Table Of Contents

Managing Security

8.1  Overview

8.2  Login Advisory Message

8.3  User Security

8.3.1  User Privilege Profiles

8.3.2  Performing User Administration

8.3.3  Managing CTM User Profiles

8.4  NE Security Management

8.4.1  Setting NE Authentication

8.4.2  Setting Up a Security Policy

8.4.3  Using the ONS 1580x NE User Access Log Table

8.4.4  Managing NE User Access

8.4.5  Managing CTC User Profiles

8.4.6  Managing Cisco IOS Users

8.5  Audit Log

8.5.1  Viewing the Audit Log

8.5.2  Filtering Audit Log Data

8.6  Northbound Gateway Security

Managing Security

---

This chapter describes CTM security and how to manage users. This includes an overview of security domains and a description of the user security and NE security features available in CTM.

This chapter contains the following sections:

•Overview

•Login Advisory Message

•User Security

•NE Security Management

•Audit Log

•Northbound Gateway Security

8.1  Overview

Why create a security policy?

•To create a baseline of your current security posture

•To set the framework for security implementation

•To define allowed and disallowed behaviors

•To help determine necessary tools and procedures

•To communicate consensus and define roles

•To define how to handle security incidents

The following security domains govern CTM networks:

•CTM client—A CTM client must be created with one of the existing default user profiles or with a new custom user profile with appropriate access privileges. This new user profile should be created and assigned to a user.

•CTM OSS users—OSS-to-CTM sessions are configured by the CTM GateWay EMS-to-NMS interface architectural component. See Chapter 12, "Southbound and Northbound Interfaces" for more information about CTM GateWay.

•NE users—An NE user account must be set up so CTM can use it to communicate with the NE. NE user accounts are used to directly access the NE through the NE's craft tool or the CLI.

CTM supports the following security features:

•Login advisory message

•User management and profiles

•NE access control

•Audit log

•Northbound gateway security

8.2  Login Advisory Message

After logging into the CTM client, a login advisory message is shown. By default, the advisory message reads:

NOTICE: This is a private computer system. Unauthorized access or use may lead to 
prosecution.

You can customize the default advisory message as follows:

---

Step 1 Log into the CTM server as the root user.

Step 2 Use a text editor to edit or create the advisory.txt file in the /opt/CiscoTransportManagerServer/cfg directory. The new advisory message can contain up to 1,600 characters. The advisory.txt file does not exist by default.

Step 3 Save the changes. All subsequent users who log into the CTM client will see the new advisory message.

---

---

Note You can also disable the advisory message altogether. See Configuring CTM Security Parameters.

---

8.3  User Security

This section describes user security and management. This includes procedures on how to add a new user, modify a user's properties, delete a user, and end an active user session. It also includes procedures on how to add, modify, and delete custom profiles and how to perform NE user administration.

8.3.1  User Privilege Profiles

By default, CTM contains the following user profiles:

•SuperUser—Users who have access to all operations.

•SysAdmin—System administrators who manage CTM access.

•NetworkAdmin—Typically, NOC supervisors who perform daily network surveillance, provisioning, and PM activities on any group or NE.

•Provisioner—Users who perform daily network surveillance, provisioning, and PM activities on specific NEs. Each provisioner can have only one active session. Provisioners cannot access administrative information.

•Operator—Users who perform daily network surveillance and PM activities on specific NEs. Each operator can have only one active session. Operators cannot access administrative information.

CTM allows SuperUsers and SysAdmins to generate custom user profiles with certain privileges. Custom user profiles are grouped into categories and each category has a set of operations. (See Table 8-1.) After the user profiles are generated, they can be assigned to new CTM users.

Table 8-1 CTM Custom User Profiles 

Operations	Description	Privileges
EMS Administration Category
Audit Error Log	Launch the Audit Log and Error Log.	Read Only or No Access
CTC Upgrade Table	Launch the CTC Upgrade table and add, activate, or delete binary files.	Read Only, Read/Write, or No Access
CTM User Profiles	Launch the CTM User Profiles table and add, delete, or modify user profiles.	Read Only, Read/Write, or No Access
CTM Users	Launch the CTM Users table and add, delete, or modify users and user preferences.	Read Only, Read/Write, or No Access
Control Panel	Launch the Control Panel and related tables.	Read/Write or No Access
GateWay/TL1 Users	Launch the GateWay/TL1 Users table and add, delete, or modify users.	Read Only, Read/Write, or No Access
Logged In CTM Users	Launch the Logged In CTM Users table.	Read Only, Read/Write, or No Access
Logged In GateWay/TL1 Users	Launch the Logged In GateWay/TL1 Users table.	Read Only, Read/Write, or No Access
Save Map As Default	Save map customizations as default.	Read/Write or No Access
NE Administration Category
Add or Delete NE or Group	Add or delete NEs or groups from the domain.	Not assigned
CTC User Profiles	Launch the CTC User Profiles table and add, delete, and modify CTC user profiles.	Read Only, Read/Write, or No Access
Edit Domain Node Properties	Edit properties on the pane associated with the root node in the Domain Explorer tree.	Read/Write or No Access
Edit NE or Group Properties	Edit NE or group properties.	Read/Write or No Access
Manage IOS Users	Launch the IOS Users table and create, modify, and delete users.	Read Only, Read/Write, or No Access
NE Logged In Users table	Launch the Logged In NE Users table and add, modify, and delete NE users.	Read Only, Read/Write, or No Access
NE Security	Change the security advisory messages set for a single NE or multiple NEs.	Read Only or Read/Write
NE User Access Admin	Launch the NE User Access table and add, modify, and delete NE users.	Read Only, Read/Write, or No Access
Subnetwork Explorer	Launch the Subnetwork Explorer, add a new subnetwork, and modify existing subnetworks. Note Adding a new subnetwork by a user profile with Assign NEs property is not allowed.	Not assigned
Supported NE table	Launch the Supported NE table.	Read Only, Read/Write, or No Access
Topology Modification	Drag, drop, cut, copy, and paste NEs in the Domain Explorer.	Not assigned
User Preferences	Edit the user preferences.	Read/Write or No Access
NE Configuration Management Category
BLSR table	Launch the BLSR table.	Read Only, Read/Write, or No Access
CLI Interface	Launch the command-line interface (CLI) for an NE.	Read/Write or No Access
Circuit table	Launch the Circuit table and create, modify, repair, delete, trace, or upgrade circuits.	Read Only, Read/Write, or No Access
Compare Config Files	Compare configuration files.	Read Only, Read/Write, or No Access
Create BLSR	Create BLSR.	Read/Write or No Access
Create MS-SPRing	Create MS-SPRing.	Read/Write or No Access
DWDM Ring table	Manage DWDM ring IDs across multiple NEs.	Read Only, Read/Write, or No Access
Data Administration Functions	Enable L2 functionality on an L2 topology created using L1 circuits.	Read Only, Read/Write, or No Access
Data Service Management Functions	Create, edit, or delete L2 services on an L2 topology.	Read Only, Read/Write, or No Access
Equipment Inventory	Launch the Equipment Inventory table.	Read Only or No Access
L2 Service Provisioning	User-defined profiles and/or custom QoS settings.	Read Only or Read/Write
Launch Craft Interface	Launch CTC from CTM.	Read/Write or No Access
Layer 1 Circuit Management	Create, edit, or delete an L2 topology using L1 circuits.	Read Only, Read/Write, or No Access
Link table	Launch the Link table and create, modify, and delete links.	Read Only, Read/Write, or No Access
MS-SPRing table	Launch the MS-SPRing table.	Read Only, Read/Write, or No Access
Manage VLANS	Launch the Manage VLANs table and create and delete VLANs.	Read Only, Read/Write, or No Access
ONS 1580x Domain NE table	Launch the ONS 1580x Domain NE table.	Read Only or No Access
Profile Management	Create, edit, and delete L2 QoS profiles on an L2 service.	Read Only, Read/Write, or No Access
Rolls table	Launch the Rolls table.	Read Only, Read/Write, or No Access
SNTP Configuration	Launch the SNTP Configuration wizard.	Read/Write or No Access
TL1 Interface	Launch the TL1 interface on the NE.	Read/Write or No Access
NE Fault Management Category
Alarm Browser/Log	Launch the Alarm Browser, Alarm Log, or Event Export Manager, acknowledge alarms, and show alarm notes.	Read Only, Read/Write, or No Access
Show CTM EMS Alarms/Events	Show the CTM-specific EMS alarms and events count in the Dashboard, show CTM-specific EMS alarms in the Alarm Browser, and show CTM-specific EMS alarms and events-related popups.	Read/Write or No Access
NE Management Category
Audit Trail table	Launch the Audit Trail table.	Read Only or No Access
Job Monitor	Launch the Job Monitor table and cancel job, cancel task, add user notes, or view user notes.	Read Only, Read/Write, or No Access
NE Software Memory Management	Back up and restore memory and download software on an NE.	Read/Write or No Access
NE Software table	Launch the NE Software table and commit and revert/switch software versions on an NE.	Read Only, Read/Write, or No Access
ONS 155xx CM Discovery	Launch the ONS 155xx CM Discovery table.	Read Only, Read/Write or No Access
ONS 155xx Flash Files table	Launch the ONS 155xx Flash Files table.	Read Only, Read/Write, or No Access
ONS 155xx SNMP table	Launch the ONS 155xx SNMP table.	Read Only, Read/Write, or No Access
ONS 1580x NE User Log	Launch the ONS 1580x NE User Log.	Read Only, Read/Write, or No Access
NE PM Category
Performance Monitor	Launch PM query wizards.	Read Only or No Access
NE Provisioning Category
NE DCC	Create, edit, and delete DCC parameters.	Read Only, Read/Write, or No Access
NE Explorer	Launch the NE Explorer.	Read Only, Read/Write, or No Access
NE Explorer Configuration	Allow network and timing write operations.	Read/Write or No Access
NE Firewall	Create, edit, and delete firewall parameters.	Read Only, Read/Write, or No Access
NE IP Address	Create, edit, and delete NE IP address-related parameters.	Read Only, Read/Write, or No Access
NE OSPF	Create, edit, and delete NE OSPF parameters.	Read Only, Read/Write, or No Access
NE OSPF Area Ranges	Create, edit, and delete NE OSPF area ranges.	Read Only, Read/Write, or No Access
NE OSPF Virtual Link	Create, edit, and delete NE OSPF virtual links.	Read Only, Read/Write, or No Access
NE Protection	Create, edit, and delete protection groups.	Read Only, Read/Write, or No Access
NE RIP	Create, edit, and delete RIP parameters.	Read Only, Read/Write, or No Access
NE SNMP	Create, edit, and delete NE SNMP.	Read Only, Read/Write, or No Access
NE Static Routes	Create, edit, and delete NE static routes.	Read Only, Read/Write, or No Access

8.3.2  Performing User Administration

This section describes how to perform user administration, including:

•Viewing the CTM Users Table

•Creating a CTM User

•Modifying a CTM User's Properties

•Deleting a CTM User

•Viewing Logged In CTM Users

•Ending an Active CTM User Session

•Using the CTM Locked Window

•Unlocking a User Account

•Changing Your User Password

•Managing Security Advisory Messages

•Setting User Preferences

•Enabling or Disabling the Continuous Audible Alarm

•Configuring CTM Security Parameters

•Sending Messages to Other Users

•Viewing User Notification Messages

Table 8-2 lists the CTM default user profiles and the privileges associated with each profile.

---

Note The SuperUser profile has access to all operations, and is not specifically listed in a separate column.

---

---

Note The NetworkAdmin profile has access to all NEs and groups. The SysAdmin profile has access to no NEs or groups.

