Guest

CiscoWorks Network Compliance Manager

Release Notes for CiscoWorks Network Compliance Manager 1.8

  • Viewing Options

  • PDF (347.1 KB)
  • Feedback
Release Notes for CiscoWorks Network Compliance Manager 1.8

Table Of Contents

Release Notes for CiscoWorks Network Compliance Manager 1.8

Introduction

What's New in CiscoWorks NCM 1.8

What's Been Fixed in CiscoWorks NCM 1.8

Supported Platforms

Supported Databases

Additional CiscoWorks NCM Configurations

Virtual Environments

Performance Issues

Additional Required Applications

Hardware Requirements

Known Problems in CiscoWorks NCM 1.8

Accessing the CiscoWorks NCM Documentation Set

Obtaining Documentation and Submitting a Service Request


Release Notes for CiscoWorks Network Compliance Manager 1.8


Published: July 2012, OL-27498-01

These release notes are for CiscoWorks Network Compliance Manager (NCM) 1.8. It contains the following sections:

Introduction

What's New in CiscoWorks NCM 1.8

What's Been Fixed in CiscoWorks NCM 1.8

Supported Platforms

Supported Databases

Additional CiscoWorks NCM Configurations

Virtual Environments

Additional Required Applications

Hardware Requirements

Known Problems in CiscoWorks NCM 1.8

Accessing the CiscoWorks NCM Documentation Set

Obtaining Documentation and Submitting a Service Request


Note The Docs tab provided in the CiscoWorks NCM user interface might not include links to the latest documents. Therefore, we recommend that you access the CiscoWorks NCM documentation set using the following URL: http://www.cisco.com/en/US/products/ps6923/tsd_products_support_series_home.html


Introduction

CiscoWorks NCM tracks and regulates configuration and software changes in a multivendor network environment. It provides visibility into network changes and tracks compliance with a broad variety of regulatory, IT, corporate governance, and technology requirements. CiscoWorks NCM helps IT staff identify and correct trends that could lead to problems, such as network instability and service interruption.

What's New in CiscoWorks NCM 1.8

CiscoWorks NCM 1.8 includes the following features:

HP NNMi-Cisco NCM Integration improvements:

The integration now supports SSL connections between NCM and NNMi.

The NNMi nodes, interfaces, and incidents forms include new tabs containing NCM data (current device configuration, configuration history, and interface configuration) in the analysis pane.

For information on the HP NNMi-Cisco NCM integration, see the HP NNM Integration User Guide for CiscoWorks Network Compliance Manager.

Import user data - You can now import user and user group definitions from CSV files.

Import device data improvements - You can now import custom attributes for devices and device groups from CSV files.

Task completion notification - You can now configure tasks to send email messages upon completion.

Support for Oracle RAC.

Improved searching:

Case-insensitive search for most fields with Oracle databases. (Microsoft® SQL Server and MySQL database searches are case-insensitive by default.)

Faster search for device configurations using the "contains (full text)" operator.

Improved database pruning gradually reduces the size of the NCM database.

Updated PCI (formerly Visa CISP) compliance report.

Performance improvements, including reduced data storage

New deployment architecture for disaster recovery using Oracle GoldenGate.

Driver improvements:

Support for additional virtual devices

Additional IPv6 support

PERL API support for JavaScript drivers

SFTP client support

Ability to enforce the saving of configurations on a per-task basis

Support for directory structures for the filesystem diagnostic and Software Center

DSD_Feature_Index.html, a list of all drivers with each driver's feature matrix and a link to each driver's individual DSD

DSD_SYSOID_Mapping_Index.html, a master list of all supported / tested sysOIDs by driver package / driver name / driver description


What's Been Fixed in CiscoWorks NCM 1.8

Table 1 describes the issues fixed in CiscoWorks NCM 1.8.

Table 1 Issues Fixed in CiscoWorks NCM 1.8

Bug Id
Bug Summary

QCCR1B100260

License server does not start on Windows Server 2008 64-Bit

QCCR1B102294

Document a procedure to migrate NCM to 64-bit from 32-bit platform

QCCR1B85695

Do not require Adobe Flash to use the user interface

QCCR1B86526

SSH exception/disconnection occurs while handling more prompts during new CLI discovery

QCCR1B86581

Per task credentials shouldn't be editable by other users

QCCR1B86915

"System hangs and becomes non-responsive, requires restart to restore service - Dynamic device group calculation problem multiple dynamic group threads (stability)"

QCCR1B87510

Replication issue between cores (scheduler)

QCCR1B88380

Optional-binary snapshots are always stored even when the configuration is unchanged

QCCR1B89790

SSH Proxy connection should not be interrupted when special characters - üäöÜÄÖ are typed

QCCR1B92556

Unable to run database upgrade script

QCCR1B93239

Logged On Users does not list any users at all

QCCR1B93977

Password and Enable Password not saved if using newer versions of Firefox

QCCR1B97130

NCM Diagram Failure

QCCR1B98846

Cisco Catalyst 2960 - NCM reloads device with running configuration instead of startup

QCCR1D100383

Viewing sub tasks of a Multi-task job deletes the Multi-task

QCCR1D108962

Port usage documentation is out of date

QCCR1D112649

JavaScript driver (NDS) allows the customer to capture extremely large configurations

QCCR1D115410

Cannot increase ssh connection/socket timeouts with Cisco GSS driver

QCCR1D116089

Context Devices cannot be edited / no IP address assigned

QCCR1D19252

Cisco NCM SCP Client doesn't work with NetScreen devices

QCCR1D86144

OutofMemoryError on Recent Tasks (all) page (scheduler)

QCCR1D87086

Clarify LDAP integration for Multidomain AD environments

QCCR1D93101

NCM keeping session open when interrogating the configuration on Cisco 7600's

QCCR1D95654

Command Scripts (line by line) fails to execute Write Mem

QCCR1D99616

com.mysql.jdbc.PacketTooBigException

QCCR1D115581

Policy non-compliance email messages should highlight the violations

QCCR1D118702

Out-of-memory errors

QCCR1B85988

Satellite monitor fails with com/rendition/service/UserManager error

QCCR1B86526

SSH exception/disconnection occurs while handling more prompts during new CLI discovery

QCCR1B89606

Import Diagnostics, Policies & Command Scripts issue

QCCR1B91014

Creating a group with the same name as a partition name causes exceptions

QCCR1B91254

List of command scripts does not include site information

QCCR1B91466

Limit of custom data field extensions not stated correctly in the product help

QCCR1B91615

Group list performance is poor with more than 500 groups

QCCR1B91670

Creating a 'New Event Notification & Response Rule' does not save the subsystem information

QCCR1B92142

Policy based on dynamic criteria creates database problem

QCCR1B92189

Running a show command changes the device configuration

QCCR1B92302

Telnet client converts CR to CR+LF

QCCR1B92803

Authentication failover description in help is incorrect

QCCR1B93054

Device template issue: the initial configuration is not readable

QCCR1B93055

html tags displayed in Recent/Running/Scheduled comments field

QCCR1B93263

Enabling NCM 1.8 cross site scripting feature affects policy related user's report

QCCR1B93365

NCM slow to execute scheduled child tasks from parent tasks

QCCR1B93619

Search results missing comments field

QCCR1B93677

Export/Import of command scripts truncates trailing whitespace which causes errors

