-
Cisco Active Network Abstraction Administrator Guide, 3.6.5
-
Preface
-
Introducing Cisco ANA
-
Getting Started with Cisco ANA Manage
-
Deploying Cisco ANA
-
Using Cisco ANA Manage Tables
-
Managing Cisco ANA Units
-
Managing AVMs and VNEs
-
Managing Global Settings
-
Managing Links
-
Managing Workflows
-
Managing Security
-
Managing the Event Listener
-
System Health Diagnostics
-
Purging the Database
-
System Security Events
-
Backup and Restore
-
Utility Scripts
-
Golden Source Registry
-
Ports Used by Cisco ANA
-
Drools Rules Engine
-
Using High Availability
-
VNE Persistency Mechanism
-
Index
-
Table Of Contents
Admin and Oper Mode AVM Status
Viewing and Editing AVM Properties
Admin and Oper Mode VNE Status
Public Key and Private Key File Formats
VNEs and Device Software Updates
Viewing and Editing VNE Properties
Moving Multiple and Single VNEs
Managing AVMs and VNEs
This chapter describes defining and managing AVMs and VNEs. It includes the following sections:
•
Viewing and Editing AVM Properties
•
•
•
Creating AVMs
Cisco ANA Manage enables you to define AVMs for Cisco ANA unit servers. Every AVM in the Cisco ANA fabric is managed by the watchdog protocol by default. Cisco ANA Manage enables you to define AVMs for units, and enable or disable the watchdog protocol on the AVM.
To define an AVM:
•
•
•
–
–
–
Note
•
Note
To create an AVM:
Step 1
Step 2
Step 3
•
•
•
The following fields are displayed in the New AVM dialog box:
•
Note
•
Note
•
•
The following check boxes are displayed in the New AVM dialog box:
•
•
Note
Step 4
Step 5
Creating a new AVM results in Cisco ANA providing the registry information of the new AVM in the specified unit. The AVM can now host VNEs. For more information, see Defining VNEs.
AVM Status
The status of AVMs and VNEs is affected by Admin and Oper modes. Admin mode is the administrative instructions that are sent to the AVM. Oper mode is the actual operational status of the AVM, such as Up. See Admin and Oper Mode AVM Status.
When moving an AVM (file), its operational status determines whether the file is reloaded (Up) or not (Down). For more information about moving AVMs, see Moving AVMs. For more information about starting and stopping AVMs, see Starting and Stopping AVMs.
An AVM can have only one of the following statuses at a time:
•
•
•
•
Admin and Oper Mode AVM Status
Table 6-1 shows the status of an AVM as it relates to Admin and Oper modes and how it is displayed in the Status column of the AVMs table. The Admin mode is the administrative instructions that are sent to the VNE, while the Oper mode is the actual status of the VNE, such as Up.
Table 6-1 AVM Status
Up
Up
Up
Shutting Down
Down
Up
Down
Down
Down
Starting Up
Up
Down
Viewing and Editing AVM Properties
Cisco ANA Manage enables you to view and edit certain properties of an AVM, such as the key or allocated memory.
To view or edit AVM properties:
Step 1
Step 2
Step 3
•
•
•
The AVM Properties dialog box is displayed with the details of the selected AVM, including the IP address or key of the unit.
The following field is displayed in the AVM Properties dialog box:
•
Step 4
Note
Step 5
Deleting AVMs
You can remove an AVM. If the AVM is running, it is stopped before it is removed. This procedure deletes the registry information of the AVM in the specified unit. If VNEs are running in the AVM, an error message is displayed, and you cannot delete the AVM.
Caution
For more information, see Deleting a VNE.
Note
To delete an AVM:
Step 1
Step 2
Step 3
Step 4
Step 5
Note
Starting and Stopping AVMs
Cisco ANA Manage enables you to start or stop an AVM.