---

Table 8-2 CTM Default User Profiles 

Operation	SysAdmin	NetworkAdmin	Provisioner	Operator
Domain Explorer
File > New Group	Deny	Allow	Deny	Deny
File > Add Network Element(s)	Deny	Allow	Deny	Deny
File > Dashboard	Allow	Allow	Allow	Allow
File > Network Map	Deny	Allow	Allow	Allow
File > Subnetwork Explorer	Deny	Allow	Deny	Deny
File > Domain NE table	Deny	Allow	Allow	Allow
File > ENE Devices	Deny	Allow	Allow	Allow
File > Notify Users	Allow	Allow	Allow	Allow
File > Refresh Data	Allow	Allow	Allow	Allow
File > Debug Options	Allow	Allow	Allow	Allow
File > Lock CTM Client	Allow	Allow	Allow	Allow
Edit > Cut	Deny	Allow	Deny	Deny
Edit > Copy	Deny	Allow	Deny	Deny
Edit > Paste	Deny	Allow	Deny	Deny
Edit > Delete	Deny	Allow	Deny	Deny
Edit > Delete All	Deny	Allow	Deny	Deny
Edit > Undelete	Deny	Allow	Deny	Deny
Edit > Expand	Deny	Allow	Allow	Allow
Edit > Collapse	Deny	Allow	Allow	Allow
Edit > Find	Deny	Allow	Allow	Allow
Edit > Find Next	Deny	Allow	Allow	Allow
Edit > User Preferences	Allow	Allow	Allow	Allow
Edit > Change Password	Allow	Allow	Allow	Allow
Fault > Alarm Browser	Allow	Allow	Allow	Allow
Fault > Alarm Log	Allow	Allow	Allow	Allow
Fault > Event Export Manager	Allow	Allow	Allow	Allow
Fault > Ping NE	Deny	Allow	Allow	Allow
Fault > Test NE Connectivity	Deny	Allow	Allow	Allow
Fault > Stop Continuous Beep	Deny	Allow	Allow	Allow
Performance > PM Query by NE Model	Deny	Allow	Allow	Allow
Performance > PM Query by Category	Deny	Allow	Allow	Allow
Configuration > NE Explorer	Deny	Allow	Allow	Allow
Configuration > Link table	Deny	Allow	Allow	Allow
Configuration > Create Circuit	Deny	Allow	Allow	Deny
Configuration > Manage VLANs	Deny	Allow	Allow	Deny
Configuration > Create Link	Deny	Allow	Allow	Deny
Configuration > NE_Model > Equipment Inventory table	Deny	Allow	Allow	Allow
Configuration > NE_Model > Launch Web Interface	Deny	Allow	Allow	Allow
Configuration > NE_Model > Launch CLI	Deny	Allow	Allow	Allow
Configuration > NE_Model > Launch TL1 Interface	Deny	Allow	Allow	Allow
Configuration > NE_Model > Launch Cisco Edge Craft	Deny	Allow	Allow	Allow
Configuration > NE_Model > BLSR table	Deny	Allow	Allow	Allow
Configuration > NE_Model > Create BLSR	Deny	Allow	Allow	Allow
Configuration > NE_Model > Alarm Profiles Management	Deny	Allow	Allow	Deny
Configuration > NE_Model > NE Defaults Management	Deny	Allow	Allow	Deny
Configuration > NE_Model > Circuit table	Deny	Allow	Allow	Allow
Configuration > NE_Model > Rolls table	Deny	Allow	Allow	Allow
Configuration > NE_Model > Update Circuit	Deny	Allow	Allow	Deny
Configuration > NE_Model > Repair Circuit	Deny	Allow	Allow	Deny
Configuration > NE_Model > Configure Node	Deny	Allow	Allow	Allow
Configuration > NE_Model > Launch CTC	Deny	Allow	Allow	Allow
Configuration > NE_Model > L2 Topology table	—	Allow	Allow	Allow
Configuration > NE_Model > Create L2 Topology	—	Allow	Allow	Deny
Configuration > NE_Model > QoS Profile table	Deny	Allow	Allow	Allow
Configuration > NE_Model > Create QoS Profile	Deny	Allow	Allow	Deny
Configuration > NE_Model > DWDM Ring table	Deny	Allow	Allow	Allow
Configuration > NE_Model > MS-SPRing table	Deny	Allow	Allow	Allow
Configuration > NE_Model > Create MS-SPRing	Deny	Allow	Allow	Allow
Configuration > NE_Model > NE Discrepancy table	Deny	Allow	Allow	Allow
Configuration > NE_Model > Discovery Info table	Deny	Allow	Allow	Allow
Configuration > NE_Model > Rediscover	Deny	Allow	Allow	Allow
Configuration > NE_Model > Rediscover All	Deny	Allow	Allow	Allow
Configuration > NE_Model > Launch CiscoView	Deny	Allow	Allow	Allow
Configuration > NE_Model > Launch IOS CLI	Deny	Allow	Allow	Allow
Configuration > NE_Model > Domain 1580X table	Deny	Allow	Allow	Allow
Administration > Job Monitor	Deny	Allow	Deny	Deny
Administration > Service Monitor	Allow	Deny	Deny	Deny
Administration > Self Monitor	Deny	Allow	Deny	Deny
Administration > Memory Backup	Deny	Allow	Deny	Deny
Administration > Memory Restore	Deny	Allow	Deny	Deny
Administration > Compare Config Files	Deny	Allow	Deny	Deny
Administration > Software Download	Deny	Allow	Deny	Deny
Administration > Image Upload	Deny	Allow	Deny	Deny
Administration > NE Software table	Deny	Allow	Deny	Deny
Administration > SNTP Configuration	Deny	Allow	Deny	Deny
Administration > CTM Users	Allow	Deny	Deny	Deny
Administration > GateWay/TL1 Users	Allow	Deny	Deny	Deny
Administration > Control Panel	Allow	Deny	Deny	Deny
Administration > Audit Log	Allow	Deny	Deny	Deny
Administration > Error Log	Allow	Allow	Deny	Deny
Administration > Supported NE table	Allow	Allow	Deny	Deny
Administration > CTC Upgrade table	Allow	Allow	Deny	Deny
Administration > NE_Model > NE User Access Administration	Allow	Allow	Deny	Deny
Administration > NE_Model > Audit Trail table	Allow	Allow	Deny	Deny
Administration > NE_Model > Security Advisory Management	Allow	Allow	Deny	Deny
Administration > NE_Model > NE Authentication	Allow	Allow	Deny	Deny
Administration > NE_Model > IOS Users table	Deny	Allow	Allow	Deny
Administration > ONS 155XX > ONS 155XX SNMP Settings table	Allow	Allow	Deny	Deny
Administration > ONS 155XX > Flash File table	Allow	Allow	Deny	Deny
Administration > ONS 1580X > NE User Access Log	Allow	Allow	Deny	Deny
Network Map
File > Open	Deny	Allow	Allow	Allow
File > Parent	Deny	Allow	Allow	Allow
File > Save	Deny	Allow	Allow	Allow
File > Save As Default	Deny	Allow	Deny	Deny
File > Revert To Default	Deny	Allow	Allow	Allow
File > Notify Users	Deny	Allow	Allow	Allow
File > Refresh Data	Deny	Allow	Allow	Allow
File > Debug Options	Deny	Allow	Allow	Allow
Edit > Enable Drag	Deny	Allow	Allow	Allow
Edit > Enable Offview	Deny	Allow	Allow	Allow
Edit > Change Map Background	Deny	Allow	Allow	Allow
Edit > Change Node Icon	Deny	Allow	Allow	Allow
Edit > Zoom In	Deny	Allow	Allow	Allow
Edit > Zoom Out	Deny	Allow	Allow	Allow
Edit > Zoom Area	Deny	Allow	Allow	Allow
Edit > Expand All Links	Deny	Allow	Allow	Allow
Edit > Collapse All Links	Deny	Allow	Allow	Allow
Edit > Circular Layout	Deny	Allow	Allow	Allow
Edit > Spring Layout	Deny	Allow	Allow	Allow
Edit > Table Layout	Deny	Allow	Allow	Allow
Edit > Declutter Layout	Deny	Allow	Allow	Allow
Configuration > Delete Link	Deny	Allow	Allow	Deny
Configuration > Modify Link	Deny	Allow	Allow	Deny
Subnetwork Explorer
File > Add New Network Partition	—	Allow	—	—
File > Add New Subnetwork	—	Allow	—	—
Alarm Browser
Fault > Acknowledge Alarms	Allow	Allow	Allow	Allow
Fault > Acknowledge All Alarms	Allow	Allow	Allow	Allow
Fault > Clear Alarm(s)	Allow	Allow	Allow	Allow
Fault > Show Alarm Note	Allow	Allow	Allow	Allow
Fault > Hide Cleared Alarms	Allow	Allow	Allow	Allow
Fault > Hide Acknowledged Alarms	Allow	Allow	Allow	Allow
Fault > Reset All Alarms	Allow	Allow	Allow	Allow
Fault > Locate Alarm/Event	Allow	Allow	Allow	Allow
Link Table
Edit > Modify Link	—	Allow	Allow	Deny
Edit > Delete Link	—	Allow	Allow	Deny
Configuration > Circuit Path table	—	Allow	Allow	Deny
Configuration > Link Utilization table	—	Allow	Allow	Deny
BLSR Table
Edit > Edit BLSR	Deny	Allow	Allow	Allow
Edit > Delete BLSR	Deny	Allow	Allow	Allow
Edit > Upgrade BLSR	Deny	Allow	Allow	Allow
Edit > Exercise BLSR	Deny	Allow	Allow	Allow
L2 Topology Table
Configuration > Circuits	—	Allow	Allow	Allow
Configuration > Create L2 Topology	—	Allow	Allow	Deny
Configuration > Modify L2 Topology	—	Allow	Allow	Deny
Configuration > Delete L2 Topology	—	Allow	Allow	Deny
Configuration > Create L2 Service	—	Allow	Allow	Deny
Configuration > Show L2 Services	—	Allow	Allow	Allow
Configuration > Modify Ports	—	Allow	Allow	Deny
Configuration > Enable L2 Service	Deny	Allow	Allow	Deny
Add/Remove ML Card(s)	Deny	Allow	Allow	Deny
L2 QoS Template Table
Configuration > Create QoS Profile	Deny	Allow	Allow	Deny
Configuration > Modify QoS Profile	Deny	Allow	Allow	Deny
Configuration > Delete QoS Profile	Deny	Allow	Allow	Deny
Configuration > Show QoS Profile	Deny	Allow	Allow	Allow
Circuit Table
Configuration > Open Circuit Span	—	Allow	Allow	Allow
Configuration > Create Circuit	—	Allow	Allow	Deny
Configuration > Modify Circuit	—	Allow	Allow	Deny
Configuration > Delete Circuit	—	Allow	Allow	Deny
Configuration > Trace Circuit	—	Allow	Allow	Allow
Configuration > VLAN table	—	Allow	Allow	Allow
Configuration > Show Circuit Note	—	Allow	Allow	Allow
Configuration > Roll Circuit	—	Allow	Allow	Deny
Configuration > Member Circuits	Allow	Allow	Allow	Allow
Configuration > Merge Circuit	—	Allow	Allow	Deny
Configuration > Reconfigure Circuit	—	Allow	Allow	Deny
MS-SPRing Table
Edit > Edit MS-SPRing	Deny	Allow	Allow	Allow
Edit > Delete MS-SPRing	Deny	Allow	Allow	Allow
Edit > Upgrade MS-SPRing	Deny	Allow	Allow	Allow
Edit > Exercise MS-SPRing	Deny	Allow	Allow	Allow
Rolls Table
Configuration > Complete Roll	—	Allow	Allow	Deny
Configuration > Finish Roll	—	Allow	Allow	Deny
Configuration > Cancel Roll	—	Allow	Allow	Deny
Configuration > Delete Roll	—	Allow	Allow	Deny
Job Monitor Table
Edit > Cancel Task	—	Allow	—	—
Edit > Cancel Job	—	Allow	—	—
Edit > User Note	—	Allow	—	—
Edit > NE Software table	—	Allow	—	—
NE Software Table
Edit > Commit	—	Allow	—	—
Edit > Revert/Switch	—	Allow	—	—
Edit > Accept	—	Allow	—	—
CTM Users
Edit > Create	Allow	—	—	—
Edit > Modify	Allow	—	—	—
Edit > Delete	Allow	—	—	—
Edit > Unlock	Allow	Deny	Deny	Deny
Administration > CTM User Profiles	Allow	Deny	Deny	Deny
Administration > Logged In CTM Users	Allow	Deny	Deny	Deny
CTM User Profiles
Edit > Create	Allow	Deny	Deny	Deny
Edit > Modify	Allow	Deny	Deny	Deny
Edit > Delete	Allow	Deny	Deny	Deny
Edit > Duplicate	Allow	Deny	Deny	Deny
Logged In CTM Users Table
Administration > Log Out User	Allow	Deny	Deny	Deny
GateWay/TL1 Client Configuration Table
Edit > Add	Allow	Deny	Deny	Deny
Edit > Modify	Allow	Deny	Deny	Deny
Edit > Delete	Allow	Deny	Deny	Deny
Administration > Logged In GateWay TL1 Users	Allow	Deny	Deny	Deny
Administration > GW/TL1 EFD table1	Allow	Deny	Deny	Deny
CTM Active GWTL1 Users Table
Administration > Log Out GateWay TL1 User	Allow	Deny	Deny	Deny
GW/TL1 Event Forwarding Discriminator Table
Edit > Add EFD Profile	Allow	Deny	Deny	Deny
Edit > Modify EFD Profile	Allow	Deny	Deny	Deny
Edit > Delete EFD Profile	Allow	Deny	Deny	Deny
Supported NE Table
Edit > Add	Allow	Allow	—	—
Edit > Delete	Allow	Allow	—	—
CTC Upgrade Table
Edit > Add	Allow	Allow	—	—
Edit > Activate	Allow	Allow	—	—
Edit > Delete	Allow	Allow	—	—
NE User Access Administration
Edit > Add	Allow	Allow	—	—
Edit > Add Predefined Users	Allow	Allow	—	—
Edit > Modify	Allow	Allow	—	—
Edit > Delete	Allow	Allow	—	—
Edit > NE Active Users	Allow	Allow	—	—
NE Active Users Table
Administration > Log Out User	Deny	Allow	Deny	Deny
Administration > NE Users Access Activity Log (ONS 1580x only)	Deny	Allow	Deny	Deny
IOS Users Table
Edit > Create	Deny	Allow	Allow	Deny
Edit > Modify	Deny	Allow	Allow	Deny
Edit > Delete	Deny	Allow	Allow	Deny
SNMP Community String
Edit > Add	Allow	Allow	—	—
Edit > Delete	Allow	Allow	—	—
Edit > Modify	Allow	Allow	—	—
Flash File Table
Edit > Verify	Allow	Allow	—	—
Edit > Delete	Allow	Allow	—	—
Edit > Undelete	Allow	Allow	—	—
Edit > Squeeze	Allow	Allow	—	—
Edit > Activate	Allow	Allow	—	—

1 GW/TL1 Event Forwarding Discriminator table

8.3.2.1  Viewing the CTM Users Table

The CTM Users table displays basic information about CTM users. The table menu options allow you to create new users, modify users, delete users, and unlock user accounts.

To view the CTM Users table, choose Administration > CTM Users in the Domain Explorer window. Table 8-3 describes the fields in the table.

---

Tip You can click any cell or row in the CTM Users table and then type an alphanumeric character on your keyboard. The selection context jumps to the next username row that starts with that letter or number.

If there are multiple usernames that begin with the same letter or number, the selection context cycles through them. For example, if the CTM Users table contains SuperUser and SysAdmin users, and you press the s key multiple times, the selected row toggles between SuperUser and SysAdmin.

---

Table 8-3 Field Descriptions for the CTM Users Table 

Field	Description
Username	Username of the selected CTM user.
CTC Username	CTC username of the selected user. This is used for launching CTC from CTM.
User Privilege	User privilege level (SuperUser, SysAdmin, NetworkAdmin, Provisioner, Operator, or a custom profile).
User Domain	Name of the management domain where the username belongs.
Password Set Time (time zone)	Last time the password was set.
Locked State	Whether the user's account is locked or unlocked. If the user repeatedly attempts unsuccessfully to log into the CTM client (the default maximum is 5 attempts), the user's account is locked automatically. You can set the maximum number of login attempts a user is allowed before being locked out in the Control Panel > Security Properties pane.
Last Login Time (time zone)	Last time the user logged in.
Failed Attempts	Number of times the user tried to log in, but failed.
Login State	Administrative state (Enabled or Disabled) of the user.
Description	Description of the user.
Password Change	Current state (Enabled or Disabled) of the password change option.
Multiple Login	Whether this user is allowed to perform multiple logins simultaneously.

8.3.2.2  Creating a CTM User

Use the Create New CTM User wizard to add new CTM users to the domain. Table 8-4 describes the fields in the wizard.

---

Step 1 In the Domain Explorer window, choose Administration > CTM Users.

Step 2 In the CTM Users table, choose Edit > Create (or click the Create a New User tool).

Step 3 In the Create New CTM User wizard, enter the following information:

•Username

•User password (and confirm password)

•User privilege

•Domain name

•Login state

•Password change

•Description

•Autodisable account

•Require Password Change on Next Login check box

•Use Global Settings check box

•Enable check box

•Period

•User login sessions

Step 4 Click Next. When you are finished adding a new SuperUser, NetworkAdmin, or SysAdmin, you can click Finish.

Step 5 When adding a new Provisioner, Operator, or custom user profile, select the groups and NEs that the Provisioner or Operator will monitor. Selected groups and NEs appear in the Assigned Objects list. (SuperUsers and NetworkAdmins monitor the entire management domain, so there is no need to select groups or NEs when adding one of these users. SysAdmin users do not access any of the NEs.)

a. To assign groups, click the Groups radio button. In the Available Objects list, select the groups that will be assigned to the new user and click Add.

b. To assign NEs, click the Network Elements radio button. In the Available Objects list, select the NEs that will be assigned to the new user and click Add.