QCCR1B93688

Data on user pages not aligned correctly

QCCR1B93864

Do not require Adobe Flash to use the user interface (includes QCCR1B92318)

QCCR1B93965

User ID Mismatched When Performing Device Configuration Comparisons

QCCR1B94031

Device access error in batch snapshot task but not in individual snapshot task

QCCR1B94116

CSV of compliance report displays policy compliance instead of the rule compliance

QCCR1B94258

Device Groups page takes a long time to load

QCCR1B94263

Tasks scheduled through a CSV file do not retain their configuration

QCCR1B94363

Oracle queries cannot process a large number of partitions

QCCR1B94371

Running diagnostic on Cisco firewalls yields many failures

QCCR1B94377

No device discovery hints sent from NCM to NNMi for existing NCM devices

QCCR1B94492

Software level violations not showing in Best Practices report

QCCR1B94740

Provide a way to resize the proxy window

QCCR1B94963

Data Pruning task fails

QCCR1B95133

Inconsistency between API commands and WSDL commands: missing input parameters: deviceid

QCCR1B95184

Displayed search results for MAC address differ from 'save as csv' results

QCCR1B95297

Custom Actions Task Failed: Could not update device status for device xyz java.lang.NumberFormatException: multiple points

QCCR1B95400

Java cannot find toolbar.png file

QCCR1B95510

NCM Proxy SSH session should not break when extended ASCII or multi-byte characters are typed in the terminal

QCCR1B95629

SSH proxy no longer connects automatically to devices

QCCR1B96014

User with read-only permissions does not see policies and policy rules

QCCR1B96067

Diagnostic task clears user attribution from Change Event Data

QCCR1D72393

Provide pruning option for the RN_DEVICE_AUTH records

QCCR1D103055

NPE when running a multi-task project on IOS devices

QCCR1D111687

Device type LoadBalancer instead of Load Balancer

QCCR1D117839

"list device" API call does not return value for driverName

QCCR1D118479

Support parsing of ACS 5.x logs by NCM Syslog server

QCCR1D118677

Removing an old diagnostic script should delete all related information

QCCR1D119364

Link to device in "My Favorites" is not deleted after deleting device

QCCR1D120576

Task page displays " " in the Comments field

QCCR1D121719

Module information not deleted after diagnostic history erased

QCCR1B85677

Policy rule exceptions are not applied to software policy rules

QCCR1B85901

"list image" command needs site specified, even if NCM only has a single site

QCCR1B86082

Device IP addresses not updated after primary IP address change

QCCR1B86233

Policy tag feature not working properly for Full Access users

QCCR1B86996

Java API connect problems with multiple threads

QCCR1B87303

Garbage collection errors when running flows against NCM

QCCR1B87505

Dynamic device group calculation problem: system becomes non-responsive, requires restart to restore service; addresses the issue of multiple threads calculating dynamic groups simultaneously

QCCR1B87506

Scripts cause a Null Pointer Exception when run in a group but not when run individually

QCCR1B87821

Test policy can fail for rule condition "must not contain"

QCCR1B88152

"list device" API call shows vendor name as status

QCCR1B88313

Update SWIM library

QCCR1B88573

View > Device > Single view page times out

QCCR1B88621

Attempt to communicate outside the time window smStatsNotInTimeWindows error) on Diagnostic Task Detect Device Boot

QCCR1B88738

Virtual Context Firewalls not available as a type in reports and groups

QCCR1B88966

Resolve FQDN Task changes hostname to Primary IP, even though the task fails

QCCR1B89270

Diagnostics page loads slowly

QCCR1B89430

Creating a device group with the result from a search takes 15 seconds

QCCR1B89555

API/CLI: useaaaloginforproxy says (yes|no) but works only for (1|0)

QCCR1B89789

SSH proxy connection should not be interrupted when special characters are typed

QCCR1B89842

Provide an option to force a save of the latest diagnostic

QCCR1B89861

Problems with advanced scripting on Windows Server 2008; problems with cross-launch to NCM diagnostic results

QCCR1B90071

Syslog change detection does not behave as expected

QCCR1B90248

Cisco NNMi-Cisco NCM integration: SNMP community string propagation fails

QCCR1B90513

Import/Export Scripts or Diagnostics link is enabled on Scripts or Diagnostics page for a user with no privileges

QCCR1B90518

Cisco NNMi-CiscoCisco NCM integration: Device deleted in NCM is not deleted in NNMi

QCCR1B90566

Edit Device Page--NAT Interface; TFTP Server IP Address not being used when taking a snapshot from a device on the other side of a firewall

QCCR1B90815

On the Start/Stop Services page, mousing over a link changes the link color to red, not black

QCCR1B90905

Same day diagnostic data not pruned cleanly

QCCR1B91001

SyslogReader java.rmi.ServerException error; support parsing of ACS 5.x logs by NCM Syslog server

QCCR1B91193

Device policy edit/view screen displays only 25 rules

QCCR1B91247

Module diagnostics fail when the Module Description is longer than 128 characters


Supported Platforms

Table 2 shows the supported platforms for CiscoWorks NCM 1.8.

Table 2 Supported Platforms for CiscoWorks NCM 1.8

Operating System
NCM Application Supported Versions
NCM Satellite Supported Versions
Windows Server 2008:
 

x64 Datacenter Edition, SP2

X
None
 

R2 x64 Datacenter Edition, SP1

X
 

x64 Enterprise Edition, SP2

X
 

R2 x64 Enterprise Edition, SP1

X
 

x64 Standard Edition, SP2

X
 

R2 x64 Standard Edition, SP1

X
 

Note: RSA device authentication is not yet available on Windows Server 2008. If you run NCM on a Windows operating system require RSA device authentication, you cannot install or upgrade to NCM 1.8 at this time.

Linux:
 

Red Hat Enterprise Linux Server AS 4.0 or later minor version

 
X
 

Red Hat Enterprise Linux Server 5.4 or later minor version through 5.6

X
X
 

Red Hat Enterprise Linux Server 6.0 or later minor version

X
 
 

SUSE Linux Enterprise Server 9

 
X
 

SUSE Linux Enterprise Server 11 SP1

X
 
 
Tip: Red Hat does not support direct upgrades from Red Hat Enterprise Linux Server 5.x to 6.0.
Solaris:
 

Oracle Solaris 10 SPARC

X
X
 
Note:
· Before installing NCM on a Solaris platform, reconfigure the Syslog server to not listen for remote Syslog messages.
· NCM on a Solaris system requires a large amount of swap space because of the way the fork() system call works. For example, forking a 24 GB process allocates 24 GB in the swap file, which guarantees space to swap out the new process if necessary. If the 24 GB is not available in swap, the fork() system call fails.

The following operating systems are no longer supported:

Windows 2000

Solaris 9

Red Hat AS3

SuSE 9


Note For all operating system upgrades, please see the respective vendor documentation or contact your system support personnel. Cisco is not responsible for issues that might arise during third-party product upgrades.


Supported Databases

Table 3 shows the databases that are supported by CiscoWorks NCM 1.8.

