-
User Guide for CiscoWorks Assistant 1.0.
-
Open Source License Acknowledgements
-
Preface
-
Chapter 1 CiscoWorks Assistant - Overview
-
Chapter 2 Getting Started with CiscoWorks Assistant
-
Chapter 3 Configuring LMS Server Using CiscoWorks Assistant
-
Chapter 4 Troubleshooting Your Network Using CiscoWorks Assistant
-
Appendix A Troubleshooting CiscoWorks Assistant
-
Index
-
Table Of Contents
Configuring LMS Server Using CiscoWorks Assistant
About the CiscoWorks Assistant Server Setup Homepage
Accepting Certificate Information
Viewing Server Addition Summary
Setting up System Identity User
Setting and Editing the Device Management Mode
Viewing Server Management Status
Viewing Set Default Credentials Status
Adding Devices Using Bulk Import From File
Adding Devices Using Bulk Import From NMS
Adding Devices Using Campus Device Discovery
Viewing the Configure ACS Mode Status
Viewing the Configure ACS Mode Result
Viewing the Server Setup Summary
Configuring LMS Server Using CiscoWorks Assistant
The Server Setup The Server Setup workflow helps you to setup and manage CiscoWorks LAN management Solution (LMS) servers. It helps you to simplify the deployment and setting up of single or multiple LMS servers.
The Server Setup workflow assists you in:
•
Managing LMS Servers—You can add servers, set up System Identity User accounts, and set up the device management mode.
•
•
•
•
Before You Begin
Before you start using the Server Setup workflow, review the following topics:
•
•
•
About Single-Server and Multi-Server Setups
If the CiscoWorks applications are installed on a single LMS server, the setup is considered as a Single-server setup.
For large deployments, you may opt to have multiple servers for a single managed network by distributing applications across multiple servers for better performance and scaling. This setup is considered as a Multi-server setup. The Multi-server set up requires the various LMS servers part of the set up work in sync with each other.
You will come across the following terms and concepts while setting up and working on a Multi-server set up:
•
Peer Server Certificates are used to allow one CiscoWorks server to communicate with another using SSL. In a Multi-server set up you have two or more servers on which CiscoWorks applications are installed. CiscoWorks allows you to add the certificate of another CiscoWorks server (a peer server) into its trusted store.
•
Communication between multiple CiscoWorks servers is enabled by a trust model addressed by certificates and shared secrets. System Identity setup should be used to create a trust user on Slave servers to facilitate communication in Multi-server scenarios. This trust user is called System Identity User. The System Identity User is also used for inter-process communication.
A default System Identify User
adminis created during installation. During the installation, you should provide the password for System Identity user. This password can be different from the password you provide for theadminuser used to log in to CiscoWorks.CiscoWorks Assistant allows you to create a System Identity User in all the servers part of the Multi-server set up.
The System Identity User is a Local User with all privileges. The user will automatically be made a Peer Server User too.
If the LMS server is in ACS mode, the System Identity User should be present in ACS user data base with Super Admin privileges assigned.
•
Peer Server Account Setup helps you create users who can programmatically login to CiscoWorks servers and perform certain tasks. These users should be set up to enable communication between multiple CiscoWorks servers. Peer Server Account can be set up in Common Services.
The Device and Credentials Repository (DCR) lets you manage the device list, and associated credentials and other user defined device attributes in a single place in a management domain. In a Multi-server setup, where each server could host one or more LMS application instances, the DCR serves as the one place where you can manage the device lists and related attributes, for use by all the applications in the set up.
DCR helps multiple applications share device lists and credentials using a client-server mechanism, with secured storage and communications. The CiscoWorks applications can read or retrieve the information from this repository.
In a Single-server scenario, the DCR would be operating in a Standalone mode (default mode after installation)
In a Multi-server scenario, user should designate one of the servers as the Master and configure the other servers in a Slave mode.
The Slave servers keep their copy of the DCR data, in sync with the Master DCR.
The Master DCR server refers to the master repository of device list and credential data. There is only one Master repository for each management domain, and it contains the most up-to-date device list and credentials. DCR Slaves are slave instances of DCR on other servers and provide transparent access to applications installed on those servers.
Any change to the repository data occurs first in the Master with the changes being propagated to all the Slaves. There can be more than one Slave in a management domain but any slave can become a master at any time.
In Standalone mode, DCR maintains an independent repository of device list and credential data. It does not participate in a management domain and its data is not shared with any other DCR. It does not communicate with or contain registration information about any other Master, Slave, or Standalone DCR.