Note
To start or stop an AVM:
Step 1
Step 2
Step 3
•
•
The AVM is started or stopped, and the appropriate status is displayed in the workspace as follows:
•
•
•
•
Note
Moving AVMs
Cisco ANA Manage enables you to move an entire AVM between units.
Note
Cisco ANA Manage automatically checks the status of AVMs and VNEs before they are moved. This information is maintained in the memory.
If the AVM is Up, the AVM is stopped and then moved to the target unit. After the move is completed, the AVM is reloaded according to its status prior to the move, so that the status of the AVM is maintained. For example, if it was Up before the move, it remains Up; if it was Down, it remains Down.
To move an AVM:
Step 1
Step 2
Step 3
The Move To dialog box displays a tree-and-branch representation of the selected Cisco ANA server and its units, excluding the unit in which the AVM is currently located. The highest level of the tree displays the Cisco ANA server. The branches can be expanded and collapsed to display and hide information.
Step 4
Step 5
For information about moving VNEs, see Moving Multiple and Single VNEs.
Finding an AVM or VNE
A single search in Cisco ANA Manage can locate AVMs and VNEs among all Cisco ANA servers according to specifically defined search criteria.
To find an AVM or VNE:
Step 1
Step 2
The Find field enables you to enter specific search criteria to find the required AVM or VNE. For example, you can search for an AVM using the ID number, or search for a VNE using an IP address.
The Types list enables you to specify whether you are searching for an AVM or VNE by selecting an option from the list. When an option is selected, the Property area is enabled, displaying the properties for the selected option. For example, if AVM is selected from the Types list, the AVM properties are displayed in the Property area, and you can select a specific property for the search.
The Up and Down radio buttons enable you to search up and down (you can also use the F3 key).
The following buttons are displayed in the Find dialog box:
•
•
Step 3
When searching for an AVM the following search criteria are displayed:
•
•
•
•
When searching for a VNE the following search criteria are displayed:
•
•
•
•
•
•
Step 4
Step 5
Step 6
Step 7
Note
Overview of VNEs
A VNE is designated by its leading IP address and corresponds to a single NE. Typically an NE has only one IP address that is used for management. For such devices, the leading IP address is the single IP address configured for this device.
If an NE has multiple IP addresses, you must choose one of these IP addresses to be used as the leading IP address. The leading IP address serves as an identifier of the VNE that corresponds to the NE and is displayed wherever the IP address of the NE is required.
Note
Cisco ANA Manage enables you to create VNEs (replicas of devices) by entering the IP address, SNMP, and polling rate information. This is referred to as element management.
After Cisco ANA Manage installs and runs the process, samples the device, and collects the data, a VNE (managed element) is created. The VNE includes tables and physical inventory, and can be accessed using Cisco ANA NetworkVision.
VNE Status
The status of VNEs is affected by Admin and Oper modes. Admin mode is the administrative instructions that are sent to the VNE, while Oper mode is the actual operational status of the VNE, such as Up. For more information about Admin and Oper modes, see Admin and Oper Mode VNE Status.
When moving a VNE, its status (either Up or Down), determines whether the VNE is reloaded (Up) or not (Down). For more information about moving VNEs, see Moving Multiple and Single VNEs. For more information about starting and stopping VNEs, see Changing VNE States.
A VNE can have only one of the following statuses at a time:
•
•
•
•
•
In addition to the statuses described, a VNE can be placed in maintenance mode. For example, a VNE status can be Up and in maintenance mode. NEs often undergo maintenance operations and planned outages. The Cisco ANA platform supports such maintenance operations without affecting the overall functionality of the active network.
While in maintenance mode (temporary state) a VNE:
•
•
•
•
•
•
•
For more information about maintenance mode, see Changing VNE States.
Admin and Oper Mode VNE Status
Table 6-2 presents the status of a VNE in relation to its Admin and Oper modes, as displayed in the Status column of the VNE table. The Admin mode is the administrative instructions that are sent to the VNE while the Oper mode is the actual status of the VNE, such as Up.