Table 3 Supported Databases for CiscoWorks NCM 1.8

Database
Notes

Oracle 10g (10.2.0.2 and 10.2.0.4) Standard and Enterprise Edition

64-bit Oracle is supported. If you are running CiscoWorks NCM 1.8 in a Distributed System environment, you will need Oracle 10g or 11gR1 Enterprise Edition.

Oracle 11g (11.1.0.7.0) Standard and Enterprise Edition

64-bit Oracle is supported. If you are running CiscoWorks NCM 1.8 in a Distributed System environment, you will need Oracle 10g or 11gR1 Enterprise Edition.

Microsoft SQL Server 2005 and 2008 Standard and Enterprise Edition

64-bit Microsoft SQL Server is supported. High Availability Distributed System on Microsoft SQL Server requires SQL Server 2005 Service Pack 2 (Standard Edition or Enterprise Edition) or SQL Server 2008 (Standard Edition or Enterprise Edition).

MySQL 5.0.58

MySQL 5.0.58 ships with CiscoWorks NCM 1.8.


Except for modest deployments without full enterprise scale and performance requirements, the application server and database server should be on separate physical machines. In addition, the database server should be dedicated to CiscoWorks NCM, rather than serving multiple applications.


Note CiscoWorks NCM 1.8 does not support the use of Microsoft SQL Named Instances.


The following databases are no longer supported:

Oracle 9i and Oracle 9.2

Microsoft SQL Server 2000

MySQL 3


Note For all database upgrades, please see the respective vendor documentation or contact your database analyst. Cisco is not responsible for issues that might arise during third-party product upgrades.


Additional CiscoWorks NCM Configurations

If you have configured a High Availability Distributed System, the database requirements for Oracle and Microsoft SQL Server include:

If you have configured a Horizontal Scalability environment, the database requirements for Oracle and Microsoft SQL Server include:

Database
Restrictions

Oracle 10g Standard or Enterprise Edition (10.2.0.2 and 10.2.0.4)

No more than five CiscoWorks NCM application servers can be configured together with a single database.

Oracle 11g Standard or Enterprise Edition (11.1.0.7.0)

No more than five CiscoWorks NCM Cores can be configured together with a single database.

Microsoft SQL Server Standard and Enterprise Edition 2005 (SP2 or higher) and 2008

No more than five CiscoWorks NCM application servers can be configured together with a single database.


See High Availability Distributed System Configuration Guide for CiscoWorks Network Compliance Manager for information on configuring High Availability Distributed System environment.

See Horizontal Scalability User Guide for CiscoWorks Network Compliance Manager for information on configuring Horizontal Scalability environment.


Note High Availability and Horizontal Scalability environments are not supported for MySQL.


Virtual Environments

Table 4 lists the virtual servers NCM supports.

Table 4 NCM-Supported Virtual Servers 

Virtual Server
Supported Operating System Types
Notes

VMware:

ESX Server 3.5

ESX 4.0 or later minor version

ESXi 4.1 or later minor version

ESXi 5.0 or later minor version

Host OS:

— Windows
— Linux

Guest OS: Any of the operating systems listed in Table 2

The virtual environment must meet the x86-64 or AMD64 hardware requirements listed in Table 5.

Microsoft® Hyper-V R2

· Host OS: Windows Server 2008 R2 x64
· Guest OS: Any of the Windows operating systems listed in Table 2
 

Oracle Solaris Zones

Oracle Solaris
 

If you are running NCM in a virtual environment, review the follow guidelines:

Because NCM can be network intensive, many virtual machines sharing a virtual switch and network interface card could result in unexpected behavior, including time-outs and failed tasks.

Each virtual environment is different and could function differently under loads with shared VM guests.

On a virtual server, it is recommended that the Disk I/O be split. The virtual server must have two arrays:

One array for the host operating system

One array for the virtual machines

Live migration (for example, using Vmotion) of the NCM application server is not recommended.

If you plan to use virtual machines for both the NCM application and the NCM database, ensure that they are running on different guests. It is recommended to host the database virtual machine on a different array to avoid conflicting I/O on the array. Verify that the database is supported in a virtual environment.

When configuring NCM on virtual machines in a Multimaster Distributed System environment or a Horizontal Scalability environment, the maximum number of NCM application servers is two.

Some virtual guests time drift, which can be an issue and should be corrected. Synchronizing the guests to an external time source can solve this issue.

Each NCM guest system must be configured with a set reservation for CPU and memory. These reservations should be at least 125% of the standalone server requirements listed in Table 5 and Table 6. Ensure that the resource pool containing the NCM guest system has adequate resources to consistently deliver the CPU and memory reservations to the NCM guest system.

Performance Issues

To counter performance issues while running NCM in a virtual environment, do the following:

Increase hardware resources on the physical host.

Ensure resources are dedicated to the NCM application server guest.

Decrease the number of guests running simultaneously.

Add a network interface card dedicated to NCM to the virtual server.

A large number of concurrent tasks increases NCM resource demand. If performance issues arise, reduce the number of concurrent tasks or provide more resources to the NCM virtual server. (This suggestion also applies to physical servers.)

Additional Required Applications

You need to install the following applications:

CiscoWorks NCM supports the following browsers:

Mozilla Firefox 3.x and higher

Internet Explorer 7.x and higher


Note Windows pop-up blockers must be disabled for the browser. Cookies must be enabled for the browser.


Microsoft Excel 2000 or higher, if you are viewing Summary Reports from the CiscoWorks NCM server.

Adobe® Acrobat Reader™ version 4.0 or higher if you are viewing CiscoWorks NCM documentation from the CiscoWorks NCM server.

ActivePerl 5.8.x (for Windows).

Perl 5.8.x (for Solaris and Linux). The CiscoWorks NCM Convert-to-Perl script feature uses Perl.

Perl Net::SSH::Expect module (for using the Connect module with SSH)


Note Third-party products mentioned in this documentation are manufactured by vendors independent of Cisco. Cisco makes no warranty, implied or otherwise, regarding the performance or reliability of these products.


Hardware Requirements

CiscoWorks NCM requires the following minimum hardware:

Table 5 Application Server Requirements

Application Server

CPU

Intel 64-bit (x86-64), AMD 64-bit (AMD64), 3.0+ GHz (Windows, Linux), Minimum of 2.5GHz, 1 physical CPU with 6 cores and 12 logical processors with hyper-threading

Oracle SPARC64 VI or later (M-Series), Oracle SPARC T4 or later (T-Series) (Oracle Solaris), Minimum of 2.5GHz, 1 physical CPU with 6 cores and 12 virtual processors

Memory

16 GB RAM

Swap Space

16 GB

Disk

40 GB, Fast SCSI

Network

100 Mbps Fast Ethernet, full duplex


Table 6 Database Server Requirements

Database Server

CPU

Intel Xeon or equivalent, 3.0+ GHz

Memory

16 GB RAM

Swap Space

16 GB

Disk

512 GB, Fast SCSI

Network

100 Mbps Fast Ethernet, full duplex


Known Problems in CiscoWorks NCM 1.8

This section contains information about the limitations and problems known to exist in CiscoWorks NCM 1.8

HP NNMi-CISCO NCM integration in the NNMi console

Bug ID : QCCR1B102485

The HP NNMi-CISCO NCM integration must be enabled and disabled in the NNMi console.The Enabled/Disabled control on the 3rd Party Integrations page controls communication from NCM to NNMi only. It does not fully control the CISCO NNMi-CISCO NCM integration.

