or dot ( . )
•Vertical bar or pipe symbol ( | )
•Question mark ( ? )
•Asterisk or star ( * )
•Plus sign ( + )
If you use these characters in a device prompt, null pointer exception errors could occur during task execution. As a result, the task will fail.
Workaround Avoid using these characters when naming devices that interact with NCM.
ACLs with the same name, but different case in NCM, is not recommended
Bug ID : QCCR1D61744
NCM supports case-sensitivity in ACL names. As a result, you can have two ACLs with the same name, but different case. If you delete one of those ACLs, however, all ACLs with the same name are deleted, regardless of the case. Cisco does not recommend multiple ACLs with the same name, but differing case in NCM.
Use of the dollar sign ($) in Perl code
Bug ID : QCCR1D61867
If you convert a Telnet/SSH Proxy session that contains a dollar sign ($) to Perl (such as a script that puts a $ in the banner), NCM does not properly escape the dollar sign ($) in the generated Perl code.
Workaround Edit the script and put a backslash (\) in front of the dollar sign ($).
Batch editing parent device groups or device groups
Bug ID : QCCR1D61742
When you batch edit devices in a parent device group or in a device group or partition that has no devices, an invalid error message is displayed: You do not have Modify Device Permission for any of the devices you selected.
Workaround To batch edit all devices in a parent device group, do a batch edit against each child group in the parent device group.
Downloading software images from Cisco.com
Bug ID : QCCR1D66891
You can download software images from Cisco.com for devices that are not currently in your NCM system. However, to be able to successfully deploy the software image, you may need to modify the driver and/or model information.
1.From the Devices menu, select Device Tools and click Software Images. The Software Images page opens.
2.In the Action column, click Edit for the software image you want modify. The Edit Software Image page opens.
3.In the Image Set Requirements field, modify the driver and/or model information to be compatible with the device in NCM.
4.Click the Save Software button.
Multimaster Distributed System: Importing Devices
Bug ID : QCCR1D59742
If you import two devices with identical IP addresses into two separate NCM Cores at approximately the same time, there is currently no way to detect the possibility of a duplicated device.
Workaround Manually run the Deduplication task after importing devices. One device will be automatically "de-duplicated" and set to "Inactive." (Refer to Chapter 7, "Scheduling Tasks," in the NCM User Guide for information on running the Deduplication task.)
Multimaster Distributed System on SQL Server
If you see a conflict entry for which the reason_text field does not reference a constraint name, it is possible that NCM automatically resolved the conflict. In which case, delete the conflict entry. If NCM did not resolve the conflict, make the appropriate corrections and then delete the conflict entry. The following is an example of a reason_text field from a conflict that does not reference a constraint name:
reason_text A row insert at 'red-dalmssql102.ds2880db2' could not be
propagated to 'RED-DALMSSQL101.ds2880db1'. This failure can be caused by a
constraint violation. The merge process was unable to synchronize the row.
Detect Network Devices Task
The NCM system prevents you from inadvertently running more than one Detect Network Devices task concurrently. Although the Detect Network Devices task generates only a minimal level of traffic, NCM provides this protection to help minimize additional traffic when running duplicate or additional Detect Network Devices tasks simultaneously.
If a second or third Detect Network Devices task is scheduled while an earlier Detect Network Devices task is running, NCM will place the new task(s) in the "Waiting" state. The task(s) will run individually after the first Detect Network Devices task has completed.
NCM applies an absolute value for the "text height" attribute for interface and port labels shown in Visio diagrams. When the Visio VDX file is loaded, Visio assigns an incorrect formula to the "text height" attribute. As a result, when you have more than two lines of annotated text (i.e. a label) for an interface or port and you attempt to copy & paste, the label of the new interface or port is displayed improperly and could hide the interface or port icon.
Workaround Click the "Text Tool" option on the Visio tool bar and move the label so as to expose the interface or port icon.
Multimaster Distributed System Performance
When running a Distributed System, if you are deleting many objects simultaneously, the system may take a while to push transactions for large delete operations.
Multimaster Distributed System External Authentication
When using external authentication in a Multimaster Distributed System environment, the External Authentication Type, for example TACACS+ or Active Directory, is global (i.e., shared between all NCM Cores). Specific authentication server information is NCM Core specific. QCCR1D53815
Workaround Set the External Authentication Type to "None" on the Administrative Settings ' User Authentication page. Configure each NCM Core individually with authentication server information or Active Directory setup. After all NCM Cores have been configured, set the External Authentication Type on any NCM Core. The External Authentication Type setting is replicated to all NCM Cores.
RADIUS External Authentication
Bug ID : QCCR1D9099
When setting up a user to authenticate using RADIUS, if the RADIUS server does not respond, NCM still authenticates the user against the NCM local password, even if you instruct NCM not to fail-over on external authentication.
Tasks: Running External Application tasks presents a possible security risk
Bug ID : QCCR1D14089
All Run External Application tasks run the application with root (UNIX) or system (Windows) privileges. This is a potential security risk that should be acknowledged by the System Administrator before using the Run External Application feature.