Table 6-2 VNE Status
Up
Up
Up
Shutting Down
Down
Up
Down
Down
Down
Starting Up
Up
Down
Unreachable
Up
Unreachable
For example, if you start a VNE, and the Admin status is Up but the Oper status is Down and has not started yet (because the server is busy), the status is Starting Up. If a VNE is Up and you stop the VNE, the Admin status is Down but, because the process is not terminated immediately, the status is Shutting Down.
Defining VNEs
When you add and define a new VNE, it corresponds to an NE and should only be added to the system once. As the VNE loads, Cisco ANA starts investigating the NE and automatically builds a live model of it, including its physical and logical inventory, its configuration, and its status.
When adding a new VNE, Cisco ANA creates the registry information of the new VNE in the unit. The newly created VNE has an administrative status of Down, and uses the default community strings and polling rates. The VNE inherits these properties from the configuration record that corresponds to the device type.
A VNE must be loaded into the bootstrap of the unit before it starts monitoring its underlying NE. This changes the administrative status of the VNE to Up, and ensures that the VNE is loaded on subsequent restarts of the unit. Loading the VNE also starts the VNE immediately. For more information about the status of VNEs, see Admin and Oper Mode VNE Status.
Before adding a new VNE using Cisco ANA Manage, you must first determine the unit and AVM the new VNE is to be added to.
You can define and manage SNMP, Telnet, SSH, ICMP, and polling information for the appropriate VNEs in the New VNE dialog box.
Note
You can create VNEs that perform reachability testing only through ICMP. This can be done by creating a VNE, selecting the type ICMP, and then defining the details in the ICMP tab. See ICMP Tab.
For information on defining VNE properties in the respective VNE tabs, see:
For details on viewing and editing VNE properties, see Viewing and Editing VNE Properties.
To define the properties of a new VNE:
Step 1
Step 2
Step 3
•
•
•
The New VNE dialog box is displayed (see Figure 6-1).
Figure 6-1 New VNE Dialog Box
The New VNE dialog box contains the following tabs:
•
•
•
•
•
Note
General Tab
The General tab enables you to manage VNE information in the connected Cisco ANA.
The following VNE identification fields are displayed in the Identification area:
•
Note
•
•
–
Note
–
–
–
Note
•
The Scheme drop-down list contains the following options:
–
–
–
The difference between the two schemes is that ipcore assumes that the device is used as part of an MPLS VPN network containing P and PE devices. Cisco ANA therefore models these VNEs slightly differently. Use Product for all other instances, including customer edge (CE) devices. The Product scheme assumes that no MPLS or VRF configuration exists and thus does not retrieve it.
These schemes provide users with the flexibility to specify the registrations (a registration is how the VNE queries a live device for information) that the VNEs modeling their routers are to use. You can designate a VNE as a core router by setting it to work with the ipcore scheme, or an edge router by setting it to work with the Product scheme.
Product Scheme
The Product scheme is to be used for routers that are not configured to serve as PE and P devices. The Product scheme includes all device types, except Cisco CRS-1, Cisco XR 12000, Cisco 3750ME, and Juniper M-Series devices.
Since the routing entry to the management system can be discovered via Border Gateway Protocol (BGP), one registration supports discovering just that one entry (mc-ip-bgp under the RoutingEntity Device Component).
Beginning with Cisco ANA 3.6 Service Pack 1, the following registrations available in previous releases are not used by the Product scheme:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
ipcore Scheme
Use the ipcore scheme when you want the VNE to poll for additional data that is typical for PE or P routers, such as VRF or MPLS. The ipcore scheme is applicable for the following device types:
•
•
•
•
•
In addition to usual registrations in the Product scheme, this scheme also includes the following registrations according to Device Components (DCs) and device queries using registrations:
•
–
–
–
–
–
–
–
•
–
•
–
–
–
•
–
–
–
•
–
•
–
•
–
–
–
–
•
–
–
The VNE State field is displayed in the initial state area:
•
•
•
The following fields are displayed in the Location area of the General tab:
•
•
SNMP Tab
The SNMP tab enables you to support polling and accessing devices using SNMPv1, SNMPv2, or SNMPv3. Figure 6-2 shows the SNMP tab dialog box.