Workaround   Enable and disable the HP NNMi-CISCO NCM integration on the HP NNMi-CISCO NCM Integration Configuration form in the NNMi console.

Write memory command not included in the session log

Bug ID : QCCR1B102502

If you select both of the "Force Save" and "Session Log" options on any device task page, you can expect to see the command used to save the running configuration to startup configuration in the task session log. For instance, for a Cisco device you can usually see the command "write memory" being sent to device in the session log. For certain tasks, you might not see the saving configuration command in the session log, notably the Run Diagnostic task. The command is sent to device but not logged.

Workaround   To confirm that the command was sent, check the jboss_wrapper log.

HP NNMi-CISCO NCM integration: some NCM interface configurations are not available in NNMi

Bug ID : QCCR1B102518

Some NCM interface configurations are available in the NCM console but not in the NNMi console. For information about how NNMi interfaces are mapped to NCM ports, see the HP NNM Integration User Guide for CiscoWorks Network Compliance Manager.

Full-text search returns incorrect results for searches including hyphens

Bug ID : QCCR1B102520

Full-text search queries that contain a hyphen (-) might return more results than expected.

Failure while enabling case-insensitive search (Oracle)

Bug ID : QCCR1B102927

The mod oraclecaseinsensitive -option enable command sometimes returns an error message: GEN_FAILURE: Failed to modify database. In this case, case-insensitive search has not been enabled. Wait for few minutes, and then rerun the mod oraclecaseinsensitive -option enable command.

Autopass license overrides legacy license

Bug ID : QCCR1B95407

Introducing an CISCO Autopass license key prevents NCM from using a legacy license key. This issue affects customers who upgrade to NCM 1.8. It can take two forms:

A fresh installation of NCM 1.8 that activates the Instant-On license during installation. In this case, the product runs fine until the Instant-On license expires. Upon expiration of the Instant-On license, NCM does not recognize the legacy license, so NCM is not usable.

Application of an additional capacity Autopass license to an NCM 1.8 system that was upgraded in place from a previous version of NCM and is still using a legacy license. In this case, NCM recognizes only the newly added capacity.

Workaround   In either case, the solution is to remove the Autopass license key as follows:

1.Locate the Autopass license file:

Windows: <NCM_HOME>\autopass\license\lickeys.dat

UNIX: <NCM_HOME>/autopass/license/lickeys.dat

2.In a text editor, delete the contents of the lickeys.dat file, and then save the empty file.

3.Verify that an appropriate legacy NCM license (license.dat file) exists in the NCM root directory.

4.If an additional capacity Autopass license caused the issue, contact your Cisco Sales Representative to request a legacy format license key for the additional capacity, and then apply that key.

5.Restart the NCM management engine.

NCM now runs with the legacy license from the license.dat file.

Enabling cross-site scripting checks causes garbled characters in NCM 1.8 on SJK systems

Bug ID : QCCR1B91853

On a non-English system, when the "Cross site scripting check" check box is selected on the Admin > Administrative Settings > User Interface page, user-entered values, such as group, policy, and policy rule names, might include garbage characters.

Incorrect SNMPv3 Configuration Prevents Correct Device Detection

Bug ID : QCCR1B86730

For a device whose NCM configuration includes SNMPv3 settings, NCM first tries to communicate with the device using SNMPv3. NCM then tries the SNMPv1 or SNMPv2c settings. If the SNMPv3 settings are incorrect, NCM does not recognize that the SNMPv3 connection failed and detects the device as a non-active node or an unrecognized host. Therefore, NCM does not attempt SNMPv1 or SNMPv2c communication with the device.

Workaround   Correct the SNMPv3 settings or remove the SNMPv3 configuration so NCM uses only SNMPv1 or SNMPv2.

Using SNMPv3 with Privacy and AES192 and AES256 Encryption

Bug ID : QCCR1D88942

Several tasks, including Detect Network Devices and Discover Driver, do not correctly use SNMPv3 with the AES192 or AES256 encryption privacy protocol.

Workaround   Use a different encryption method, such as AES128.

SNMP Timeout Value Might Be Too Short for SNMPv3 Communications

Bug ID : QCCR1B87867

If you encounter frequent timeouts during communications with SNMPv3 devices, increase the value of the SNMP Timeout setting on the Device Access tab of the Administrative Settings page.

Telnet and SSH Sessions (IPv6 devices)

Bug ID : QCCR1B87641

NCM does not cache telnet or SSH sessions to IPv6 devices. Therefore, these histories are not available from the device information page.

Alternate Driver Discovery (IPv6 devices)

Bug ID : QCCR1B87801

Alternate driver discovery incorrectly interprets the first colon (:) of an IPv6 address as indicating a port on the device.

Users Without Permissions to All Partitions Might Not Be Able to Compare Device Configurations

Bug ID : QCCR1D94263

Users with access to some, but not all, partitions do not see the options for comparing devices on the Configuration Changes tab of the Devices page.

Custom Diagnostics

Bug ID : QCCR1B86671

NCM enables you to define custom diagnostics to capture specific information that is useful in your environment. If the name of a custom diagnostic is longer than 80 characters, the Device Diagnostic page shows the content of the most recent diagnostic. However, the Diagnostics History table at the bottom of the page does not appear due to a rendering error.

Polices Page

Bug ID : QCCR1D86308

Users with Admin permissions can view the full list of policies on the Policies page and segment polices into separate policy tags. However, users with Full Access permissions cannot filter policies based on policy tags when there is more than one site partition.

NCM-NNMi Integration (IPv6 devices)

Bug ID : QCCR1B86228

NCM-NNMi integration does not support synchronizing IPv6 devices. Only IPv4 devices are supported.

Using the mod authentication command

Bug ID : QCCR1D116666

When there are no device specific authentication records to modify for a device the mod authentication command reports the following error:

GEN_FAILURE : The Device Password Information for Device you requested can not be found. It may have been deleted.

Workaround   You can use the add authentication command to create a new entry.

Network Diagrams

Bug ID : QCCR1D113667

Network diagrams can be viewed in either Visio, static JPEG, or interactive JPEG format. When installing NCM 1.8 on Windows Server 2008, JPEG formatted network diagrams do not contain icons.

Memory Allocation Error

Bug ID : QCCR1D114717

If you have installed NCM on a Linux platform, you might see the following error in the log messages or within the results of failed NCM tasks:

Caused by: java.io.IOException: error=12, Cannot allocate memory


Note This error occurs when the JVM (Java process) attempts to run an external shell script, such as a custom action or memory monitor. To run the external shell script, the system must fork its process--a mechanism that requires the parent process to copy itself for the child process. Making a copy of the parent process could send a request to the system kernel for more memory than the system can allocate. (Note that this can occur on either a 64-bit or 32-bit server.)


Workaround   : As root, run the following command at the root shell prompt:

echo 1> /proc/sys/vm/overcommit_memory

Using API calls to move sites and tasks

Bug ID : QCCR1D112938

Currently, NCM 1.8 does not support failover scripts when a NCM Core goes down in a Distributed System or Horizontal Scalability environment.

Workaround   : NCM provides API calls for moving sites and tasks from a down NCM Core to an up NCM Core.