Scripts: Output results in HTML Format
Bug ID : QCCR1D21216
When executing an advanced script or a Run External Application task, any text that the advanced script or external application writes to 'stdout' is stored in NCM as the task result. Typically, this output is treated and displayed as plaintext. As a result, before NCM displays the task results, it will escape any characters that would affect the HTML rendering, for example converting < to <.
However, you may want to create an advanced script that outputs its results in HTML format. In this case, none of the output characters would be escaped, so the results displayed would include any applicable HTML formatting. To indicate to NCM that your script outputs HTML results, the first item that your script writes to 'stdout' must be <html>. If your script output begins with anything other than <html>, the script results will be treated as plaintext.
Bug ID : QCCR1D19036
Careful consideration should be taken when identifying the network range you are going to scan. Some network topologies can result in very long scans. In addition, it is recommended that you do not scan Internet addresses. If you think your Nmap scan will take more than a few minutes, you can use several Nmap options, for example --max_scan_delay <milliseconds>, setting <milliseconds> to a value between 1 and 1000. Nmap will throttle up to 1000ms max as packets are dropped.
Keep in mind that Nmap settings can be changed using the Administrative Settings option under Admin on the menu bar, and selecting the Device Access option. Please refer to the Nmap documentation at www.insecure.org for detailed Nmap information.
SecurID Software Token Software, Version 3.x
Bug ID : QCCR1D18988
If the NCM server is installed with the 3.x SecurID token software, turn off copy protection when exporting SecurID software token keys on the RSA server. Otherwise, NCM reports an error when accessing SecurID software tokens. A patched version of the SecurID software is available at RSA's website (http://www.rsasecurity.com).
Canceling or Deleting Tasks
Bug ID : QCCR1D16257
Some NCM tasks will spawn external processes to run PERL or Expect scripts, or to run user-provided executables or shell scripts. Under certain circumstances, NCM may not be able to kill these external processes when the spawning task is cancelled or deleted. This could include scripts that spawn sub-processes or processes that are coded to catch kill signals.
Workaround Manually stop the external process on the NCM server.
Tasks: A task scheduled for the 31st might run on the 1st
Bug ID : QCCR1D11142
If you schedule a monthly recurring task for the 31st of every month and that task runs during a month that contains fewer than 31 days, NCM will run the task on the 1st, 2nd, or 3rd day of the next month depending on how many days fewer than 31 the previous month contains. For example, if you schedule a task in February (with 28 days) for the 30th, the task will actually run on March 2nd. If you want to run the task on the last day of the month, you must set the date correctly.
Inventory: Data from device overwrites manually entered values
Bug ID : QCCR1D11942
Certain data on the Device Details page (and other pages) is auto-populated. If you manually change the data, NCM overwrites the values when the next snapshot occurs. .
The automatically populated data includes:
Console Server: SSH access is not supported
Bug ID : QCCR1D11402
NCM does not support console server access via SSH. If you use a console server to access a device, you must use the Telnet connectivity. In other words, on the New Device page/Edit Device page, if "Use to access device" is checked in the Console Server Information section, you should make sure that the "Telnet" option in the Connection Information section is also checked.
Sending reports to external email addresses
Bug ID : QCCR1D15982
Even though you may have properly configured NCM to contact your SMTP server, for network security reasons your SMTP server could have been configured to reject messages from the NCM server address. In this case, you would see the following error message, and any NCM messages would not be delivered.
Error occurred when sending email. Please check the email address and/or your SMTP server settings.
If this occurs, you will need to configure the SMTP server to enable the NCM server to relay email messages through it.
Non availability of Mail.jar
The mail.jar is not available in the directory /<NCM Directory>/server/ext/jboss/server/default/lib/
Workaround Before upgrading the version from NCM 1.x to NCM 1.8, copy mail.jar from /<NCM Directory>/server/ext/jboss/server/default/lib/ to another location. After the upgrade, copy the mail.jar back to the same location.
Accessing the CiscoWorks NCM Documentation Set
All or any part of the CiscoWorks NCM documentation set, including this document, might be upgraded over time. Therefore, we recommend that you access the CiscoWorks NCM documentation set using the following URL: http://www.cisco.com/en/US/products/ps6923/tsd_products_support_series_home.html
Tip To cut and paste a two-line URL into the address field of your browser, you must cut and paste each line separately to get the entire URL without a break.
Obtaining Documentation and Submitting a Service Request
For information on obtaining documentation, submitting a service request, and gathering additional information, see the monthly What's New in Cisco Product Documentation, which also lists all new and revised Cisco technical documentation, at:
Subscribe to the What's New in Cisco Product Documentation as a Really Simple Syndication (RSS) feed and set content to be delivered directly to your desktop using a reader application. The RSS feeds are a free service and Cisco currently supports RSS Version 2.0.
Open a service request online at:
View a list of Cisco worldwide contacts at:
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.
© 2012 Cisco Systems, Inc. All rights reserved.