Figure 6-2 SNMP Tab
Note
The following check box and radio buttons are displayed in the SNMP tab of the New VNE dialog box:
•
Note
•
•
•
Note
The following fields are displayed in the SNMP V1/V2 Settings area:
•
•
The following fields are displayed in the SNMP V3 settings area:
•
–
–
–
If MD5 or SHA is selected, enter the required information in the following fields:
–
–
•
–
–
–
–
–
If one of the security options is selected, enter the required information in the following field:
–
Telnet/SSH Tab
The Telnet/SSH tab enables you to define the Telnet command sequence and support SSH for device access (reachability) and investigation. See SSHv2 Protocol for more information about the SSH protocol. Figure 6-3 shows the Telnet/SSH tab dialog box.
Figure 6-3 Telnet/SSH Tab
Note
You cannot enable or disable fields.
The following check box is displayed in the Telnet/SSH tab of the New VNE dialog box:
•
Note
The following fields are displayed in the Telnet/SSH tab of the New VNE dialog box:
•
–
–
–
•
Device credentials in the GUI can be masked with asterisks. Click Mask. A Password Controller window opens; enter the password and confirm it. An error message appears if one of the fields is missing, or if the password and confirm strings are not identical. Click OK. The Password Controller window closes, and the password is inserted in the Run text field as asterisks. The Run text field stays masked until you add the prompt to the sequence.
If you do not click Mask, the password is entered as regular text.
The Run column in the Telnet sequence table displays the data in regular text or as asterisks depending on the chosen option.
•
•
The following buttons are displayed in the Telnet/SSH tab of the New VNE dialog box:
•
•
Use the Up and Down arrows to change the order of the commands in the list.
Note
Figure 6-4 Telnet Sequence Ending With Prompt Field
Note
SSHv1 Protocol
If the SSHv1 protocol is selected, enter the required information and properties in the following fields:
•
•
•
•
SSH Login Sequence
After an SSH session is established between the VNE and the device, the VNE starts the login sequence. This sequence is usually shorter than the corresponding Telnet login sequence, as the username or password might have been sent as part of establishing the SSH session.
We recommend that you first use any SSH client application, such as unix-ssh or openSSH, to see what the device valid SSH login sequence is and then add the sequence to the VNE configuration.
SSHv2 Protocol
SSH is a protocol that provides a secure session using standard cryptographic mechanisms.
SSH Login Sequence
For information on the SSH login sequence, see SSH Login Sequence.
Client Authentication
You need to enter your username and either a password or a private key according to the configured authentication option on the device.
Public key client authentication uses a key pair system in which the client application is configured with the secret private key and the device is configured with the public nonsecret key of this pair.
You must enter a private key. You can copy and paste it, or upload it from a file by clicking Browse for file.
Entering the matching public key is optional. If it is provided, the application verifies that the public and private key are a part of the pair. You can also click Generate to generate the matching public key using the private key information.
Supported Algorithms
At least one algorithm must be selected in each subject (key-exchange, MAC, cipher, or host-key). If more than one is selected, the application tries all algorithms until one is accepted by the server. There is no priority in the way the algorithms are tried.
Note
Cisco ANA supports the following algorithms commonly used in network devices:
•
–
–
–
–
•
–
–
–
–
•
–
–
•
–
–
Server Authentication
Most of the devices that support SSH have a means of identifying themselves to the clients, so the clients are sure that the server is not an imposter.