---

Note When individual NEs are assigned, these NEs will appear directly under the top level domain for the user in the Domain Explorer. It is possible that a given NE may have already been assigned as part of a group assignment to the user. In such a case, the same NE will appear directly under the top level domain and also within the assigned group. This behavior is consistent with the Domain Explorer's ability to represent the same group or NE within multiple locations of the hierarchy.

---

c. To remove groups or NEs from the Assigned Objects list, select the group or NE from the Assigned Objects list and click Remove.

d. Click Next (or Finish).

Step 6 When adding a new Provisioner, you can restrict the set of SONET or SDH circuit sizes that the user can provision. The selected SONET or SDH circuit sizes appear in the Assigned Circuit Sizes list.

a. To assign SONET circuits, click the SONET radio button. In the Available Circuit Sizes list, select the circuits that will be assigned to the user and click Add.

b. To assign SDH circuits, click the SDH radio button. In the Available Circuit Sizes list, select the circuits that will be assigned to the user and click Add.

c. To remove SONET or SDH circuits from the Assigned Circuit Sizes list, select the circuit size from the Assigned Circuit Sizes list and click Remove.

d. click Next (or Finish).

Step 7 (Optional) In the CTC/Craft User Properties area, enter the username and password for accessing CTC-based NEs or NEs that support a TL1 interface. Then, confirm the password.

---

Note If the CTC/Craft User username and password have been defined for a given user, when that user launches a TL1 session to an NE that supports a TL1 interface, CTM logs the user in automatically with the ACT-USER command using the defined craft username and password.

---

Step 8 Click Finish.

The new user is listed in the CTM Users table. For CTC-based NEs, the new user will be mapped to a CTC user but the CTC user will not be created in the NE database. To create a CTC user on the NE database, see Managing NE User Access.

---

Table 8-4 Field Descriptions for the Create New CTM User Wizard 

Field	Description
User Properties Pane
Username	Name that the user will use to access the system. The CTM username must contain from six to twelve alphanumeric characters (A-Z, a-z, 0-9). Alphabetic characters are case-sensitive. The username must be unique in CTM and cannot contain a space or a special character. Note After the username is set, it cannot be changed without deleting the user.
User Password	Login password that the user will use to access the system. The password complexity is configurable in the Control Panel > Security Properties pane. By default, the user password must: •Contain at least six characters, but not more than 12 characters. •Contain at least two alphabetic characters (A-Z, a-z). Of the alphabetic characters, at least one must be uppercase and one must be lowercase. •Contain at least one numeric character (0-9). •Contain at least one special character (+ # % , . ; & !). The default special character set is TL1+UNIX. •Allow a special character as the first or last character. •Allow a numeric character as the first or last character. •Not contain the username or any circular shift of the username. An uppercase letter and its corresponding lowercase letter are considered equivalent. For example, if the username is Arthur, the password cannot contain the string arthur, rthura, thurar, hurart, urarth, or rarthu. •Differ from the old password by at least three characters. For example, if the old password is MikeBrady5!, the new password cannot be mikebrady5% because only the last character is different. However, the new password MikeBrady2!99 is acceptable because it differs from MikeBrady5! by three characters. Note By default, the minimum time between password changes is 20 days. The new password must differ from the previous password by 3 characters, and the new password is compared against the previous 5 passwords.
Confirm Password	Retype the password to confirm it.
User Privilege	User privilege level. Note After the user privilege is set, it cannot be changed without deleting the user.
Domain Name	Domain name. When the user logs into the system, he or she sees all of the devices contained within this domain.
Login State	Permit (enable) or prevent (disable) the user from logging into the system.
Password Change	Permit (enable) or prevent (disable) the user from changing his or her password.
Description	Description of the new user.
Autodisable Account	Number of days of nonuse that will prompt the account to be disabled automatically. The range is 0 to 365 days in 1-day increments. The default is 0 days, meaning the account will not be disabled automatically as a result of inactivity.
Require Password Change on Next Login	If checked, the user is prompted to change his or her password upon next login to the CTM client. If unchecked, the user is not required to change his or her password upon next login. By default, this option is checked.
Lockout	CTM automatically locks the current session after the period in the Period field. Click Use Global Settings to use the settings from the Security window. If you do not select Use Global Settings, click Enable to activate lockout for the selected user. Enter a lockout length in the Period field.
Logout	CTM automatically logs the user out of the CTM session after the period in the Period field. Click Use Global Settings to use the settings from the Security window. If you do not select Use Global Settings, click Enable to activate logout for the selected user. Enter a logout length in the Period field.
User Login Sessions	Select whether to allow single or multiple user logins.
Assign Objects to User Pane (for Provisioner and Operator users only)
Select Object Type	Assign groups or NEs to the new user. Note The Discovered NEs and Deleted NEs groups cannot be assigned to a Provisioner, Operator, or custom user profile.
Select Objects	Select from the list of available objects that can be assigned to the new user. By clicking the Add and Remove buttons, you can move objects back and forth between the Available Objects list and the Assigned Objects list.
Assign Circuit Sizes to User Pane (for Provisioner users only)
Select Circuit Size Type	Select the circuit types that are relevant, SONET or SDH.
Select Circuit Sizes	Select valid circuit sizes from the list of available circuit sizes. By clicking the Add and Remove buttons, you can move objects back and forth between the Available Circuit Sizes list and the Assigned Circuit Sizes list.
CTC/Craft User Properties Pane
Username	Active username for accessing CTC-based NEs or NEs that support a TL1 interface. The username must contain at least six alphanumeric characters, but not more than 20 characters.
User Password	Login password for accessing CTC-based NEs or NEs that support a TL1 interface. The new password must: •Contain at least 6 alphanumeric characters, but not more than 10. •Contain at least two alphabetic characters (A-Z, a-z). •Contain at least one numeric character (0-9). •Contain at least one special character (+, #, or %).
Confirm Password	Retype the password to confirm it.

---

Note See Table 1-19 on page 1-38 for the descriptions of the actions that can be performed using the buttons at the bottom of the window.

---

8.3.2.3  Modifying a CTM User's Properties

Use the Modify CTM User Properties wizard to modify the properties of an existing CTM user. Table 8-5 describes the fields in the wizard.

---

Step 1 In the Domain Explorer window, choose Administration > CTM Users.

Step 2 In the CTM Users table, select the CTM user whose user properties will be modified.

Step 3 Choose Edit > Modify (or click the Modify User Properties tool). The Modify CTM User Properties wizard opens.

Step 4 Modify the following information, as needed; then, click Next:

•User password (and confirm password)

•Domain name

•Login state

•Password change

•Description

•Autodisable account

•Require Password Change on Next Login check box

•Use Global Settings check box

•Enable check box

•Period

•User login sessions

Step 5 (Optional) For Provisioner, Operator, and custom user profiles, modify the list of assigned objects by adding groups or NEs to the Assigned Objects list or removing groups or NEs from the list. Click Next.

Step 6 (Optional) For Provisioners, modify the list of assigned circuit sizes by adding or removing SONET or SDH circuit sizes from the list. Click Next.

Step 7 (Optional) Modify the user's CTC/craft username and password for accessing CTC-based NEs or NEs that support a TL1 interface. For username and password constraints, see Table 8-5.

Step 8 Click Finish. The user whose properties were modified is listed in the CTM Users table.

---

Table 8-5 Field Descriptions for the Modify CTM User Properties Wizard 

Field	Description
Cisco Transport Manager User Properties Pane
Username	(Read-only) Active username for accessing the system. The CTM username must contain from six to twelve alphanumeric characters (A-Z, a-z, 0-9). Alphabetic characters are case-sensitive. The username must be unique in CTM and cannot contain a space or a special character. Note After the username is set, it cannot be changed without deleting the user.
User Password	Login password used to access the system. The password complexity is configurable in the Control Panel > Security Properties pane. By default, the user password must: •Contain at least six characters, but not more than 12 characters. •Contain at least two alphabetic characters (A-Z, a-z). Of the alphabetic characters, at least one must be uppercase and one must be lowercase. •Contain at least one numeric character (0-9). •Contain at least one special character (+ # % , . ; & !). The default special character set is TL1+UNIX. •Allow a special character as the first or last character. •Allow a numeric character as the first or last character. •Not contain the username or any circular shift of the username. An uppercase letter and its corresponding lowercase letter are considered equivalent. For example, if the username is Arthur, the password cannot contain the string arthur, rthura, thurar, hurart, urarth, or rarthu. •Differ from the old password by at least three characters. For example, if the old password is MikeBrady5!, the new password cannot be mikebrady5% because only the last character is different. However, the new password MikeBrady2!99 is acceptable because it differs from MikeBrady5! by three characters. Note By default, the minimum time between password changes is 20 days. The new password must differ from the previous password by 3 characters, and the new password is compared against the previous 5 passwords.
Confirm Password	Retype the password to confirm it.
User Privilege	(Read-only) User's privilege level. Note The user privilege level cannot be modified without deleting the user.
Domain Name	Domain name. When the user logs into the system, he or she sees all the devices contained within this domain.
Login State	Permit (enable) or prevent (disable) the user from logging into the system.
Password Change	Permit (enable) or prevent (disable) the user from changing his or her password.
Description	User description.
Autodisable Account	Number of days of nonuse that will prompt the account to be disabled automatically. The range is 0 to 365 days in 1-day increments. The default is 0 days, meaning the account will not be disabled automatically as a result of nonuse.
Require Password Change on Next Login	If checked, the user is prompted to change his or her password upon next login to the CTM client. If unchecked, the user is not required to change his or her password upon next login. By default, this option is checked.
Lockout	CTM automatically locks the current session after the number of minutes in the Period field. Click Use Global Settings to use the settings from the Security window. If you do not select Use Global Settings, click Enable to activate lockout for the selected user. Enter a lockout length in the Period field.
Logout	CTM automatically logs the user out of the CTM session after the number of minutes in the Period field. Click Use Global Settings to use the settings from the Security window. If you do not select Use Global Settings, click Enable to activate logout for the selected user. Enter a logout length in the Period field.
User Login Sessions	Whether to allow single or multiple user login.
Assign Objects to User Pane (for Provisioner and Operator users only)
Select Object Type	Assign specific groups and NEs to operator and provisioner users.
Select Objects	Modify the objects that are assigned to operators and provisioners. Click Add and Remove to move objects back and forth between the Available Objects list and the Assigned Objects list.
Assign Circuit Sizes to User Pane (for Provisioner users only)
Select Circuit Size Type	Select the circuit types that are relevant, SONET or SDH.
Select Circuit Sizes	Modify the circuit sizes that are assigned to the user. Click Add and Remove to move circuit sizes back and forth between the Available Circuit Sizes list and the Assigned Circuit Sizes list.
CTC/Craft User Properties Pane
Username	Modify the active username for accessing CTC-based NEs or NEs that support a TL1 interface. The username must contain at least six alphanumeric characters, but not more than 20 characters.
User Password	Modify the user's login password. The user password must: •Contain at least 6 alphanumeric characters, but not more than 10. •Contain at least two alphabetic characters (A-Z, a-z). •Contain at least one numeric character (0-9). •Contain at least one special character (+, #, or %).
Confirm Password	Confirm the newly modified password by retyping it.

---

Note See Table 1-19 on page 1-38 for the descriptions of the actions that can be performed using the buttons at the bottom of the window.

---

8.3.2.4  Deleting a CTM User

---

Step 1 In the Domain Explorer window, choose Administration > CTM Users.

Step 2 In the CTM Users table, select the user to be deleted.

---

Note A user cannot be deleted from the database until that user logs out. However, an active user session can be ended. See Ending an Active CTM User Session.

---

Step 3 Choose Edit > Delete (or click the Delete User tool).

Step 4 Click OK to remove the user from the database.

---

8.3.2.5  Viewing Logged In CTM Users

The Logged In CTM Users table lists the CTM users who are currently logged into the CTM application.

---

Step 1 In the Domain Explorer window, choose Administration > CTM Users.

Step 2 In the CTM Users table, choose Administration > Logged In CTM Users. Table 8-6 describes the fields in the table.

---

Table 8-6 Field Descriptions for the Logged In CTM Users Table 

Field	Description
Username	Name of the user who is currently logged in.
Logged in At	Date and time when the user logged in.
IP Address	User's IP address.
Session ID	Unique session ID number that the CTM server assigns to each CTM user during login.

8.3.2.6  Ending an Active CTM User Session

---

Step 1 In the Domain Explorer window, choose Administration > CTM Users.

Step 2 In the CTM Users table, choose Administration > Logged In CTM Users.

Step 3 In the Logged In CTM Users table, select the user whose session will be ended and choose Administration > Log Out User (or click the Log Out User tool).

Step 4 Click Yes at the following prompt:

This operation will log out the selected CTM user. The process will take approximately 
1 minute and this CTM client will be unusable until then. Do you wish to continue?

Wait while the CTM server logs out the selected CTM client. The CTM GUI is frozen for approximately 1 minute until the request is complete.

---

8.3.2.7  Using the CTM Locked Window

Use the CTM Locked window to lock the current CTM session. Once the session is locked, the Domain Explorer disappears, and the CTM Locked window prompts you to enter your password to unlock the CTM session. You can attempt login up to the configured maximum login attempts to unlock the session. If the threshold is exceeded, CTM will terminate. Table 8-7 describes the field in the CTM Locked window.

Table 8-7 Field Descriptions for the CTM Locked Window 

Field	Description
Password	Enter your password; then, click Unlock to unlock the CTM session.

8.3.2.8  Unlocking a User Account

By default, CTM allows users a maximum of five login attempts; the user account is locked after the fifth unsuccessful login attempt. The lockout duration is configurable and can be from 0 to 600 seconds or infinite.

---

Step 1 In the Domain Explorer window, choose Administration > CTM Users.

Step 2 In the CTM Users table, select the locked user.

Step 3 Choose Edit > Unlock (or click the Unlock User tool).

---

8.3.2.9  Changing Your User Password

CTM users can use the Change Password dialog box to change their CTM and CTC passwords. The password change applies to the CTM user who is currently logged in. There is an enforced password change request when the default user logs in for the first time. If the user does not change the password, the CTM session is canceled.

---

Note The password complexity is configurable in the Control Panel > Security Properties pane.

---

Table 8-8 describes the fields in the Change Password dialog box.

---

Step 1 In the Domain Explorer window, choose Edit > Change Password.

Step 2 To change the CTM password:

a. In the CTM Password area, enter the current CTM password in the Old Password field.

b. Enter the new password in the New Password field. For CTM password constraints, see Table 8-8.

c. Confirm the new password.

d. Click OK.

Step 3 To change the CTC password:

a. In the CTC Password area, enter the new CTC password in the New Password field. For CTC password constraints, see Table 8-8.

b. Confirm the new password.

c. Click OK.

d. To apply the new CTC password on the NE, see Managing NE User Access.