Note : (Be sure to move the sites before you move the tasks.)


Uninstalling NCM

Bug ID : QCCR1B103211

If the current NCM is 64-bit and was upgraded from 32-bit NCM, the NCM uninstaller does not work.

Workaround   If you upgrade a 32-bit NCM platform to a 64-bit NCM platform, check the NCM install directory. If there is a directory named "jre_old", do the following before uninstalling NCM:

1.Stop NCM services (this includes TFTP, Syslog, SWIM, and FTP).

2.Rename <NCM install dir>/jre.

3.Rename <NCM install dir>/jre_old to <NCM install dir>/jre.

4.Run the NCM uninstaller.

FTP Service (Starting)

Bug ID : QCCRID114411

If you restart NCM through the CLI on a Linux or Solaris platform, the FTP service will not start. You must start the FTP service via the NCM Web UI after the NCM has been started.


Note There are cases where FTP configuration is changed and the FTP service needs a restart to reflect the changes. In this case, you must do this via the NCM Web UI.


FTP Accounts

Bug ID : QCCR1D112098

The NCMUserManager class utilizes a configuration option to identify the username and password of the authorized FTP account. There is only one FTP account at this time. If the NCM administrator changes the configuration value in NCM, the FTP server will not be aware of the change until it has been restarted because the FTP server does not reload configuration options before performing a user check.

Workaround   The FTP server runs as a separate process outside of NCM and is not notified when changes to the .rcx files are made. Restart the FTP server if the FTP account username or password is changed.

CLI driver discovery via Bastion Host does not work for some devices

Bug ID : QCCR1D105486

When configuring a device to use a Bastion Host server with SSH, the Discover Driver task fails with the following error message: This task did not complete

In addition, the Session Log is not stored for the failed task.

Workaround   Discover the driver without the Bastion Host or manually assign the driver.

Oracle Database Log Files

Bug ID : QCCR1D1114453

Oracle database users could encounter the following error in their log files, associated with a failed query:

java.sql.SQLException: ORA-00600: internal error code, arguments: [kglhdgn_1], [0xA000000], [0], [2], [], [], [], []

This is an Oracle internal error, normally handled by the DBA and Oracle Support. The error is shown below:

ORA-00600 internal error code, arguments: [string], [string], [string], [string], [string], [string], [string], [string]

This is the generic internal error number for Oracle program exceptions. It indicates that a process has encountered a low-level, unexpected condition. Causes of this message include:

Timeouts

File corruption

Failed data checks in memory

Hardware, memory, or I/O errors

Incorrectly restored files

The first argument is the internal message number. Other arguments are various numbers, names, and character strings. The numbers may change meanings between different versions of Oracle.

Workaround   Report this error to your DBA or Oracle Support Services.

VLAN Searches

Bug ID : QCCR1D102754

VLAN searches saved in NCM 1.4 or earlier are not valid in NCM 1.8 because of VLAN features added in NCM 1.5.01. If you attempt to view a saved VLAN search, you could see the following error message:

Error executing query VLAN: PortInVlanName is not a valid field name for this query.

Workaround   Remove and re-create the VLAN search.

Uploading Large Image Files

Bug ID : QCCR1D99027

Currently, NCM is limited to uploading device configurations no greater than 1GB.

Provision Device Task

Bug ID : QCCR1D102620

Although the Provision Device task enables you to select more than one device, the task only works with one device (or when using a .csv file for multiple devices). Attempting to select more than one device, or a device group, using the Device Selector will cause an error.

Canceling Tasks

Bug ID : QCCR1D101509

If you cancel a task that is currently communicating with a device, NCM could mark subsequent attempts to run the task (or similar tasks) as "skipped". This could happen even if communication between the task and the device seem to be hung and you are waiting for a timeout.

This issue can occur because NCM is looking for a clean opportunity to end communication between the task and the device before actually canceling the task. As a result, NCM will continue to execute the task until that point is reached. Any attempt to rerun the task before it is canceled will appear to NCM as if the task is already in progress. As a result, NCM will mark the new task as "skipped". You must give NCM ample time to finish with the canceled task. Once that has occurred, NCM will be able to rerun the task.

Using the $tc_device_enable_password$ variable in command scripts

Bug ID : QCCR1D100314

When using the $tc_device_enable_password$ variable in a command script, if the device enable password contains an at sign (@) character, the @ character will be preceded by a backslash (\) character.

Device Managed IP Addresses Page

Bug ID : QCCR1D101755

When making changes to the Device Managed IP Address, because NCM attempts to remember a connection path, the change might not take effect.

Workaround   On the Device Managed IP Addresses page, click the "Reset last used IP" link.

Setting Parent Task Priority

Bug ID : QCCR1D98393

When changing a parent task's priority that is currently running, any existing child tasks that are in the "Pending" or "Waiting" state will appropriately change their priority to that of the parent task. However, child tasks that have not been created yet or are in another state, such as "Running" or "Paused" will retain the parent task's original priority. If a parent task is not running and its priority is changed, all of the parent task's child tasks take on the new priority.

Testing OpenLDAP User Authentication

Bug ID : QCCR1D99664

When configuring NCM to use OpenLDAP for NCM user authentication, save the configuration before using the test function to verify the settings.

Using LDAP Servers

Bug ID : QCCR1D99663

If you are using a LDAP server for external user authentication, you might need to modify certain LDAP related options in the appserver.rcx file. The default settings will work with the Active Directory server under most situations. However, for other types LDAP servers (depending on the LDAP schema configurations), you might need to customize the following settings if you are experiencing issues with the default settings:

<!-- Attribute mapping for Generic LDAP server-->

<option NCMme="ldap_server/attr_mapping/Generic/group_search">group,organizatioNCMlunit, container,groupOfUniqueNCMmes</option>

<option NCMme="ldap_server/attr_mapping/Generic/group_NCMme">NCMme,cn,commonNCMme</option>

<option NCMme="ldap_server/attr_mapping/Generic/member_search">member,uniqueMember </option>

<option NCMme="ldap_server/attr_mapping/Generic/userNCMme_search">samAccountNCMme,uid,cn </option>

Ignore the following settings. They are not used at this time.

<!-- Attribute mapping for SunLDAP server-->

<!-- Attribute mapping for OpenLDAP server-->

The "group_search" option specifies the list of LDAP entries to search for in the LDAP groups.

This information is used in Step 3 of the LDAP Setup Wizard, where you define the LDAP groups to specify the members are allowed to login to NCM.

Consult with your organization's LDAP Administrator to ensure that the list contains all necessary group attributes. For example, it might be necessary to add "groupOfName" to the list for the LDAP group search to work.

The same concept applies to "username_search" and "member_search". Both of these are used during the NCM login process to positively identify the user and to determine the user's group memberships. If the default LDAP attribute names do not match your LDAP schema configuration, change them accordingly.

The "group_name" option specifies the attribute names that usually contain the group name. If the attribute name for the LDAP group is not "name", "cn", and "commonName", you must modify them accordingly. You rarely need to change this option, however.

After you make the appropriate changes, save the appserver.rcx file and restart the NCM server.

Device Relationships

Bug ID : QCCR1D100298

Scripting to a vSwitch is done via direct API calls to the containing ESX server. As a result, there is no way to prevent scripts from modifying ESX server settings outside those that pertain to the vSwitch.