The server has a permanent server public key and it passes it in each session negotiation. The client compares this public key to the known public key of the server. If they match, the client can be sure of the authenticity of the server.
There are several methods that a VNE uses for this authentication:
•
•
For all subsequent connections, authentication is performed against the data saved in the first connection. This method assumes the first connection was legitimate and compares all later connections to it. Note that a security risk still exists if the first connection was compromised.
After the first connection, this option automatically changes to preconfigured and the public key data of the session is inserted as the preconfigured data.
•
If the server fails to authenticate itself using the preconfigured data, the connection fails. This is the default behavior and is the recommended security option.
Preconfigured data can be of either of the following types:
–
–
Public Key and Private Key File Formats
There are several file formats for public and private RSA and DSA keys. The same key can be written differently according to the format that is used.
This application officially supports the openSSH format. For more details, see http://www.openssh.com/manual.html.
Make sure that the keys you provide as input parameters are in this format. If they are not, you need to convert them to the open SSH format before applying them.
Use Case Example
When working with Cisco IOS, the public key is retrieved using the show crypto key mypubkey command. This format is not compatible with the OpenSSH format, and is not supported. There are several ways to convert the format.
The easiest solution is to use public key scan by the (free) openSSH application to retrieve the public key in the supported format. For more details, see http://www.openssh.com/manual.html.
Another option is to convert the files to the required format either manually or by using a script.
Examples of Valid File Formats
RSA- private key-----BEGIN RSA PRIVATE KEY-----MIICWwIBAAKBgQDvdpW8ItfbSp/hTbWZJqCPmjRyh9S+EpTJ0Aq3fnGpFPTR+........TiOfhiuX5+M1cTaE/if8sScj6jE9A0MpShBrnDU/0A==-----END RSA PRIVATE KEY-----DSA private key-----BEGIN DSA PRIVATE KEY-----MIIBuwIBAAKBgQDNGO+l2XW+W+YtVnWSYbKXr6qkrH9nOl+.........7wO4+FR9afoRjDusrQrL-----END DSA PRIVATE KEY-----DSA public keyssh-dss AAAAB3.........HfuNYu+ DdGY7njEYrN++iWs= aslehr@aslehr-wxp01RSA - public keyssh-rsa AAAAB3...lot more...qc8Hc= aslehr@aslehr-wxp01ICMP Tab
The ICMP tab enables repetitive sending of packets to a device to verify that the device is reachable. You can define the polling rate in seconds for the VNE. Click the ICMP tab to display the ICMP tab in the New VNE dialog box (see Figure 6-5).
Figure 6-5 ICMP Tab
The following check box is displayed in the ICMP tab of the New VNE dialog box:
•
Note
Polling Tab
The Polling tab enables you to:
•
•
–
–
–
–
In addition, a polling interval can be configured for a class of devices, such as all Cisco routers.
Caution
Click the Polling tab to display the Polling tab dialog box (Figure 6-6).
Figure 6-6 Polling Tab
The following radio buttons are displayed in the Polling Method area:
•
For more information about creating customized polling groups, see Chapter 7, "Managing Global Settings."
The Polling Intervals and Topology areas are disabled when Group is selected.
•
Note
The Polling Intervals and Topology areas are enabled when Instance is selected.
The following polling interval fields are displayed in the Polling Intervals area:
•
•
•
The following fields are displayed in the Topology area:
•
•
Caution
Defining a Generic SNMP VNE
The generic SNMP VNE is a VNE that is not related to any vendor, can represent any vendor (with certain limitations), and provides lightweight management support for network devices.
The generic SNMP VNE provides basic management capabilities for a device with the following technologies:
•
•
•
Note
The generic SNMP VNE supports the following inventory items:
•
•
•
•
•
A generic SNMP VNE can be loaded in two ways:
•
Cisco ANA Manage enables you to load a VNE as a generic SNMP VNE. You can do this by selecting the Generic SNMP option in the Type field of the New VNE dialog box. For more information about defining a generic SNMP VNE, see Defining VNEs.