---

Table 8-8 Field Descriptions for the Change Password Dialog Box 

Field	Description
CTM Password
Old Password	Enter the old CTM user password.
New Password	Enter the new login password. The password complexity is configurable in the Control Panel > Security Properties pane. By default, the new password must: •Contain at least six characters, but not more than 12 characters. •Contain at least two alphabetic characters (A-Z, a-z). Of the alphabetic characters, at least one must be uppercase and one must be lowercase. •Contain at least one numeric character (0-9). •Contain at least one special character (+ # % , . ; & !). The default special character set is TL1+UNIX. •Allow a special character as the first or last character. •Allow a numeric character as the first or last character. •Not contain the username or any circular shift of the username. An uppercase letter and its corresponding lowercase letter are considered equivalent. For example, if the username is Arthur, the password cannot contain the string arthur, rthura, thurar, hurart, urarth, or rarthu. •Differ from the old password by at least three characters. For example, if the old password is MikeBrady5!, the new password cannot be mikebrady5% because only the last character is different. However, the new password MikeBrady2!99 is acceptable because it differs from MikeBrady5! by three characters. Note By default, the minimum time between password changes is 20 days. The new password must differ from the previous password by 3 characters, and the new password is compared against the previous 5 passwords.
Confirm Password	Retype the password to confirm it.
CTC Password
New Password	Enter the new login password. The new password must: •Contain at least 6 alphanumeric characters, but not more than 10. •Contain at least two alphabetic characters (A-Z, a-z). •Contain at least one numeric character (0-9). •Contain at least one special character (+, #, or %).
Confirm Password	Retype the password to confirm it.

---

Caution Do not change the CTM and CTC passwords at the same time in the Change Password dialog box.

---

---

Tip It is possible to set up the user account such that the change password function is disabled. See the description of the Password Change field in Creating a CTM User.

---

---

Note See Table 1-19 on page 1-38 for the descriptions of the actions that can be performed using the buttons at the bottom of the window.

---

8.3.2.10  Managing Security Advisory Messages

Use the Security Advisory Message Management wizard to choose an NE from which a security advisory message can be loaded. The wizard then provides you with a list of NEs where the user can download this security message. When you click Finish, CTM schedules a job for this action, and the security message downloaded to each selected NE is tracked as a separate task on the Job Monitor table.

Table 8-9 describes the fields in the wizard.

---

Step 1 In the Domain Explorer window, choose Administration > CTC-based NEs > Security Advisory Management. The Security Advisory Message Management window opens.

Step 2 Select the NE where the security advisory message exists.

Step 3 Click the Text tab to view the existing security advisory message on the selected NE. If no message exists, you can use this field to enter a new message.

Step 4 Click Next.

Step 5 Use the Add and Remove buttons to move NEs to or from the Selected NE(s) field.

Step 6 Click Finish.

---

---

Note You can also use the NE Explorer node view to set the security advisory message for CTC-based NEs. In the node properties pane, click the Security tab. In the Legal Disclaimer subtab, there is a default advisory message that is noncustomer-specific. Change the text if you want the disclaimer to be specific for your company. In the Preview subtab, you can view the advisory message before saving it. Click Apply.

---

Table 8-9 Field Descriptions for the Security Advisory Message 

Field	Description
Select an NE to View the Security Advisory Message Pane
Select NE	NE where the security advisory message exists. Note If you opened the Security Advisory Message Management wizard after selecting an NE, only that NE will appear in this list.
Text	Security advisory message present on the selected NE. If no message exists, you can use this tab to enter a new message. You can use the following HTML commands to format the text: <b> Begins boldface font </b> Ends boldface font <center> Aligns type in the center of the window </center> Ends the center alignment <font=n, where n = point size> Changes the font to the new size </font> Ends the font size command <p> Creates a line break <sub> Begins subscript </sub> Ends subscript <sup> Begins superscript </sup> Ends superscript <u> Starts underline </u> Ends underline
Preview	View the advisory message before saving it.
Save the Security Advisory Message Pane
Available NE(s)	Select one or more NEs in the Available NEs field and click Add to move them to the Selected NE(s) field. The advisory message is saved for the NEs in the Selected NE(s) list.
Selected NE(s)	Select one or more NEs in the Selected NE(s) field and click Remove to move them to the Available NE(s) field.

---

Note See Table 1-19 on page 1-38 for the descriptions of the actions that can be performed using the buttons at the bottom of the window.

---

8.3.2.11  Setting User Preferences

Use the User Preferences dialog box to configure the CTM user interface.

---

Step 1 In the Domain Explorer window, choose Edit > User Preferences. The User Preferences dialog box opens. Table 8-10 describes the fields in the dialog box.

Step 2 After specifying the settings, check the Save current settings check box to preserve the current settings even after logging out. Users with the appropriate privileges can check the Save as the default user template check box to save the current settings as the default for new users who are added in the future. Current users who have not altered their default settings adopt the new default settings when they log out.

Step 3 Click OK to save the settings. After you save the selections, all subsequent views use the saved preferences.

---

Table 8-10 Field Descriptions for the User Preferences Dialog Box 

Field	Description
Event Notification Tab
Show Notification Dialog For	Select whether an alert popup displays when a specific alarm or event occurs on NEs in your management domain or on the EMS. You can specify the alarm severity that will generate an alert popup, and whether to include cleared alarms. Note Selections that apply to NEs are allowed only if you have NEs assigned to you. Selections that apply to the EMS are allowed only if you have the appropriate user privilege.
Play Audible Notification For	Select whether an audible alert sounds when a specific alarm or event occurs on an NE or on the CTM application. You can specify the alarm severity that will generate an audible alert, and whether to include cleared alarms. Check the Continuous Alarm for Dashboard Notifications check box to enable continuous audible notification whenever a new update occurs in the Dashboard window. Uncheck this check box to disable continuous audible notifications. Note Selections that apply to NEs are allowed only if you have NEs assigned to you. Selections that apply to the EMS are allowed only if you have the appropriate user privilege.
Miscellaneous Tab
Time Zone for Date/Time Display	Change the time zone selection. You can select one of the following: •Local—Displays time information adjusted for the time zone that is configured on the PC or workstation where the CTM client is running. •GMT—Displays time information (for example, alarm time stamps) according to the GMT time zone. •User Defined—Specify a fixed offset from GMT. The offset range is -12 to +13 hours from GMT, in one-hour increments. For offsets other than zero, specify a display string of four characters maximum (to indicate the time zone, for example).
Display Log/15-min PM Data	Change the time period used to display time-sensitive data in 15-minute increments. Note This field is visible only if you have read permission for the Performance Monitor operation. Note If you change the time setting from a shorter time period to a longer time period (for example, from Past 4 Hours to Past 30 Days), you must click Refresh Data in the log window to retrieve the data, even if the Auto Refresh feature is enabled. This behavior is by design, because if there are thousands of nodes under management, it takes a long time to retrieve the data. CTM does not begin retrieving the data until you click Refresh Data manually.
Display 1 Day PM Data	Change the time period used to display time-sensitive data in 24-hour increments. Note This field is visible only if you have read permission for the Performance Monitor operation.
Don't Display User Profile Creation Warning Messages	Enable or disable the warning dialog box that pops up when you click Finish after creating or modifying a user profile. The warnings are still visible in the User Profile table.
Map Preferences Tab
Open Network Map in New Window	Within network map views, this setting specifies whether to open subsequent frames in the same window, or open a new window for subsequent map views.
Show Off View Icons	Within map views, this setting enables or disables the display of off-view icons. If an NE has a link defined to an NE on a different map, the off-view NE is represented by an off-view icon. The off-view icon serves as a hyperlink to the map that contains the NE at the opposite end of the link. Off-view icons are used only for links that terminate on an NE; off-view icons are not used for subnetworks or groups.
Minimum Icon Size	Specify a fixed and locked pixel size for icons in network maps. Choices are 8x8, 16x16, 24x24, and 32x32. Regardless of the zoom level, the map icon size does not change when it is set to a fixed size. By default, the icon size is variable based on the zoom level. The icon size setting is saved with the other map settings.
FM Preferences Tab
Color Entire Row in Table View	Set the Alarm Browser or Alarm Log to full background color for the entire selected row. The color corresponds to the alarm status and severity.

8.3.2.12  Enabling or Disabling the Continuous Audible Alarm

---

Step 1 In the Domain Explorer window, choose Edit > User Preferences. The User Preferences dialog box opens.

Step 2 In the Event Notification tab > Play Audible Notification For area, check the Continuous Alarm For Dashboard Notifications check box.

Step 3 Click OK.

Step 4 To disable the continuous audible alarm, choose Fault > Stop Continuous Beep in the Domain Explorer window.

---

8.3.2.13  Configuring CTM Security Parameters

Use the Security Properties pane to configure CTM security parameters and password complexity rules. You can also specify usernames and passwords for the ONS 15216 EDFA2, ONS 15216 EDFA3, ONS 15216 OADM, ONS 15310, ONS 15327, ONS 15454 SONET, ONS 15454 SDH, ONS 155xx, ONS 15600 SONET, ONS 15600 SDH, ONS 1580x, and Cisco CRS-1.

---

Note Passwords that are already in the system are not affected by modification(s) to the password complexity rules. The password complexity rules are checked when:

•A privileged user adds a new user to the system

•A privileged user modifies an existing user's password

•A user changes his or her own existing password

---

---

Step 1 In the Domain Explorer window, choose Administration > Control Panel.

Step 2 Click Security Properties and set the parameters described in Table 8-11.

Step 3 Click Save.

---

Table 8-11 Field Descriptions for the Security Properties Pane 

Field	Description
CTM Security Tab
Password Aging	Number of days before the password expires. The user is prompted to change the password after the specified number of days. The range is 0 to 999 days; the default is 30 days. A value of 0 disables this feature.
Password Expiration Early Notification	Allows you to configure an early warning period for password expiration. Enter the number of days before the warning in the Password Expiration Early Notification field. CTM supports values of 0 to (password aging - 1), with a maximum of 30. For example, if the password aging is configured for 30 days, the maximum early notification value would be 29 days. A value of 0 disables this feature.
Max Retries	Maximum number of login attempts a user is allowed before being denied access. The range is 0 to 10 retries; the default is 5 retries. A value of 0 disables this feature. Note When the number of login attempts is exceeded for a given user, CTM generates an alarm. Alarm information includes the username and IP address of the client workstation where the final login attempt was made.
Infinite	Enable or disable infinite user lockout. If checked, CTM does not automatically re-enable the account, but always requires the intervention of a user with the appropriate user profile to re-enable.
Login Disable Period	Number of seconds a user's login is disabled after the maximum login retries value is exceeded. The range is 0 to 600 seconds; the default is 30 seconds. A value of 0 disables this feature and the Max Retries feature. For example, if the maximum number of retries is 5 and the login disable period is 30 seconds, the user account will be disabled for 30 seconds after the fifth failed login attempt. Note If you check the Infinite check box, the Login Disable Period field is grayed out. The user will not be allowed to log in until that user's login state is re-enabled from the CTM Users table.
Enable CTM Security Advisory Message	If checked, the advisory message that appears on login is enabled. Uncheck to disable the login advisory message.
Lockout Enable	If checked, CTM automatically locks the current session after the period in the Lockout Period field. Note If both Lockout Enable and Logout Enable are checked, logout only occurs after the lockout period.
Lockout Period	Number of minutes a user's CTM session is inactive before CTM automatically locks the user out. The range is 0 to 120 minutes in 1-minute increments; the default is 30 minutes. A value of 0 disables this feature.
Logout Enable	If checked, CTM automatically logs the user out of the CTM session after the period in the Logout Period field.
Logout Period	Number of minutes a user's CTM session is inactive before CTM automatically logs the user out. The range is 0 to 1440 minutes in 1-minute increments. A value of 0 disables this feature.
CTM Password Rules Tab
Interval Between Password Change	Number of days a user must wait between password changes. The range is 0 to 99 days; the default is 20 days. A value of 0 disables this feature.
Differ From Previous Password by n Characters	Number of characters by which the new password must differ from the previous one. The range is 1 to 5 characters; the default is 3 characters.
Compare Against Previous n Passwords	Number of previously used passwords to compare against the new password. The range is 0 to 5 passwords; the default is 5 passwords. A value of 0 disables this feature.
Minimum Password Length	Minimum password length. The range is 2 to 10 characters; the default is 6 characters.
Maximum Password Length	Maximum password length. The range is 10 to 12 characters; the default is 12 characters.
Number of Alphabetic Characters	Minimum number of alphabetic characters that the password must include. The range is 0 to 2; the default is 2 alphabetic characters.
Number of Lowercase Alphabetic Characters	Minimum number of lowercase alphabetic characters that the password must include. The range is 0 to 2; the default is 1 lowercase character.
Number of Uppercase Alphabetic Characters	Minimum number of uppercase alphabetic characters that the password must include. The range is 0 to 2; the default is 1 uppercase character.
Number of Numeric Characters	Minimum number of numeric characters that the password must include. The range is 0 to 2; the default is 1 numeric character.
Number of Special Characters	Minimum number of special characters that the password must include. The range is 0 to 2; the default is 1 special character.
Special Character Set to Use	Special character set to use: •TL1—Special characters permitted are + # % •UNIX—Special characters permitted are , . ; % & ! •TL1+ UNIX—(Default) Special characters permitted are , . ; % & ! + # •ASCII—Special characters permitted are @ ` ! " # $ % & ' ( ) * : + ; [ { , < \ | - = ] } . > ^ ~ / ? _
Allow Special First or Last Character	If checked, a special character is allowed as the first or last character in the password. If unchecked, the first or last character in the password cannot be a special character.
Allow Numeric First or Last Character	If checked, a numeric character is allowed as the first or last character in the password. If unchecked, the first or last character in the password cannot be a number.
Allow User ID Circular Shift	If checked, the user ID or a circular shift of the ID can be used in the password. If unchecked, the user ID or a circular shift of the ID cannot be used in the password.
ONS 15216 EDFA2 Tab
Username	Username that the CTM server and CTM GateWay/TL1 use to connect to ONS 15216 EDFA2 NEs.
Password	Password to use for CTM server and CTM GateWay/TL1 connections to ONS 15216 EDFA2 NEs.
Confirm Password	Re-enter the password to confirm it.
ONS 15216 EDFA3 Tab
CTM Server - NE Connection Username	Username that the CTM server uses to connect to ONS 15216 EDFA3 NEs. Note The ONS 15216 EDFA3 has a TL1 interface and multiple usernames can be defined for authentication. Each username can be used for only one active connection. A second connection with the same username is not allowed. The current user must log out before another user can log in with that username.
Password	Password to use for CTM server connections to ONS 15216 EDFA3 NEs.
Confirm Password	Re-enter the password to confirm it.
GateWay/TL1 - NE Connection Username	Username that CTM GateWay/TL1 uses to connect to ONS 15216 EDFA3 NEs.
Password	Password to use for CTM GateWay/TL1 connections to ONS 15216 EDFA3 NEs.
Confirm Password	Re-enter the password to confirm it.
CTM Server - FTP Connection Username	Username that the CTM server uses to connect to FTP for software download, memory backup, and memory restore. Caution An FTP account must already exist on the server in order for the file transfer to work correctly.
Password	Password to use for CTM server connections to FTP.
Confirm Password	Re-enter the password to confirm it.
FTP Directory	Absolute path for the FTP directory, beginning with a forward slash (/).
ONS 15216 OADM Tab
CTM Server - NE Connection Username	Username that the CTM server uses to connect to ONS 15216 OADM NEs. Note The ONS 15216 OADM has a TL1 interface and multiple usernames can be defined for authentication. Each username can be used for only one active connection. A second connection with the same username is not allowed. The current user must log out before another user can log in with that username.
Password	Password to use for CTM server connections to ONS 15216 OADM NEs.
Confirm Password	Re-enter the password to confirm it.
GateWay/TL1 - NE Connection Username	Username that CTM GateWay/TL1 uses to connect to ONS 15216 OADM NEs.
Password	Password to use for CTM GateWay/TL1 connections to ONS 15216 OADM NEs.
Confirm Password	Re-enter the password to confirm it.
ONS 15310 CL, ONS 15327, ONS 15454, and ONS 15454 SDH Tabs
Username	(For the ONS 15327) Username that the CTM server and CTM GateWay/TL1 use to connect to NEs. (For the ONS 15310, ONS 15454 SONET, and ONS 15454 SDH) Username that the CTM server and CTM GateWay/TL1 use to connect to NEs. Also the username that the CTM server uses to connect to ML-series cards. Note The ONS 15454 SDH R5.0 supports a TL1 interface. For NE releases earlier than the ONS 15454 SDH R5.0, the GateWay/TL1 - NE Connection area is not applicable. Note The default username is configured as CISCO15 for the ML cards specified in the default Cisco IOS configuration file. The Cisco IOS configuration file is included in the CTM R5.0 server installation CD (misc/bareboneCLI_Security.txt). By default, the username for all connections is configured as CISCO15.
Password	Password to use for CTM server, CTM GateWay/TL1, and ML-series card connections. Note The default password is configured as CTM123+ for the ML cards specified in the default Cisco IOS configuration file.
Confirm Password	Re-enter the password to confirm it.
ONS 155xx Tab
Username	Username that CTM GateWay/TL1 uses to connect to ONS 15530 and ONS 15540 NEs.
Password	Password to use for CTM GateWay/TL1 connections to ONS 15530 and ONS 15540 NEs.
Confirm Password	Re-enter the password to confirm it.
ONS 15600 SDH Tab
Username	Username that the CTM server uses to connect to ONS 15600 SDH NEs. By default, ONS 15600 SDH NEs are configured with the username CISCO15.
Password	Password to use for CTM server connections to ONS 15600 SDH NEs.
Confirm Password	Re-enter the password to confirm it.
ONS 15600 Tab
Username	Username that the CTM server and CTM GateWay/TL1 use to connect to ONS 15600 SONET NEs. By default, ONS 15600 SONET NEs are configured with the username CISCO15.
Password	Password to use for CTM server and CTM GateWay/TL1 connections to ONS 15600 SONET NEs.
Confirm Password	Re-enter the password to confirm it.
ONS 158xx Tab
Username	Username that the CTM server and CTM GateWay/TL1 use to connect to ONS 1580x NEs. Note The account specified on the NE for CTM to use must be a SuperUser-level account.
Password	Password to use for CTM server and CTM GateWay/TL1 connections to ONS 1580x NEs.
Confirm Password	Re-enter the password to confirm it.
CRS-1 Tab
Username	Username that the CTM server uses to connect to the CRS-1 device.
Password	Password to use for CTM server connections to the CRS-1.
Confirm Password	Re-enter the password to confirm it.