This is true even in cases where MSP permissions are being granted to the vSwitch, but not the containing ESX server.

Including URLs in Policies

Bug ID : QCCR1D98621

When creating a policy and including a vendor solution URL and/or a vendor advisory URL, the URL must start with the "http://" prefix, otherwise the link might not be correctly interpreted by the browser.


Note Note that if the URL field is left blank, when selected, the link could open the NCM Home page.


Running NCM on a Solaris Platform

Bug ID : QCCR1D99873

When starting the NCM server on a Solaris platform, there is a remote chance that the NCM server will crash due to an error in the native frame_sparc.cpp file. This is due to a bug in the Solaris JVM Biased Locking feature.

Workaround   Add the following VM argument to the jboss_wrapper.conf file located in NCM_INSTALLED_DIR/server/ext/wrapper/conf:

wrapper.java.additional.#=-XX:-UseBiasedLocking

Where # is the next number in sequential order of all the parameters. For example, if the jboss_wrapper conf file has the following arguments, the workaround VM argument would be #6.

wrapper.java.additional.1=-DTCMgmtEngine=1

wrapper.java.additional.2=-Duser.dir=C:\NCM\server\ext\jboss\bin

wrapper.java.additional.3=-Xmn170m

wrapper.java.additional.4=-Djava.awt.headless=true

wrapper.java.additional.5=-Dfile.encoding=UTF8

wrapper.java.additional.6=-XX:-UseBiasedLocking

Viewing VLAN Information for a Port/Interface

Bug ID : QCCR1D98139

When viewing device MAC Addresses details on the MAC Address Details page, the VLAN field is not populated.

Workaround   To display VLAN information for a port/interface, click the Port Name link for that port on the MAC Address Details page. The Interface Details page opens. Scroll down to the Member VLANs field to view VLAN information.

Using Active Directory

Bug ID : QCCR199633

If you are using Active Directory, you must modify the corresponding options in the appserver.rcx file to include the correct attributes in the search mapping session.

In the appserver.rcx file, locate <!-- Attribute mapping for Generic LDAP server--> session.

Make sure that:

"groupOfName" is included in the "group_search".

"uid" is included in the "username_search".

"member" is included in the "member_search".

Save the changes to the appserver.rcx file.

Restart the NCM server.

Java Plug-in Version

Bug ID : QCCR1D88659

If the Connect function fails and the NCM server hangs, check the version of Java running on your Windows system. This is problem with the Java Plug-in to your Web browser. The issue is not with the NCM server.

To check what version of Java you are running:


Step 1 Go to Start > Control Panel.

Step 2 Double-click Java.

Step 3 In the General tab, click About.

The Java version will be displayed

If you have Version 6 Update 11 or later, you must install an older JRE on your Windows system. Version 6 Update 10 and earlier are known to work.


Using the Device Group Selector

Bug ID : QCCR1D98865

Some Chinese characters will not be displayed when using the Device Group Selector.

Creating advanced Perl scripts

Bug ID : QCCR1D101541

While creating an advanced Perl script, remember that NCM treats $some_text$ as reserved variables. If you use '$' pairs in the script that are not NCM variables, ensure you separate them with a space.

For example:

Incorrect: my($host,$port,$user,$pass) = ('localhost','$tc_proxy_telnet_port$', '$tc_user_username$','$tc_user_password$');

Correct: my($host, $port, $user, $pass) = ('localhost','$tc_proxy_telnet_port$', '$tc_user_username$','$tc_user_password$');

Error when viewing results for diagnostics with single quotes in their name

Bug ID : QCCR1D95468

When creating a diagnostic with single quotes in its name, such as "Ana's Diagnostic", after running the diagnostic against a device, the diagnostic results are not displayed.

Workaround   Do not use single quotes in diagnostic names.

Diagnostic Name Limit

Bug ID : QCCR1D96090

When naming a diagnostic, you are able to enter up to 100 characters. However, when running the diagnostics, the name is limited to 50 characters.

Workaround   Limit diagnostic names to 50 or less characters.

Using SCP with devices in remote Realms

Bug ID : QCCR1D87003

Devices in remote Realms cannot use the Secure Copy (SCP) Transfer Protocol because in most cases, the remote Gateway Satellite Agent cannot use SSH/SCP port 22, since the Gateway OS is already using the port.

Workaround   Disable SCP for devices in remote Realms.

Solaris and SecurID

Bug ID : QCCR1D86370

Configuring NCM to use SecurID as the authentication method can cause the management service to crash. The SecurID libraries provided by RSA are the source of the problem. Currently, the problem can occur on Solaris 10 with a version string of "SunOS 5.10 Generic_118833-22", while version "SunOS 5.10 Generic_120011-14" works fine. Please update your OS to at least this version if you are experiencing problems with SecurID on Solaris until this issue can be resolved.

Using SCP on Linux and Solaris

Bug ID : QCCR1D82379

The Secure Copy (SCP) Transfer Protocol enables you to securely transfer files between a local and remote host or between two remote hosts using the Secure Shell (SSH) protocol. When using SCP on a Linux platform, you will need to modify your system's SSH daemon (SSHD) to run on an alternate port and restart the SSHD service. Port 8022 is recommended.

Once the system's SSHD is reconfigured, you can restart NCM so that it can bind to Port 22. System administrators will need to 'ssh -p 8022 userNCMme@host' to login via the system's SSHD after the change is made.


Note Use 'ssh userNCMme@host' for a direct connection to the NCM proxy.


When logged-in to NCM, you can NCMvigate to the Device Access page (Admin ' Administrative Settings ' Device Access). Scroll down to the SSH Device Access field. Enter a SSH User and SSH Password. The device driver will use this information when copying files to the NCM server.


Note The device specific settings must be configured to eNCMble SCP and SSH to function properly. In addition, the device and the device driver must support SCP to use the NCM SSH server for SCP.


1 To use SCP with remote Realms, the SCP connection must be made back to the managing NCM server. A SCP connection to the NCM Gateway will not succeed because the NCM Gateway runs the Linux and Solaris system SSHD. The NCM Gateway sets the host to the NCM Gateway and not the managing NCM Core. This can be overridden by setting an access variable (TFTPServer) to the IP address of the managing NCM Core. Refer to the Satellite User Guide for CiscoWorksNetwork Compliance Manager for detailed information.

Using SCP

Bug ID : QCCR1D80180

The SSH protocol runs on port 22. Secure Copy (SCP) is a data transfer mechanism that uses the SSH protocol. By default, Linux and Solaris installs run on port 8022. Windows installs run on port 22. For Windows installs, if the port is switched to 8022, there could be connectivity issues. (Because most devices do not allow for the specification of an alternate port, this issue if uncommon.)


Note SCP will not work if the device is in a remote Realm and access to the device is managed via a NCM Satellite. You must run the NCM SSHD proxy on port 22. If you use port 8022 on any platform, SCP copies from a device to NCM will not work. Refer to the NCM Satellite Guide for information on configuring NCM Satellites.


Proxy Interface

Bug ID : QCCR1D86391

If you login to NCM as a limited access user and attempt to connect to a device via the proxy interface, the connection will be dropped at the username/password prompt.