•
If the device is not found in the deviceTypes list, it is currently unsupported and you can load the VNE as:
–
–
Every VNE in agentdefaults/da has the entry "load generic agent for unsupported device type," where you can set the value as true or false (the default). If the value is true, it sets 1.3.999.3 as the property. It looks for this property in agentdefaults/da/deviceTypes and finds sheer/genericda. It then skips the investigation of the device software versions and builds the VNE (generic SNMP) from the default version.
Polling System Configuration
The sysoid command and the software version command are used to poll the system configuration. The following parameters are available:
•
•
Note
VNEs and Device Software Updates
You do not need to manually restart a VNE after a upgrading the software on a device. When the VNE polls for configuration information, it will detect these kinds of changes and will restart itself. When the VNE reloads, it will update any required registry information, such as the VNE registry path.
For information on configuration polling cycles, see Polling Tab.
Viewing and Editing VNE Properties
Cisco ANA Manage enables you to view and edit the properties of a VNE in a unit, such as the status or Telnet settings. See Defining VNEs.
To edit the properties of a VNE:
Step 1
Step 2
Step 3
•
•
•
For more details about the fields displayed in the VNE Properties dialog box, see Defining VNEs. In addition to the fields displayed when adding a new VNE, the following fields and buttons are displayed:
•
•
•
•
•
•
Step 4
Step 5
Step 6
Deleting a VNE
Cisco ANA Manage enables you to delete a VNE from a unit and AVM. This process stops the VNE if it is running and deletes all VNE references from the system and Golden Source. This includes the registry information of the VNE in the specified unit. A VNE that has been removed no longer appears in any future system reports.
Since all VNE information is deleted, adding the VNE again requires you to enter all VNE information.
Note
To delete a VNE:
Step 1
Step 2
Step 3
Step 4
Step 5
Changing VNE States
Cisco ANA Manage enables you to start or stop a VNE, or move a VNE to maintenance mode. Starting the VNE adds the VNE to the server bootstrap. Stopping the VNE removes the VNE from the server bootstrap.
During normal operation, NEs often undergo maintenance operations and planned outages such as software upgrades, hardware modifications, or cold reboots. The Cisco ANA platform supports such maintenance operations without affecting the overall functionality of the active network. Neighboring VNEs do not generate alarms that are related to links to or from the maintained VNE.
While in maintenance state (temporary state), a VNE:
•
•
•
•
•
•
•
However, you are not required to manually restart a VNE when you upgrade the device software. The VNE will automatically restart itself and update any required information. For more details, see VNEs and Device Software Updates.
A VNE blocks all provisioning flows that run through the VNE. A device in maintenance state can be disconnected and restarted, and this does not result in link down alarms. Upon restart, the VNE receives only persistent information and returns to its latest known configuration. The topology links are renewed automatically.
Table 6-3 shows the icon used to indicate that a VNE is in maintenance state.
Table 6-3 VNE Maintenance Icon
This icon indicates a VNE in maintenance state in NetworkVision.
To change the state of a VNE:
Step 1
Step 2
Step 3
Step 4
•
•
•
Step 5
•
If the AVM hosting the VNE is in a Down status, the VNE status remains Starting Up until the AVM is brought up.
•
•
Moving Multiple and Single VNEs
Cisco ANA Manage enables you to move single and multiple VNEs between AVMs. The VNEs that are moved are unloaded. The status of the VNEs is maintained after they are reloaded.
To move one or more VNEs:
Step 1
Step 2
Step 3
Step 4
The Move To dialog box displays a tree-and-branch representation of the selected Cisco ANA server, its units, and AVMs, excluding the AVM in which the VNE is currently located. The highest level of the tree displays the Cisco ANA server. The branches can be expanded and collapsed to display and hide information.
Step 5
Step 6
Note
Note