8.3.2.14  Sending Messages to Other Users

Use the Notify Users dialog box to type and send a message to all CTM users, or to all CTM users with the same user privileges. For example, you might want to use the Notify Users dialog box to alert all CTM users before shutting down the CTM server.

Table 8-12 describes the fields in the dialog box.

---

Step 1 In the Domain Explorer window, choose File > Notify Users. The Notify Users dialog box opens.

Step 2 In the Message Targets area, select the recipients of the message.

Step 3 Type the message in the Message area.

Step 4 To send the message to the specified recipients, click Send. To cancel the message and close the dialog box, click Cancel. To launch the online help for the Notify Users dialog box, click Help.

---

Table 8-12 Field Descriptions for the Notify Users Dialog Box 

Field	Description
Message Targets	Select recipients for your message. This list includes the default SuperUser, SysAdmin, NetworkAdmin, Provisioner, and Operator profiles, as well any custom user profile that has been generated. You can select custom and multiple profiles by using the Shift and Control keys while clicking the profile, or click the All CTM Users radio button to send your message to all users, regardless of user type.
Message	Type your message. The maximum length is 512 characters. If you enter a message that is longer than 512 characters, only the first 512 characters are sent.

8.3.2.15  Viewing User Notification Messages

The User Notification dialog box pops up on your screen when another user sends a message to a certain user profile or to all CTM users, and you belong to one of those groups. Table 8-13 describes the fields in the dialog box.

Table 8-13 Field Descriptions for the User Notification Dialog Box 

Field	Subfield	Description
Message Received	From	Username of the user who sent you the message.
	Time	Date and time when you received the message.
Message	—	Text of the message. The maximum message length is 512 characters.

8.3.3  Managing CTM User Profiles

The following sections describe how to view, add, modify, delete, and duplicate a CTM user profile.

8.3.3.1  Viewing User Profiles

The CTM User Profiles table displays basic information about CTM user profiles. Use the menu options to manage user profiles.

---

Step 1 In the Domain Explorer window, choose Administration > CTM Users.

Step 2 In the CTM Users table, choose Administration > CTM User Profiles (or click the Launch User Profiles Table tool). Table 8-14 describes the fields in the CTM User Profiles table.

---

Table 8-14 Field Descriptions for the CTM User Profiles Table 

Field	Description
User Profile Name	Name of the existing CTM user profiles.
NE Assignment	NE assignment for the selected user profile. NE assignments are: •Assign all NEs—SuperUser, NetAdmin •Assign NEs—Operator, Provisioner •Assign no NEs—SysAdmin When you create a new profile, only Assign NEs is available for the new profile, meaning that NEs or groups must always be assigned to the new profile.
Login Sessions	Number of permitted simultaneous logins assigned to the user profile: •1—Only one user with a given profile can log into a specific CTM server at a time. •2 to 10—The specified number of users (2 to 10) with a given profile can log into a specific CTM server simultaneously. •Unlimited—An unlimited number of users with a given profile can log into a specific CTM server simultaneously.
Description	Description of the user profile.

8.3.3.2  Adding a Custom User Profile

Use the Create New User Profile wizard to add CTM user profiles. Table 8-15 describes the fields in the wizard.

---

Step 1 In the Domain Explorer window, choose Administration > CTM Users.

Step 2 In the Cisco Transport Manager Users table, choose Administration > CTM User Profiles (or click the Launch User Profiles Table tool).

Step 3 In the Cisco Transport Manager User Profiles table, choose Edit > Create (or click the Create a New User Profile tool).

Step 4 In the Create New CTM User Profile wizard, specify the following:

•User profile name

•NE assignment (read only)

•Max user sessions allowed

•Description

Step 5 Click Next.

Step 6 Select a user profile category from the Categories area. Operations for each category are displayed on the right side of the Categories area. See Table 8-1 for a list of CTM profile categories and operations.

Step 7 Specify user capabilities by setting permission or privileges for one or all operations. When setting privileges for each operation, select one of the following radio buttons:

•Read Only

•Read/Write

•No Access

When setting privileges for all operations, select one of the following buttons:

•Set All Read Only

•Set All Read/Write

•Set All No Access

---

Note The user profile operations displayed on the right side of the Create New CTM User Profile wizard depend on the category selected. You can select the root node to see all the operations for all categories.

---

Step 8 Click Finish.

Step 9 Click Yes in the message box. The message box will not be displayed if it is disabled in the User Preferences dialog box. See Setting User Preferences for more information.

---

Table 8-15 Field Descriptions for the Create New User Profile Wizard 

Field	Description
User Profile Name	Enter the name of the new user profile. The profile name must contain from six to twenty alphanumeric characters (A-Z, a-z, 0-9). Alphabetic characters are case-sensitive. The profile name must be unique in CTM and cannot contain a space or any special characters.
NE Assignment	(Read only) The NE assignment for the new user profile. Values are: •Assign All NEs—SuperUser, NetworkAdmin •Assign NEs—Operator, Provisioner •Assign No NEs—SysAdmin When you create a new profile, only Assign NEs is available for the new profile, meaning that NEs or groups must always be assigned to the new profile.
Max User Sessions Allowed	Select 1 to allow only one user with the selected user profile to log into a specific CTM server. Select a number other than 1 to allow the specified number of users to log into a specific CTM server simultaneously. Select Unlimited if you do not want to restrict the number of users with the selected profile from logging into a specific server simultaneously.
Description	Enter a description of the new user profile.
User Profile Privileges	Set user privileges for specific CTM categories. Select a category in the left panel to display that category's available operations. Select an operation from the Operations column; then, select a user privilege for the selected operation from the radio buttons in the Privileges column. •Set All Read Only—Specifies that the user can only view information related to all the operations with Read Only privilege listed under the specified category. All other operations will be set to No Access. •Set All Read/Write—Specifies that the user can view and perform any of the operations with Read/Write privilege listed under the specified category. All other operations will be set to Read Only. •Set All No Access—Specifies that the user is not allowed to perform any of the operations with No Access privilege listed under the specified category. All other operations will be set to Read Only. The Warning column lists the dependencies between various operations. After you click Finish to create the new user profile, a warning dialog box lists all of the warning messages. If you check the Don't Display User Profile Creation Warning Messages check box, the warning dialog box does not appear for subsequent user profile creations in the current client session. If you check the Don't Display User Profile Creation Warning Messages check box in the User Preferences dialog box, the warning dialog box is disabled as specified for the current user or as a template for new users.

---

Note See Table 1-19 on page 1-38 for the descriptions of the actions that can be performed using the buttons at the bottom of the window.

---

8.3.3.3  Modifying a User Profile

Use the Modify User Profile wizard to modify CTM user profiles. Table 8-16 describes the fields in the wizard.

---

Note Users created with a certain profile cannot be changed to another profile. To change profiles, the user must be deleted, then recreated with the new profile.

---

---

Note Modifying a profile will log out all users who are logged in with that profile.

---

---

Step 1 In the Domain Explorer window, choose Administration > CTM Users.

Step 2 In the Cisco Transport Manager Users table, choose Administration > CTM User Profiles (or click the Launch User Profiles Table tool).

Step 3 In the Cisco Transport Manager User Profiles table, click the profile to modify; then, choose Edit > Modify (or click the Modify User Profile Properties tool).

Step 4 In the Modify CTM User Profile wizard, modify the following:

•Max user sessions allowed

•Description

Step 5 Click Next.

Step 6 Select a user profile category from the Categories area. Operations for each category are displayed on the right side of the Categories area. See Table 8-1 for a list of CTM profile categories and operations.

Step 7 Specify user capabilities by setting permission or privileges on one or all operations. When setting privileges for each operation, select one of the following radio buttons:

•Read Only

•Read/Write

•No Access

When setting privileges for all operations, select one of the following buttons:

•Set All Read Only

•Set All Read/Write

•Set All No Access

---

Note The user profile operations displayed on the right side of the Create New CTM User Profile wizard depend on the category selected. You can select the root node to see all the operations for all categories.

---

Step 8 Click Finish.

Step 9 Click Yes in the message box. The message box will not be displayed if it is disabled in the User Preferences dialog box. See Setting User Preferences for more information.

---

Table 8-16 Field Descriptions for the Modify User Profile Wizard 

Field	Description
User Profile Name	(Read only) Name of the user profile. The profile name must contain from six to twenty alphanumeric characters (A-Z, a-z, 0-9). Alphabetic characters are case-sensitive. The profile name must be unique in CTM and cannot contain a space or any special characters.
NE Assignment	(Read only) The NE assignment for the user profile. Values are: •Assign all NEs—SuperUser, NetAdmin •Assign NEs—Operator, Provisioner •Assign no NEs—SysAdmin Only Assign NEs is available for new profiles, meaning that NEs or groups must always be assigned to the new profile.
Max User Sessions Allowed	Select 1 to allow only one user with the selected user profile to log into a specific CTM server. Select a number other than 1 to allow the specified number of users to log into a specific CTM server simultaneously. Select Unlimited if you do not want to restrict the number of users with the selected profile from logging into a specific server simultaneously.
Description	Modify the description of the user profile.
User Profile Privileges	Modify selected user privileges for specific CTM categories. Select a category in the left panel to display that category's available operations. Select an operation from the Operations column, then select a user privilege for the selected operation from the radio buttons in the Privileges column. •Set All Read Only—Specifies that the user can only view information related to all the operations with Read Only privilege listed under the specified category. All other operations will be set to No Access. •Set All Read/Write—Specifies that the user can view and perform any of the operations with Read/Write privilege listed under the specified category. All other operations will be set to Read Only. •Set All No Access—Specifies that the user is not allowed to perform any of the operations with No Access privilege listed under the specified category. All other operations will be set to Read Only. The Warning column lists the dependencies between various operations. After you click Finish to modify the user profile, a warning dialog box lists all of the warning messages. If you check the Don't Display User Profile Creation Warning Messages check box, the warning dialog box does not appear for subsequent user profile modifications in the current client session. If you check the Don't Display User Profile Creation Warning Messages check box in the User Preferences dialog box, the warning dialog box is disabled as specified for the current user or as a template for new users. Note Topology modification is not allowed for custom users.

---

Note See Table 1-19 on page 1-38 for the descriptions of the actions that can be performed using the buttons at the bottom of the window.

---

8.3.3.4  Deleting a User Profile

---

Step 1 In the Domain Explorer window, choose Administration > CTM Users.

Step 2 In the Cisco Transport Manager Users table, choose Administration > CTM User Profiles (or click the Launch User Profiles Table tool).

Step 3 In the Cisco Transport Manager User Profiles table, select the profile you want to delete; then, choose Edit > Delete (or click the Delete User Profile tool).

Step 4 In the confirmation dialog box, click OK.

---

---

Note The default user profiles (SuperUser, SysAdmin, NetworkAdmin, Provisioner, and Operator) cannot be deleted. Custom user profiles cannot be deleted if they are assigned to any user. Delete the user with the custom user profile before deleting the user profile. See Deleting a CTM User.

---

8.3.3.5  Duplicating a User Profile

Use the Create Duplicate Profile window to duplicate an existing CTM user profile.

---

Step 1 In the Domain Explorer window, choose Administration > CTM Users.

Step 2 In the Cisco Transport Manager Users table, choose Administration > CTM User Profiles (or click the Launch User Profiles Table tool).

Step 3 In the Cisco Transport Manager User Profiles table, select the profile you want to duplicate; then, choose Edit > Duplicate (or click the Duplicate User Profile tool).