SNMP Timeouts

Bug ID : QCCR1D75228

Using SNMP device discovery over networks with latency can cause SNMP timeouts. To resolve this issue:

1.Login to NCM.

2.On the menu bar under Admin, select Administrative Settings and click Device Access. The Administrative Settings - Device Access page opens.

3.Scroll down to the Detect Network Devices and Port Scan Task Settings section and set SNMP Timeout to a higher value, for example 2500 (milliseconds).

-sync option

Bug ID : QCCR1D79600

When Workflow is enabled, attempting to run a CLI or API task with the -sync option will fail with a "No such directory' error.

Database Passwords

Bug ID : QCCR1D61595

Any NCM user input cannot contain multiple dollar signs ($$). As a result, if the password you use to connect to the database contains multiple dollar signs, you must modify the password before installing NCM.

Installation Address

Bug ID : QCCR1D78975

The IPv4 address range 169.254.0.0/16 is reserved for link-local usage (referred to as APIPA: Automatic Private Internet Protocol Addressing, by Microsoft) and is not applicable addressing for a network application server such as NCM. For more information, refer to http://www.ietf.org/ (rfc 3330 and rfc3927).

SSH Communication

Bug ID : QCCR1D78861

NCM 1.4 introduced a new set of keys for SSH communication. In releases earlier than NCM 1.4, NCM used one Digital Signature Algorithm (DSA) key for all installations. When you upgrade to NCM 1.4 or NCM 1.5, NCM creates two, new 1024 bit keys. The first key uses the DSA algorithm. The second key uses the RSA algorithm. These keys are used when you connect to NCM via SSH.

Custom Data Setup

Bug ID : QCCR1D77153

Custom data fields enable you to assign useful data to specific devices, configurations, users, and so on. This gives you added flexibility and enables you to integrate NCM with other applications.

To add custom data, on the menu bar under Admin click Custom Data Setup. The Custom Data Setup page opens. Custom data field can include alphanumerics and underscores. While you can use dashes, custom data field names with dashes cannot be used with tc_device_custom device variables in custom scripts.

Advanced ACL Scripts

Bug ID : QCCR1D74295

Selecting the "Update Script" button when specifying an advanced ACL script can lock-in values. As a result, running (or re-running) the script could result in variables not being updated properly.

Workaround   Avoid using the "Update Script" button with advanced ACL scripts.

Use of Dollar Signs ($) in Scripts

Bug ID : QCCR1D69342

If generating a script from a Telnet/SSH session log, the script will fail or perform in unexpected ways if the session contains dollar signs ($) in the executed commands.

OS Analysis Task

Bug ID : QCCR1D67566

When using NCM in an environment with overlapping IP addresses, the OS Analysis task is not supported for devices behind remote Realm gateways. OS Analysis tasks run on devices in the locally reachable network. This could result in an image recommendation being incorrect for devices behind the gateway. Keep in mind that NCM will report OS recommendations for a device in the default Realm instead of a remote Realm if they share an IP address.

Email Report Task

Bug ID : QCCR1D69342

When scheduling an Email Report task, if you select a report other than Summary Reports in the "Reports to run" field, the task is reported as failed. However, the report is successfully emailed to the recipient. You can disregard the error message.

Template Scripts

Bug ID : QCCR1D70552

When using template scripts (i.e., Batch insert line into ACL by handle), selecting the Run Again option will rerun the same script. Attempting to change fields will not change the script that is run.

NCM Core Gateways

Bug ID : QCCR1D68751

You cannot configure redundant NCM Core Gateways in the same NCM Realm as a single NCM Core.

Workaround   Edit the adjustable_options.rcx file and add the other NCM Core Gateways' IP address(es):

<array name="rpc/allowed_ips">

<value>10.255.54.10</value>

</array>

Oracle database errors cause failed tasks and other issues

Bug ID : QCCR1D69094

Oracle database errors cause failed tasks and other issues due to a bug in the JDBC Oracle driver. As a result, it is possible for the driver to cause database errors-causing tasks to fail and other issues. The error message information is OALL8 is in an inconsistent state.

Workaround   It is recommended that you update your version of Oracle Database Server.

Potential for task failure when using reserved NCM characters in device prompts

Bug ID : QCCR1D70102

There are eleven characters with special meanings to NCM:

Opening square bracket ( [ )

Opening round bracket and the closing round bracket ( ( ) ).

Backslash ( \ )

Caret ( ^ )

Dollar sign ( $ )

Period or dot ( . )

Vertical bar or pipe symbol ( | )

Question mark ( ? )

Asterisk or star ( * )

Plus sign ( + )

If you use these characters in a device prompt, null pointer exception errors could occur during task execution. As a result, the task will fail.

Workaround   Avoid using these characters when naming devices that interact with NCM.

ACLs with the same name, but different case in NCM, is not recommended

Bug ID : QCCR1D61744

NCM supports case-sensitivity in ACL names. As a result, you can have two ACLs with the same name, but different case. If you delete one of those ACLs, however, all ACLs with the same name are deleted, regardless of the case. Cisco does not recommend multiple ACLs with the same name, but differing case in NCM.

Use of the dollar sign ($) in Perl code

Bug ID : QCCR1D61867

If you convert a Telnet/SSH Proxy session that contains a dollar sign ($) to Perl (such as a script that puts a $ in the banner), NCM does not properly escape the dollar sign ($) in the generated Perl code.

Workaround   Edit the script and put a backslash (\) in front of the dollar sign ($).

Batch editing parent device groups or device groups

Bug ID : QCCR1D61742

When you batch edit devices in a parent device group or in a device group or partition that has no devices, an invalid error message is displayed: You do not have Modify Device Permission for any of the devices you selected.

Workaround   To batch edit all devices in a parent device group, do a batch edit against each child group in the parent device group.

Downloading software images from Cisco.com

Bug ID : QCCR1D66891

You can download software images from Cisco.com for devices that are not currently in your NCM system. However, to be able to successfully deploy the software image, you may need to modify the driver and/or model information.

Workaround   

1.From the Devices menu, select Device Tools and click Software Images. The Software Images page opens.

2.In the Action column, click Edit for the software image you want modify. The Edit Software Image page opens.

3.In the Image Set Requirements field, modify the driver and/or model information to be compatible with the device in NCM.

4.Click the Save Software button.

Multimaster Distributed System: Importing Devices

Bug ID : QCCR1D59742

If you import two devices with identical IP addresses into two separate NCM Cores at approximately the same time, there is currently no way to detect the possibility of a duplicated device.

Workaround   Manually run the Deduplication task after importing devices. One device will be automatically "de-duplicated" and set to "Inactive." (Refer to Chapter 7, "Scheduling Tasks," in the NCM User Guide for information on running the Deduplication task.)

Multimaster Distributed System on SQL Server

If you see a conflict entry for which the reason_text field does not reference a constraint name, it is possible that NCM automatically resolved the conflict. In which case, delete the conflict entry. If NCM did not resolve the conflict, make the appropriate corrections and then delete the conflict entry. The following is an example of a reason_text field from a conflict that does not reference a constraint name:

reason_text A row insert at 'red-dalmssql102.ds2880db2' could not be

propagated to 'RED-DALMSSQL101.ds2880db1'. This failure can be caused by a

constraint violation. The merge process was unable to synchronize the row.