Step 4 In the Create Duplicate Profile dialog box, enter the duplicate profile name. See Table 8-17 for name constraints.

Step 5 Click OK.

---

Table 8-17 Field Descriptions for the Create Duplicate Profile Window 

Field	Description
Duplicate Profile Name	The name of the duplicate user profile must contain from six to twenty alphanumeric characters (A-Z, a-z, 0-9). Alphabetic characters are case-sensitive. The profile name must be unique in CTM and cannot contain a space or any special characters.

8.4  NE Security Management

This section describes NE security, including setting authentication on an NE, setting up a security policy, using log tables, and managing NE user access.

8.4.1  Setting NE Authentication

Use the NE Authentication window to select the security properties (username and password for each authentication session) for multiple NEs. For each ONS 15000 NE that supports authentication, there is a specific Security tab in the Control Panel window.

Table 8-18 describes the fields in the NE Authentication window. Fields shown depend on the NE that is selected.

---

Step 1 In the Domain Explorer window, choose Administration > CTC-based NEs, ONS 15216, ONS 155XX, or ONS 1580X > NE Authentication. The NE Authentication dialog box opens.

Step 2 Specify the NE(s) that you will set a username and password authentication for. Click Add to add NEs to the Selected NEs list or click Remove to remove NEs from the list.

Step 3 In the CTM Server-NE Connection area, complete the following:

•Enable—Check the Enable check box if you want set a username and password that the CTM server will use to establish a connection with the selected NEs.

•Username

•Password (and confirm password)

Step 4 In the GateWay/TL1-NE Connection area, complete the following:

•Enable—Check the Enable check box if you want set a TL1 username and password that the CTM server will use to establish a connection with the selected NEs through CTM GateWay/TL1.

•Username

•Password (and confirm password)

Step 5 Click Save.

---

Table 8-18 Field Descriptions for the NE Authentication Window 

Field	Description
Network Elements Area
Available NEs	List of available NEs.
Selected NEs	List of selected NEs.
CTM Server - NE Connection Area
Enable	If checked, allows a connection between the CTM server and the NE.
Username	Enter a username for the selected NEs. This field is unavailable if the Enable check box is unchecked.
Password	Enter the password for the username. This field is unavailable if the Enable check box is not checked.
Confirm Password	Retype the password. This field is unavailable if the Enable check box is not checked.
GateWay/TL1 - NE Connection Area
Enable	If checked, allows a connection between the CTM GateWay/TL1 service and the NE.
Username	Enter a username for the selected NEs. This field is unavailable if the Enable check box is not checked.
Password	Enter the password for the username. This field is unavailable if the Enable check box is not checked.
Confirm Password	Retype the password. This field is unavailable if the Enable check box is not checked.

---

Note You can also set the NE authentication username and password in the Domain Explorer > Network Element Properties pane > NE Authentication tab.

---

---

Note If the username and password fields in the NE Authentication tab are left blank, CTM uses the username and password defined in the Control Panel.

---

---

Note See Table 1-19 on page 1-38 for the descriptions of the actions that can be performed using the buttons at the bottom of the window.

---

8.4.2  Setting Up a Security Policy

You can set up a security policy for CTC-based NEs.

---

Step 1 Select a CTC-based NE and choose Configuration > NE Explorer.

Step 2 In the tree view of the NE Explorer window, select the NE node.

Step 3 In the properties pane of the NE Explorer window, click the Security tab.

Step 4 Complete the following information in the Policy subtab:

•In the Idle User Timeout area:

–Retrieve—Set the idle user timeout for a CTC Retrieve user.

–Maintenance—Set the idle user timeout for a CTC Maintenance user.

–Provisioner—Set the idle user timeout for a CTC Provisioner user.

–SuperUser—Set the idle user timeout for a CTC SuperUser.

---

Note Idle time can be from zero to 999 minutes. To deactivate Idle User Timeout, enter zero as idle time. A user already logged into the node is not affected by a change to the Idle User Timeout policy.

---

•In the User Lockout area:

–Manual Unlock By SuperUser—If checked, the CTC SuperUser user must manually unlock locked out CTC users. If unchecked, locked out CTC users are automatically unlocked after the lockout duration period elapses.

–Lockout Duration—Set the lockout duration period for locked out CTC users. This field is only enabled if the Manual Unlock by SuperUser check box is unchecked.

–Failed Logins Before Lockout—Set the number of failed logins before the CTC user is automatically locked out.

•In the Other area:

–Single Sessions Per User—If checked, each CTC user can only launch one session at a time.

–Disable Inactive User—If checked, inactive users will be disabled automatically.

–Inactive Duration—If Disable Inactive User is checked, specify the inactive duration. The range is 45 to 90 days; the default is 45 days.

Step 5 Complete the following information in the Password subtab:

•In the Password Change area:

–Prevent Reusing Last— Prevents setting a CTC user's current password to one of the most recent passwords. You can set the number of most recent passwords that cannot be reused.

–Disable Password Flipping—If checked, users cannot change passwords for the number of days specified in the Cannot Change New Password For field.

–Cannot Change Password For—Enter the number of days that will elapse before the user can change the password.

–Force Password Change After Assigned—If checked, during the first successful login, the user is forced to change the password.

•In the Password Aging Area:

–Enable Password Aging—Check this check box to enable password aging.

–Aging Period—Enter the aging period, in days, for Retrieve, Maintenance, Provisioner, and SuperUser CTC users. After the aging period expires, CTC users are forced to change their passwords.

–Warning Period—Enter the warning period, in days, for Retrieve, Maintenance, Provisioner, and SuperUser CTC users. After the warning period expires, CTC users are warned that their passwords will soon expire.

Step 6 Complete the following information in the Access subtab:

•In the Access area:

–LAN Access—Specify the type of LAN access allowed. Values are Backplane Only, NO LAN Access, or Front and Backplane.

---

Note After setting the LAN access to the backplane, the CTM client is unusable for 4 to 5 minutes.

---

–Restore Timeout—This time period begins if LAN Access is NO and all DCC connections are lost. If the time expires before a DCC is restored, LAN Access is restored so that the node is not isolated. When the DCC comes back, LAN Access returns to its specified settings. The range is 0 (never) to 60 minutes; the default is 5 minutes.

•In the Shell Access area:

–Shell Access On—Specify shell access on Telnet or SSH.

–Telnet Port—This is enabled if you selected the Telnet radio button. Enter the Telnet port number.

–SSH Port—(Read-only) Indicates the SSH port number that will be used if the SSH radio button is selected.

•In the Other area:

–PM Clearing Privilege—Select the user's privilege that allows clearing PM statistics for the NE.

Step 7 Complete the following in the Legal Disclaimer subtab:

•In the Advisory Message subtab, there is a default advisory message that is noncustomer-specific. Change the text if you want the disclaimer to be specific for your company.

•In the Preview subtab, you can view the advisory message before saving it.

Step 8 Click Apply.

---

8.4.3  Using the ONS 1580x NE User Access Log Table

The NE User Access Log table displays access activity logs of ONS 15800, ONS 15801, and ONS 15808 users.

8.4.3.1  Enabling or Disabling the NE User Access Log

---

Step 1 In the Domain Explorer, select an ONS 15800, ONS 15801, or ONS 15808 NE.

Step 2 In the NE User Access Log State field of the Status tab in the Network Element Properties pane, choose Enabled or Disabled from the pull-down menu.

Step 3 Click Save.

---

8.4.3.2  Viewing the NE User Access Log Table

The NE User Access Log table displays the current status of the NE Access log. To view the NE User Access Log table, select an ONS 15800, ONS 15801, or ONS 15808 NE in the Domain Explorer tree; then, choose Administration > ONS 1580X > NE User Access Log. Table 8-19 describes the fields in the table.

Table 8-19 Field Descriptions for the NE User Access Log Table 

Field	Description
NE ID	ID number of the NE.
IP Address	IP address of the NE.
Log Status	Status of the NE access log. The status is either Enabled, Disabled, or Deleted.
Last Update	Date of the last update to the NE Users Access Activity Log table.

8.4.3.3  Enabling or Disabling a Log

Use the Enable/Disable Log Activation wizard to enable, disable, or delete logs for the ONS 15800, ONS 15801, or ONS 15808 NEs.

---

Step 1 In the Domain Explorer, select an ONS 15800, ONS 15801, or ONS 15808 NE and choose Administration > ONS 1580X > NE User Access Log.

Step 2 In the NE Access Log table, choose Administration > Enable/Disable Log. The Enable/Disable Log Activation wizard opens. Table 8-20 describes the fields in the wizard.

Step 3 Use the Add and Remove buttons to designate which cards have the access logs disabled or enabled.

Step 4 Click Finish.

Step 5 Click OK in the confirmation message box.

---

Table 8-20 Field Descriptions for the Enable/Disable Log Activation Wizard 

Field	Description
Log Disable/Log Deleted	Displays a list of ONS 1580x NEs that have their logs selected to be disabled or deleted. Select one or more NEs and click Add to enable the logs.
Log Enabled	Displays a list of ONS 1580x NEs that have their logs selected to be enabled. Select one or more NEs and click Remove to disable the logs.

8.4.3.4  Updating a Log

---

Step 1 In the Domain Explorer, select an ONS 15800, ONS 15801, or ONS 15808 NE and choose Administration > ONS 1580X > NE User Access Log.

Step 2 In the NE Access Log table, choose Administration > Update Log. The NE Access Log table updates.

Step 3 Choose File > Refresh Data (or click the Refresh Data tool) to see the updates.

---

8.4.3.5  Deleting a Log

---

Step 1 In the Domain Explorer, select an ONS 15800, ONS 15801, or ONS 15808 NE and choose Administration > ONS 1580X > NE User Access Log.

Step 2 In the NE Access Log table, select a card to delete access log information and choose Administration > Delete Log. The Delete Log wizard opens. Table 8-21 describes the fields in the wizard.

Step 3 Use the Add and Remove buttons to designate the NE(s) for which you want to delete access log information.

Step 4 Click Finish.

Step 5 Click OK in the confirmation message box.

---

Table 8-21 Delete Log Wizard Descriptions 

Field	Description
Available NEs	Displays a list of ONS 1580x NEs that are eligible for log removal. Select one or more NEs and click Add to add them to the Selected NEs list.
Selected NEs	Displays a list of ONS 1580x NEs that are selected for log removal. Select one or more NEs and click Remove to remove them from the Selected NEs list.

8.4.3.6  Viewing the NE Users Access Activity Log Table

The NE Users Access Activity Log table displays information about the users who have accessed the NE within a selected time frame.

---

Step 1 In the Domain Explorer, select an ONS 15800, ONS 15801, or ONS 15808 NE and choose Administration > ONS 1580X > NE User Access Log.

Step 2 In the NE Access Log table, choose Administration > NE Users Access Activity Log. Table 8-22 describes the fields in the table.

---

Table 8-22 Field Descriptions for the NE Users Access Activity Log Table 

Field	Description
NE ID	ID number of the NE.
Session ID	ID number of the session.
Username	Name of the user who accessed the NE.
Profile	Access level of the user.
Date and Time	Date and time the user accessed the NE.
Module Name	Name of the affected module, if applicable.
Location	Location of the affected module, if applicable.
Operation	Operation that the user performed on the NE.
Result	Result of the operation. Results are N/A, OK, or FAIL.

8.4.3.7  Filtering the NE Users Access Activity Log Table Data

---

Step 1 In the NE User Access Activity Log table, choose File > Filter (or click the Filter Data tool). The Filter dialog box opens.

Step 2 Specify the filter parameters described in Table 8-23.

Step 3 After making your selections, click OK to run the filter.

---

Table 8-23 Field Descriptions for the NE Users Access Activity Log Table Filter 

Field	Description
Date and Time (time zone)	Select a specific date or a date and time range for filtering.
User ID	Move users back and forth between the list of available users and selected users. The filter runs on the users in the Selected User ID list.

8.4.4  Managing NE User Access

You can view, add, modify, and delete user accounts for CTC-based, ONS 15216 EDFA3, and ONS 1580x NEs.

---

Note For more information about ONS 15800 and ONS 15801 user access levels, see TL1 Software Message Manual for the Cisco ONS 15800/15801 System. For more information about ONS 15808 user access levels, see TL1 Command Reference for the Cisco ONS 15808 DWDM System.

---

8.4.4.1  Viewing the NE User Access Administration Table—CTC-Based and ONS 1580x NEs

The NE User Access Administration table displays information about the existing users on the NEs that are selected from the CTM domain.

To view the NE User Access Administration table, choose Administration > CTC-based NEs or ONS 1580X > NE User Access Administration. Table 8-24 describes the fields in the table.

Table 8-24 Field Descriptions for the NE User Access Administration Table 

Field	Description
NE ID	Unique ID representing the NE.
User Type (ONS 1580x only)	Classification of the user. User types are Local Craft Terminal (LCT) or TL1.
NE Username	Username of the NE user.
NE User Privilege (CTC-based NEs only)	Privilege level of the user. For CTC-based NEs, user privileges are Retrieve, Maintenance, Provisioning, and SuperUser.
Profile (ONS 1580x only)	Access level of the user. Values are System Administrator, Complete Permission, Read Only User, Partial Permission, or Simple Permission.
Lock Out	Whether the NE user is locked out of the NE.
Last Login Time	Time stamp when the NE user most recently logged in.
Failed Login Count	Number of times the NE user failed to log into the NE successfully.
Disabled	Whether the NE user's access to the NE has been disabled.
Password Change on Next Login	Whether the NE user is required to change his or her password upon the next login to the NE.

8.4.4.2  Viewing the NE User Access Administration Table—ONS 15216 EDFA3 NEs

The NE User Access Administration table displays information about the existing users on the NEs that are selected from the CTM domain.

To view the NE User Access Administration table, choose Administration > ONS 15216 > NE User Access Administration. Table 8-25 describes the fields in the table.

Table 8-25 Field Descriptions for the NE User Access Administration Table 

Field	Description
NE ID	Unique ID representing the NE.
NE Username	Username of the NE user.
NE User Privilege	Privilege level of the user. User privileges are Read Only, Read/Write, and Read/Write/Administrative.
Timeout	Length of the timeout period (in minutes) based on the user's privilege. When a timeout occurs, the corresponding session is terminated, because no messages were exchanged for a defined period of time. •For Read Only users, the default timeout is 60 minutes. •For Read/Write users, the default timeout is 30 minutes. •For Read/Write/Administrative users, the default timeout is 15 minutes.

8.4.4.3  Filtering NE User Access Administration Table Data

---

Step 1 In the NE User Access Administration table, choose File > Filter (or click the Filter Data tool). The Filter dialog box opens.

Step 2 Specify the filter parameters described in Table 8-26.

Step 3 After making your selections, click OK to run the filter.

---

Table 8-26 Field Descriptions for the NE User Access Administration Table Filter 

Field	Description
NE ID	Move NEs back and forth between the list of available NEs and selected NEs. The filter runs on the NEs in the Selected NE ID list.
User ID	Move users back and forth between the list of available users and selected users. The filter runs on the users in the Selected User ID list.
User Privilege	Select the user privilege level(s) for filtering.
User Type (ONS 1580x only)	Select the user type(s) for filtering. The user types are TL1 User and LCT User.

8.4.4.4  Adding an NE User

Use the Add NE User wizard to add new users to CTC-based, ONS 15216 EDFA3, or ONS 1580x NEs. Table 8-27 describes the fields in the wizard.

---

Note Only users with Read/Write/Administrative privileges can add a new user to the ONS 15216 EDFA3.

---

---

Step 1 In the Domain Explorer window, choose Administration > CTC-based NEs, ONS 15216, or ONS 1580X > NE User Access Administration. The NE User Access Administration table opens.

Step 2 Choose Edit > Add (or click the Create a New User tool) for CTC-based or ONS 15216 EDFA3 NEs. Choose Administration > Add User for ONS 1580x NEs. The Add NE User wizard opens.

Step 3 In the Network Elements area, choose the NEs from the Available NEs list that the new user will have access to and click Add. These NEs will appear in the Selected NEs list. If you want to remove NEs that the new user has access to, select the NEs from the Selected NEs list and click Remove.

Step 4 Click Next.

Step 5 Set the new user account:

•User type (for ONS 1580x NEs)

•Username

•Password (and verify password)

•Privilege (for CTC-based and ONS 15216 EDFA3 NEs)

•Profile (for ONS 1580x NEs)

Step 6 Select Add. Each new user is added in the Selected Users Profile list.

Step 7 To remove a new user from the Selected Users Profile list, select the user profile and click Remove.

Step 8 Select Finish. The result of this activity can be monitored in the Job Monitor table.

---

Note LCT users are predefined and cannot be added to ONS 1580x NE users.

---

---

---

Note The addition of an NE user account cannot be scheduled for an NE that is marked Out of Service. The NE is not available in the list of NEs.

The addition of an NE user account can be scheduled for an NE that is marked In Service and with a communication state of Unavailable. The job will remain in the Job Monitor table in Waiting status and will be executed once the NE becomes available. This job cannot be canceled while in Waiting status.

---

Table 8-27 Field Descriptions for the Add NE User Wizard 

Field	Description
NE Selection Task
NE Model	Selected NE model.
Network Elements	List of available and selected NEs. Select one or more NEs from the Available NEs list and click Add to add them to the Selected NEs list. Select one or more NEs from the Selected NEs list and click Remove to remove them from the Selected NEs list.
User Profile Selection Task
User Type (for ONS 1580x NEs only)	New user's type. User types are LCT User and TL1 User.
Username	Username for the new user. •For CTC-based NEs, the username must contain at least 6 but not more than 20 alphanumeric characters. The username cannot contain a space or any special characters. •For ONS 15216 EDFA3 NEs, the username must contain at least 6 but not more than 10 alphanumeric characters. •For ONS 1580x NEs, the username must contain at least 1 but not more than 10 alphanumeric characters. Letters must be uppercase (A-Z). The username can also contain a hyphen (-), underscore (_), and a forward slash (/).
New Password	User password. •For CTC-based NEs, the password must contain at least 6 but not more than 10 alphanumeric characters (a-z, A-Z, 0-9) and special characters (+, #, %) where at least two characters are alphabetic, at least one character is numeric, and at least one character is a special character. •For ONS 15216 EDFA3 NEs, the password must contain at least 7 but not more than 10 ASCII characters, where at least two characters are nonalphabetic and at least one character is a special character (+, #, %). For example, jpasswd#1 is an acceptable password. The password cannot contain the username. For example, if the username is CISCO15, the password cannot be CISCO15#. The password is case-sensitive. •For ONS 1580x NEs, the password must contain at least 6 but not more than 8 alphanumeric characters. Of these characters, at least two must be uppercase letters (A-Z). Lowercase letters are not accepted. The password can also contain numeric characters and a hyphen (-), an underscore (_), and a forward slash (/).
Verify/Confirm Password	Re-enter the password to confirm it.
Privilege (for CTC-based and ONS 15216 EDFA3 NEs)	Privilege level for the new NE user. •For CTC-based NEs, privilege levels are Retrieve, Maintenance, Provisioning, and Superuser. •For ONS 15216 EDFA3 NEs, privilege levels are Read Only (R), Read/Write (RW), and Read/Write/Administrative (RWA). The timeout period is based on user's privilege. When a timeout occurs, the corresponding session is terminated, because no messages were exchanged for a defined period of time. –Read Only: The user can monitor the state of an NE, but cannot issue provisioning commands. The default timeout is 60 minutes. –Read/Write: The user can receive notifications, read information, and provision the NE. The user cannot carry out system administrative tasks. The default timeout is 30 minutes. –Read/Write/Administrative: The user can receive notifications, read information, provision the NE, carry out system administrative tasks, and perform user management. The default timeout is 15 minutes.
Profile (for ONS 1580x NEs)	Profile for the new user. Profiles are System Administrator, Complete Permission, Read Only User, Partial Permission, and Simple Permission.
Selected Users Profile	List of new NE user(s). You can click Remove to remove the selected NE user.

---

Note See Table 1-19 on page 1-38 for the descriptions of the actions that can be performed using the buttons at the bottom of the window.

---

8.4.4.5  Adding a Predefined User

Use the Add Predefined User wizard to add a predefined CTM user from an NE or from the NE User Access Administration table. Table 8-28 describes the fields in the Add Predefined User wizard.

---

Note The Add Predefined User wizard is not available for ONS 15216 EDFA3 NEs.

---

---

Step 1 In the Domain Explorer window, choose Administration > CTC-based NEs or ONS 1580x > NE User Access Administration. The NE User Access Administration table opens.

Step 2 For CTC-based NEs, choose Edit > Add Predefined Users. For ONS 1580x NEs, choose Administration > Add Predefined Users.

Step 3 In the Add Predefined User wizard, do the following:

a. Select the area from which you will choose the predefined NE user. In the Existing NE User Selection area, click either:

•From NE—To choose predefined users of a specific NE.

•From CTM User Table—To choose predefined users associated with the CTM user in the CTM User table.

b. If you chose to select users from an NE, in the NE selection area, choose the NE from the Select NE to pick users from drop-down list. If you chose to select from the CTM User table, this field becomes unavailable.

c. If you chose to select users from an NE, specify and verify the password in the Specify User Password area. This password will be applied to all the users selected in the next window. If you choose to select from the CTM User table, you can force a password to the user by selecting the Force Password check box, then specifying and verifying the password.

d. Specify the user privilege. If you choose to select users from an NE, you can force a privilege to the user by selecting the Force Privilege check box.

This privilege will be applied to all the users selected in the next window.

Step 4 Click Next.

Step 5 Select the predefined users. Use the Add and Remove buttons to add or remove NEs in the Selected Users list.

Step 6 Click Next.

Step 7 Specify the NEs that the new user will have access to. Use the Add and Remove buttons to add or remove NEs in the Available NEs list.

Step 8 Click Finish. The result of this activity can be monitored in the Job Monitor table.

---

Table 8-28 Field Descriptions for the Add Predefined User Wizard 

Field	Description
Predefined User Property Selection Task
Existing NE User Selection	Choose whether to add the new user from the selected NE or from the CTM User table. Note From CTM User table is disabled if you launch this window from an ONS 1580x NE.
NE Selection	Select the NE from which to choose a user. Note This field is disabled if you selected From CTM User table in the Existing NE User Selection field.
Force Password	If enabled, forces the predefined user to use a password when logging in. Note This field is disabled if you select From NE in the Existing NE User Selection field.
Password	Enter the login password that the user will use to access the system. •For CTC-based NEs, the password must contain at least 6 but not more than 10 alphanumeric characters (a-z, A-Z, 0-9) and special characters (+, #, %) where at least two characters are alphabetic, at least one character is numeric, and at least one character is a special character. •For ONS 1580x NEs, the password must contain at least 6 but not more than 8 alphanumeric characters. Of these characters, at least two must be uppercase letters (A-Z). Lowercase letters are not accepted. The password can also contain numeric characters and a hyphen (-), an underscore (_), and a forward slash (/). Note This field is disabled if you select From CTM User table in the Existing NE User Selection field.
Confirm Password	Confirm the user password by retyping it.
Force Privilege	If enabled, forces the predefined user to use a specific user privilege level when logging in. Note This field is disabled if you select From CTM User table in the Existing NE User Selection field.
Privilege	Set the appropriate user privilege level. •For CTC-based NEs, privilege levels are Retrieve, Maintenance, Provisioning, and Superuser. •For ONS 1580x NEs, privilege levels are System Administrator, Complete Permission, Read Only User, Partial Permission, and Simple Permission.
Predefined Users
Available Users	Select one or more users from the list and click Add to add them to the Selected Users field. Only the users listed in the Selected Users field will be added.
Selected Users	Select one or more users from the list and click Remove to remove them from the Selected Users field. Only the users listed in the Selected Users field will be added.
NE Selection
Available NEs	Select one or more NEs from the list and click Add to add them to the Selected NEs field. Users are added only to the NEs listed in the Selected NEs field.
Selected NEs	Select one or more NEs from the list and click Remove to remove them from the Selected NEs field. Users are added only to the NEs listed in the Selected NEs field.

---

Note See Table 1-19 on page 1-38 for the descriptions of the actions that can be performed using the buttons at the bottom of the window.

---

8.4.4.6  Modifying an NE User Profile

Use the Modify NE User wizard to make changes to existing NE users. Table 8-29 describes the fields in the wizard.

---

Note Only users with Read/Write/Administrative privileges can modify a user's password and privilege level on the ONS 15216 EDFA3.

---

---

Step 1 In the Domain Explorer window, choose Administration > CTC-based NEs, ONS 15216, or ONS 1580x > NE User Access Administration. The NE User Access Administration table opens.

Step 2 Select a user from the list. Choose Edit > Modify (or click the Modify User Properties tool) for CTC-based and ONS 15216 EDFA3 NEs. Choose Administration > Modify User (or click the Modify User tool) for ONS 1580x NEs.

Step 3 In the Modify NE User wizard, modify the following (as needed). Fields shown depend on the NE selected:

•User Type (for ONS 1580x NEs)

•Username

•New Password (and verify password)

•Privilege (for CTC-based and ONS 15216 EDFA3 NEs)

•Profile (for ONS 1580x NEs)

•Lock Out

•Disabled

•Change Password on Next Login

•Modify User on Multiple NEs check box

Step 4 Do one of the following:

a. If you did not check Modify User on Multiple NEs, go to Step 5.

b. If you checked Modify User on Multiple NEs, click Next. Select the NE(s) that the modified user can or cannot access.

Step 5 Click Finish.

Step 6 If you are modifying the profile of a user who is currently logged in, click OK in the warning message. Changes to the NE user profile will take effect on the user's next login attempt.

---

Note You can modify only the password field for LCT users of ONS 1580x NEs.

---

---

---

Note You cannot modify an existing NE user account for an NE that is marked Out of Service. You can select the NE's records in the NE User Access Administration table, but when you try to modify the account, you will get an error message telling you that you cannot perform the operation.

---

---

Note You can schedule modification of an existing NE user account for an NE that is marked In Service but is unavailable. The job remains in Waiting status in the Job Monitor Table and is executed when the NE becomes available. You cannot cancel the job.

---

Table 8-29 Field Descriptions for the Modify NE User Wizard 

Field	Description
User Type (for ONS 1580x NEs only)	(Read-only) User type (LCT User or TL1 User). Note The user type cannot be modified without deleting the user.
Username	For the ONS 15216 EDFA3, edit the username. Note For CTC-based and ONS 1580x NEs, the username is read-only; it cannot be modified without deleting the user.
New Password	Modify the user password. •For the CTC-based NEs, the password must contain at least 6 but not more than 10 alphanumeric characters (a-z, A-Z, 0-9) and special characters (+, #, %) where at least two characters are alphabetic, at least one character is numeric, and at least one character is a special character. •For ONS 15216 EDFA3 NEs, the password must contain at least 7 but not more than 10 ASCII characters, where at least two characters are nonalphabetic and at least one character is a special character (+, #, %). For example, jpasswd#1 is an acceptable password. The password cannot contain the username. For example, if the username is CISCO15, the password cannot be CISCO15#. The password is case-sensitive. •For ONS 1580x NEs, the password must contain at least 6 but not more than 8 alphanumeric characters. Of these characters, at least two must be uppercase letters (A-Z). No lowercase letters are allowed. The password can also contain numeric characters and a hyphen (-), an underscore (_), and a forward slash (/).
Verify/Confirm Password	Re-enter the modified password to confirm it.
Privilege (for CTC-based and ONS 15216 EDFA3 NEs)	Modify the privilege level of the user. •For CTC-based NEs, privilege levels are Retrieve, Maintenance, Provisioning, and Superuser. •For ONS 15216 EDFA3 NEs, privilege levels are Read Only, Read/Write, and Read/Write/Administrative.
Timeout (for ONS 15216 EDFA3 NEs)	(Read-only) View the length of the timeout period (in minutes) based on the user's privilege. When a timeout occurs, the corresponding session is terminated, because no messages were exchanged for a defined period of time. •For Read Only users, the default timeout is 60 minutes. •For Read/Write users, the default timeout is 30 minutes. •For Read/Write/Administrative users, the default timeout is 15 minutes.
Profile (for ONS 1580x NEs only)	Modify the profile for the user. The choices are System Administrator, Complete Permission, Read Only User, Partial Permission, and Simple Permission.
Lockout	Check this check box to lock out the NE user.
Disabled	Check this check box to permanently disable the user from logging back into CTM.
Change Password on Next Login	Check this check box to force the NE user to change his or her password on the next login.
Modify User on Multiple NEs	Check this check box to modify the profile for multiple NEs. The NEs are selected in the next dialog box.

---

Note See Table 1-19 on page 1-38 for the descriptions of the actions that can be performed using the buttons at the bottom of the window.

---

8.4.4.7  Deleting an NE User

---

Step 1 In the Domain Explorer window, choose Administration > CTC-based NEs, ONS 15216, or ONS 1580X > NE User Access Administration. The NE User Access Administration table opens.

Step 2 Select a user from the list and choose Edit > Delete (or click the Delete User tool) for CTC-based and ONS 15216 EDFA3 NEs. Choose Administration > Delete User (or click the Delete User tool) for ONS 1580x NEs.

---

Note You cannot delete a user who is currently logged in. For CTC-based and ONS 1580x NE users, you must first log out the user from the Active NE Users table. See Ending an Active NE User Session. For ONS 15216 EDFA3 NE users, you must wait for the user to log out before deleting that user.

---

---

Note Only users with Read/Write/Administrative privileges can delete an ONS 15216 EDFA3 user.

---

---

Note You cannot delete LCT users of ONS 1580x NEs.