Detect Network Devices Task

The NCM system prevents you from inadvertently running more than one Detect Network Devices task concurrently. Although the Detect Network Devices task generates only a minimal level of traffic, NCM provides this protection to help minimize additional traffic when running duplicate or additional Detect Network Devices tasks simultaneously.

If a second or third Detect Network Devices task is scheduled while an earlier Detect Network Devices task is running, NCM will place the new task(s) in the "Waiting" state. The task(s) will run individually after the first Detect Network Devices task has completed.

Diagramming

NCM applies an absolute value for the "text height" attribute for interface and port labels shown in Visio diagrams. When the Visio VDX file is loaded, Visio assigns an incorrect formula to the "text height" attribute. As a result, when you have more than two lines of annotated text (i.e. a label) for an interface or port and you attempt to copy & paste, the label of the new interface or port is displayed improperly and could hide the interface or port icon.

Workaround   Click the "Text Tool" option on the Visio tool bar and move the label so as to expose the interface or port icon.

Multimaster Distributed System Performance

When running a Distributed System, if you are deleting many objects simultaneously, the system may take a while to push transactions for large delete operations.

Multimaster Distributed System External Authentication

When using external authentication in a Multimaster Distributed System environment, the External Authentication Type, for example TACACS+ or Active Directory, is global (i.e., shared between all NCM Cores). Specific authentication server information is NCM Core specific. QCCR1D53815

Workaround   Set the External Authentication Type to "None" on the Administrative Settings ' User Authentication page. Configure each NCM Core individually with authentication server information or Active Directory setup. After all NCM Cores have been configured, set the External Authentication Type on any NCM Core. The External Authentication Type setting is replicated to all NCM Cores.

RADIUS External Authentication

Bug ID : QCCR1D9099

When setting up a user to authenticate using RADIUS, if the RADIUS server does not respond, NCM still authenticates the user against the NCM local password, even if you instruct NCM not to fail-over on external authentication.

Tasks: Running External Application tasks presents a possible security risk

Bug ID : QCCR1D14089

All Run External Application tasks run the application with root (UNIX) or system (Windows) privileges. This is a potential security risk that should be acknowledged by the System Administrator before using the Run External Application feature.

Scripts: Output results in HTML Format

Bug ID : QCCR1D21216

When executing an advanced script or a Run External Application task, any text that the advanced script or external application writes to 'stdout' is stored in NCM as the task result. Typically, this output is treated and displayed as plaintext. As a result, before NCM displays the task results, it will escape any characters that would affect the HTML rendering, for example converting < to &lt;.

However, you may want to create an advanced script that outputs its results in HTML format. In this case, none of the output characters would be escaped, so the results displayed would include any applicable HTML formatting. To indicate to NCM that your script outputs HTML results, the first item that your script writes to 'stdout' must be <html>. If your script output begins with anything other than <html>, the script results will be treated as plaintext.

Nmap Scanning

Bug ID : QCCR1D19036

Careful consideration should be taken when identifying the network range you are going to scan. Some network topologies can result in very long scans. In addition, it is recommended that you do not scan Internet addresses. If you think your Nmap scan will take more than a few minutes, you can use several Nmap options, for example --max_scan_delay <milliseconds>, setting <milliseconds> to a value between 1 and 1000. Nmap will throttle up to 1000ms max as packets are dropped.

Keep in mind that Nmap settings can be changed using the Administrative Settings option under Admin on the menu bar, and selecting the Device Access option. Please refer to the Nmap documentation at www.insecure.org for detailed Nmap information.

SecurID Software Token Software, Version 3.x

Bug ID : QCCR1D18988

If the NCM server is installed with the 3.x SecurID token software, turn off copy protection when exporting SecurID software token keys on the RSA server. Otherwise, NCM reports an error when accessing SecurID software tokens. A patched version of the SecurID software is available at RSA's website (http://www.rsasecurity.com).

Canceling or Deleting Tasks

Bug ID : QCCR1D16257

Some NCM tasks will spawn external processes to run PERL or Expect scripts, or to run user-provided executables or shell scripts. Under certain circumstances, NCM may not be able to kill these external processes when the spawning task is cancelled or deleted. This could include scripts that spawn sub-processes or processes that are coded to catch kill signals.

Workaround   Manually stop the external process on the NCM server.

Tasks: A task scheduled for the 31st might run on the 1st

Bug ID : QCCR1D11142

If you schedule a monthly recurring task for the 31st of every month and that task runs during a month that contains fewer than 31 days, NCM will run the task on the 1st, 2nd, or 3rd day of the next month depending on how many days fewer than 31 the previous month contains. For example, if you schedule a task in February (with 28 days) for the 30th, the task will actually run on March 2nd. If you want to run the task on the last day of the month, you must set the date correctly.

Inventory: Data from device overwrites manually entered values

Bug ID : QCCR1D11942

Certain data on the Device Details page (and other pages) is auto-populated. If you manually change the data, NCM overwrites the values when the next snapshot occurs. .

The automatically populated data includes:

Domain Name

Host Name

Model

Serial Number

Location

Vendor

Console Server: SSH access is not supported

Bug ID : QCCR1D11402

NCM does not support console server access via SSH. If you use a console server to access a device, you must use the Telnet connectivity. In other words, on the New Device page/Edit Device page, if "Use to access device" is checked in the Console Server Information section, you should make sure that the "Telnet" option in the Connection Information section is also checked.

Sending reports to external email addresses

Bug ID : QCCR1D15982

Even though you may have properly configured NCM to contact your SMTP server, for network security reasons your SMTP server could have been configured to reject messages from the NCM server address. In this case, you would see the following error message, and any NCM messages would not be delivered.

Error occurred when sending email. Please check the email address and/or your SMTP server settings.

If this occurs, you will need to configure the SMTP server to enable the NCM server to relay email messages through it.

Non availability of Mail.jar

The mail.jar is not available in the directory /<NCM Directory>/server/ext/jboss/server/default/lib/

Workaround   Before upgrading the version from NCM 1.x to NCM 1.8, copy mail.jar from /<NCM Directory>/server/ext/jboss/server/default/lib/ to another location. After the upgrade, copy the mail.jar back to the same location.

Accessing the CiscoWorks NCM Documentation Set

All or any part of the CiscoWorks NCM documentation set, including this document, might be upgraded over time. Therefore, we recommend that you access the CiscoWorks NCM documentation set using the following URL: http://www.cisco.com/en/US/products/ps6923/tsd_products_support_series_home.html


Tip To cut and paste a two-line URL into the address field of your browser, you must cut and paste each line separately to get the entire URL without a break.


Obtaining Documentation and Submitting a Service Request

For information on obtaining documentation, submitting a service request, and gathering additional information, see the monthly What's New in Cisco Product Documentation, which also lists all new and revised Cisco technical documentation, at:

http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html

Subscribe to the What's New in Cisco Product Documentation as a Really Simple Syndication (RSS) feed and set content to be delivered directly to your desktop using a reader application. The RSS feeds are a free service and Cisco currently supports RSS Version 2.0.

Open a service request online at:

http://www.cisco.com/techsupport/servicerequest

View a list of Cisco worldwide contacts at:

http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html