---

Step 3 Click Yes in the confirmation dialog box.

Step 4 Click OK in the message box.

---

---

Note You cannot delete an existing NE user account for an NE that is marked Out of Service. You can select the NE's records in the NE User Access Administration Table, but when you try to delete the account, you will get an error message telling you that you cannot perform the operation.

---

---

Note You can schedule deletion of an existing NE user account for an NE that is marked In Service but is unavailable. The job remains in Waiting status in the Job Monitor Table and is executed when the NE becomes available. You cannot cancel the job.

---

8.4.4.8  Viewing Active NE Users

The NE Active Users table displays information about the users who are currently logged into selected NEs in CTM. Table 8-30 describes the fields in the table. Fields shown depend on the NE selected.

---

Note The ONS 15216 EDFA3 supports up to 20 user accounts with up to 11 simultaneous Telnet user connections. Each user can open only one connection at a time.

---

---

Step 1 In the Domain Explorer window, choose Administration > CTC-based NEs, ONS 15216, or ONS 1580X > NE User Access Administration. The NE User Access Administration table opens.

Step 2 For CTC-based and ONS 15216 EDFA3 NEs, choose Edit > NE Active Users (or click the Show NE Active Users tool). For ONS 1580x NEs, choose Administration > NE Active Users (or click the Show NE Active Users tool).

---

Table 8-30 Field Descriptions for the NE Active Users Table 

Field	Description
NE ID	Unique ID number of the NE. Note For the ONS 1580x, all NEs in a DCC ring are displayed when one NE is logged in from CTM to CTC.
User Type (ONS 1580x NEs only)	Classification of the user. User types are LCT or TL1.
Session ID (ONS 1580x NEs only)	Session ID of the user.
NE Username	Name of the user.
Profile (ONS 1580x NEs only)	Access level of the user.
IP Address (CTC-based and ONS 1580x NEs only)	IP address of the client workstation from which the user has logged in.

8.4.4.9  Filtering NE Active Users Table Data

---

Step 1 In the NE Active Users table, choose File > Filter (or click the Filter Data tool). The Filter dialog box opens.

Step 2 Specify the filter parameters described in Table 8-31.

Step 3 After making your selections, click OK to run the filter.

---

Table 8-31 Field Descriptions for the NE Active Users Table Filter 

Field	Description
NE ID	Move NEs back and forth between the list of available NEs and selected NEs. The filter runs on the NEs in the Selected NE ID list.

8.4.4.10  Ending an Active NE User Session

You can use the Log Out User feature to end a user session on CTC-based or ONS 1580x NEs.

---

Note The Log Out User feature is not available for ONS 15216 EDFA3 NEs.

---

---

Step 1 In the Domain Explorer window, choose Administration > CTC-based NEs or ONS 1580X > NE User Access Administration. The NE User Access Administration table opens.

Step 2 For CTC-based NEs, choose Edit > NE Active Users (or click the Show NE Active Users tool). For ONS 1580x NEs, choose Administration > NE Active Users. The NE Active Users table opens.

Step 3 For CTC-based NEs, choose Administration > Log Out User (or click the Log Out User tool). For ONS 1580x NEs, choose Administration > Disconnect User.

Step 4 Click Yes.

---

8.4.5  Managing CTC User Profiles

You can view, create, modify, and delete CTC user profiles in the CTM database.

8.4.5.1  Viewing the CTC User Profiles Table

The CTC User Profiles table contains a list of predefined CTC user profiles that are available in the CTM database. To view the CTC User Profiles table, choose Administration > CTC User Profiles in the Domain Explorer window. Table 8-32 describes the fields in the table.

Table 8-32 Field Descriptions for the CTC User Profiles Table 

Field	Description
User ID	CTC username.
User Privilege	CTC user privilege.
Description	Description of the CTC user.

8.4.5.2  Creating a CTC User Profile

Use the Create CTC User Profile wizard to add new CTC user profiles to the database. Table 8-33 describes the fields in the wizard.

---

Step 1 In the Domain Explorer window, choose Administration > CTC User Profiles. The CTC User Profiles table opens.

Step 2 Choose Edit > Create.

Step 3 In the Create CTC User Profile wizard, enter the following information:

•User ID

•Password (and confirm password)

•Privilege

•Description

Step 4 Click OK.

---

Table 8-33 Field Descriptions for the Create CTC User Profile Wizard 

Field	Description
User ID	Name of the new user profile. The profile name must contain from six to twenty alphanumeric characters (A-Z, a-z, 0-9). Alphabetic characters are case-sensitive. The user profile name cannot contain a space or any special characters. Note After the user ID is set, it cannot be changed without deleting the user.
User Password	User password. The new password must contain a minimum of six and a maximum of ten alphanumeric (a-z, A-Z, 0-9) and special characters (+, #,%), where at least two characters are alphabetic, at least one character is numeric, and at least one character is a special character.
Confirm Password	Retype the password to confirm it.
Privilege	Access privilege for the new user profile. Privilege levels are Retrieve, Maintenance, Provisioning, and Superuser.
Description	Description of the new user profile.

---

Note See Table 1-19 on page 1-38 for the descriptions of the actions that can be performed using the buttons at the bottom of the window.

---

8.4.5.3  Modifying a CTC User's Properties

Use the Modify CTC User Profile wizard to make changes to an existing CTC user profile. Table 8-34 describes the fields in the wizard.

---

Step 1 In the Domain Explorer window, choose Administration > CTC User Profiles. The CTC User Profiles table opens.

Step 2 Choose Edit > Modify.

Step 3 In the Modify CTC User Profile wizard, modify the following, as needed:

•Password (and confirm password)

•User Privilege

•Description

Step 4 Click OK.

---

Table 8-34 Field Descriptions for the Modify CTC User Profile Wizard 

Field	Description
User ID	(Read-only) Name of the user profile. The profile name must contain from six to twenty alphanumeric characters (A-Z, a-z, 0-9). Alphabetic characters are case-sensitive. The user profile name cannot contain a space or any special characters. Note After the username is set, it cannot be changed without deleting the user.
User Password	User password. The password must contain a minimum of six and a maximum of ten alphanumeric (a-z, A-Z, 0-9) and special characters (+, #,%), where at least two characters are alphabetic, at least one character is numeric, and at least one character is a special character.
Confirm Password	Retype the modified password to confirm it.
User Privilege	Access privilege for the user profile. Privilege levels are Retrieve, Maintenance, Provisioning, and Superuser.
Description	Description of the user profile.

---

Note See Table 1-19 on page 1-38 for the descriptions of the actions that can be performed using the buttons at the bottom of the window.

---

8.4.5.4  Deleting a CTC User Profile

---

Step 1 In the Domain Explorer window, choose Administration > CTC User Profiles. The CTC User Profiles table opens.

Step 2 Select the CTC user profile that you want to delete and choose Edit > Delete.

Step 3 Click OK in the confirmation dialog box.

---

8.4.6  Managing Cisco IOS Users

You can view, create, modify, and delete Cisco IOS user accounts in the CTM database.

8.4.6.1  Viewing the IOS Users Table

The IOS Users table shows all of the configured Cisco IOS user accounts. You can use the IOS Users table to manage user access to Layer 2 and Layer 3 Cisco IOS cards. Use this table to give users the ability to view or edit the username and password on ML cards in CTC-based NEs.

To view the table, choose Administration > CTC-based NEs > IOS Users Table in the Domain Explorer window. Table 8-35 describes the fields in the table.

Table 8-35 Field Descriptions for the IOS Users Table 

Field	Description
NE ID	ID number of the NE.
Module Name	Name of the selected module.
Physical Location	Location of the selected module.
Username	Username that is provisioned on the Cisco IOS card.
Privilege	Privilege level of the selected user.

8.4.6.2  Adding an IOS User

Use the IOS User Creation wizard to add new Cisco IOS users to the domain. Table 8-36 describes the fields in the wizard.

---

Step 1 In the Domain Explorer window, choose Administration > CTC-based NEs > IOS Users Table.

Step 2 In the IOS Users table, choose Edit > Create (or click the Create a New User tool). The IOS User Creation wizard opens.

Step 3 In the IOS Card Selection window, complete the following substeps:

a. Select the NE ID on which you want to create a new Cisco IOS user.

b. In the Available IOS Cards list, select the card(s) that you want the new user to be able to access. Use the Add button to move the card(s) to the Selected IOS Cards list.

c. Click Next.

Step 4 In the IOS User Information window, enter the following information:

•Username

•Password (and confirm password)

•User privilege

Step 5 Click Finish.

The new user is listed in the IOS Users table.

---

Table 8-36 Field Descriptions for the IOS User Creation Wizard 

Field	Description
IOS Card Selection Pane
NE ID	NE ID on which you want to create a new Cisco IOS user.
Available IOS Cards	Available Cisco IOS data card(s) that the user can access. Click Add to move the card(s) to the Selected IOS Cards list.
Selected IOS Cards	Selected Cisco IOS data card(s) that the user can access. Click Remove to return the card(s) to the Available IOS Cards list.
IOS User Information Pane
Username	Name of the Cisco IOS user.
Password	Login password that the Cisco IOS user will use to access ML cards.
Confirm Password	Retype the password to confirm it.
User Privilege	User privilege level. Values are 0 to 15; the default is 15.

---

Note See Table 1-19 on page 1-38 for the descriptions of the actions that can be performed using the buttons at the bottom of the window.

---

8.4.6.3  Modifying an IOS User

Use the IOS User Modification wizard to modify the password or privilege level of an existing Cisco IOS user. Table 8-37 describes the fields in the wizard.

---

Step 1 In the Domain Explorer window, choose Administration > CTC-based NEs > IOS Users Table.

Step 2 In the IOS Users table, choose Edit > Modify (or click the Modify User Properties tool). The IOS User Modification wizard opens.

Step 3 In the IOS Card Selection window, complete the following substeps:

a. Select the NE ID on which you want to modify the Cisco IOS user password or privilege level.

b. In the Available IOS Cards list, select the card(s) that you want the modified user to be able to access. Use the Add button to move the card(s) to the Selected IOS Cards list.

c. Click Next.

Step 4 In the IOS User Information window, enter the following information:

•Password (and confirm password)

•User privilege

Step 5 Click Finish.

---

Table 8-37 Field Descriptions for the IOS User Modification Wizard 

Field	Description
IOS Card Selection Pane
NE ID	NE ID on which you want to modify the Cisco IOS user.
Available IOS Cards	Available Cisco IOS data card(s) that the user can access. Click Add to move the card(s) to the Selected IOS Cards list.
Selected IOS Cards	Selected Cisco IOS data card(s) that the user can access. Click Remove to return the card(s) to the Available IOS Cards list.
IOS User Information Pane
Username	(Read only) Name of the Cisco IOS user.
Password	Login password that the Cisco IOS user will use to access ML cards.
Confirm Password	Retype the password to confirm it.
User Privilege	User privilege level. Values are 0 to 15; the default is 15.

---

Note See Table 1-19 on page 1-38 for the descriptions of the actions that can be performed using the buttons at the bottom of the window.

---

8.4.6.4  Deleting an IOS User

---

Step 1 In the Domain Explorer window, choose Administration > CTC-based NEs > IOS Users Table.

Step 2 In the IOS Users table, select the user to be deleted.

Step 3 Choose Edit > Delete (or click the Delete User tool).

Step 4 Click OK to remove the user from the database.

---

8.5  Audit Log

The Audit Log table contains information about significant events that occurred on the CTM server during a specified time period. By default, the Audit Log displays information about significant events that occurred during the last four hours. You can change the default time period in the User Preferences dialog box.

The Audit Log records the following runtime-affecting operations for monitoring purposes:

•CTM client logins, logouts, and security violations (including successful/unsuccessful client user logins and forced logouts)

•NE or group location changes in the Domain Explorer tree

•Domain Explorer group operations (add, delete, or modify a group)

•Changes in the Domain Explorer properties of an NE

•Write operations from a native CTM NE Explorer

•Changes in the NE Software table

•NE Service, PM Service, and CTM GateWay Service start or stop operations

•CTM user administration (add, delete, or modify user profile)

•Changes in:

–UI properties

–Security settings

–High availability settings

–Recovery settings

–Database configuration

–Error log configuration

–NE poller parameters

–NE autobackup parameters

–NE service parameters

•Job or task cancellation in the Job Monitor table

•Manual memory backup

•Memory restore

•Software download

•Software activation

•Circuit operations (add, delete, modify, or upgrade circuits)

•Link operations (add, delete, or modify links)

•OSS profile changes (TL1 or CORBA)

•VLAN operations

•Addition or deletion of a CTM GateWay/SNMP trap destination

•Addition or deletion of a CTC binary

•BLSR/MS-SPRing operations

•L2 service operations

•CTM GateWay/CORBA client logins/logouts

•CTM GateWay/TL1 DMM client logins/logouts

8.5.1  Viewing the Audit Log

To view the Audit Log, choose Administration > Audit Log in the Domain Explorer window. Table 8-38 describes the fields in the Audit Log.

Table 8-38 Field Descriptions for the Audit Log 

Field	Description
Source ID	Source of the event. Events performed by the CTM server show CTM as the source ID.
Username	Name of the user performing the logged event. Events performed by the CTM server are logged under the username Internal.
Service Name	Name of the service that generated the audit log entry.
CTM Time Stamp (time zone)	Date and time when the event occurred on the CTM server.
Category	Name of the category in which the event occurred. Events belong to one of the following categories: CTM GateWay/TL1, CTM server administration, CTM server connectivity, CTM server security, CTM server topology, CTM server circuit, CTM server network, NE provisioning, NE connectivity, BLSR/MS-SPRing, or subnetwork management.
Message	Description of the significant event that occurred.

8.5.2  Filtering Audit Log Data

---

Step 1 In the Audit Log window, choose File > Filter (or click the Filter Data tool). The Filter dialog box opens.

Step 2 Specify the filter parameters described in Table 8-39.

Step 3 After making your selections, click OK to run the filter.

---

Table 8-39 Field Descriptions for the Audit Log Filter Dialog Box 

Tab	Description
Time Stamp (time zone)	Filter audit log data for a specified time period, ranging from the past hour to the past 6 months. You can click the User Specified radio button to specify an exact filter starting and ending time by month, day, year, and hour. The time zone can be GMT, a user-defined offset from GMT, or local time, depending on what is specified in the User Preferences dialog box. If you want to filter audit log data and the time period is not important, click No Time Specified.
Source ID	Move NEs back and forth between the list of available NEs and selected NEs and then run the filter.
Category	Filter audit log data by task.
Username	Move users back and forth between the list of available users and selected users and then run the filter. Events performed by the CTM server are logged under the username Internal.
Service	Move services back and forth between the list of available services and selected services and then run the filter.

8.6  Northbound Gateway Security

OSS-to-CTM sessions are configured by the CTM GateWay EMS-to-NMS interface architectural component. See Chapter 12, "Managing Southbound and Northbound Interfaces" for more information about CTM GateWay.