Devices newly added in DCR can be managed by an application in following ways
•
•
The Single Sign-On (SSO) feature helps you to use a single session to navigate to multiple CiscoWorks servers without having to authenticate to each of them.
For Single Sign On, one of the CiscoWorks servers needs to be set up as the authentication server. The SSO authentication server is called the Master, and the SSO regular server is called the Slave. If there is no SSO Master server configured in your setup, the local server is selected as SSO Master.
You must perform the following tasks if the server is either configured as Master or Slave:
•
•
About AAA Mode
CiscoWorks provides a robust security mechanism to manage identity and access to the CiscoWorks applications, and data in a multi-user environment.
By default, CiscoWorks Server authentication (CiscoWorks Local) is used to authenticate users, and authorize them to access CiscoWorks applications. After authentication, your authorization is based on the privileges that have been assigned to you.
A privilege is a task or an operation defined within the application. The set of privileges assigned to you defines your role. It dictates how much, and what type of system access you have.The CiscoWorks Server authorization scheme has pre-defined roles. In this mode, you cannot change the roles, or the privileges assigned to these roles. However, a user can be assigned a combination of these roles.
CiscoWorks server can be integrated with Cisco Secure Access Control Server (ACS) to provide improved access control by means of authentication, authorization, and accounting (AAA). CiscoSecure ACS provides authentication, authorization, and accounting services to network devices that function as AAA clients.
In ACS mode, you can create custom roles to best suit your business workflow and needs. That is, you can create a user, and assign the user with a set of privileges, that would suit your needs.
CiscoWorks Assistant helps you in changing the login module of all servers part of the multi-server set up to ACS mode. See Changing ACS Setup for details. See also, Adding Server Details.
Related Documentation
For more information on Multi-server setups, DCR and SSO, see the latest versions of following documents on Cisco.com:
•
http://www.cisco.com/en/US/products/sw/cscowork/ps3996/products_user_guide_list.html
•
http://www.cisco.com/en/US/products/sw/cscowork/ps2425/prod_white_papers_list.html
•
http://www.cisco.com/en/US/products/sw/netmgtsw/tsd_products_support_category_home.html
Implications of DCR and SSO Modes on Server Setup Workflow
The Server Setup workflow assists you in setting up a Multi-server set up. You can add servers, create System Identity Users, modify the device management mode, add and manage devices, and change the AAA mode to ACS using the workflow.
In a Multi-Server setup, Server Setup workflow runs only on the DCR Master server.
In Server Setup workflow, the local server will be treated as DCR Master server if the setup is converted from Single-Server setup to Multi-Server setup. That is, using CiscoWorks Assistant if you add another server to a Standalone server, the DCR mode of the Standalone server to which the new server is added will be changed to Master.
A Multi-Server setup must have one SSO Master. The other LMS servers must be in SSO Slave mode. If there is no SSO Master server configured in your setup, the local server is set as SSO Master.
If the server is already configured for Multi-Server Setup, CiscoWorks Assistant automatically performs a Server Discovery to collect all the server information in the setup and displays it. Server Discovery runs once every hour. The existing server setup will be discovered when you invoke the CiscoWorks Assistant workflow pages, if the last discovery occurred before 60 minutes. Also, Server Discovery runs at the end of the Manage Server tasks and CiscoWorks Assistant collects all the updated information.
If the SSO Master is not reachable, you cannot perform any operation in the Server Setup workflow. Also, if any of the servers is unreachable, you cannot perform the Manage Servers and Change ACS Mode Setup steps.
Navigating Within Server Setup Workflow
If you are starting the workflow for the first time, click Start Setup to enter into the Server Setup workflow.
To get back to the initial Server Setup workflow screen from any other screen, click Cancel.
If you have operated the workflow earlier, and logged out from the CiscoWorks, or closed the browser after a particular task, you can continue from that task. To do this, click Enter Setup.
The links in the Server Setup table-of contents at the top-left corner of the screen are disabled after you enter the workflow.
After you enter the Server Setup workflow, you can navigate among the available options using the Back, Skip, and Next buttons.
•
Takes you to the previous screen. When you click Back, the previous step will not be rolled back. CiscoWorks Assistant does not retain the values you entered previously.
•
Allows you to skip a task, and get to the next task. For example, if you want to get to the Set Default Credentials page from the Manage Servers page, without getting into the System Identity User Setup or Device Management mode page, click Skip.
•
Takes you to the screen that is after the current screen.
CiscoWorks Assistant runs only one instance of Server Setup workflow. You can end an active session of another user when no operation is running in that session. To end the session, you need to provide the System Identity User details. If any operation is running, you cannot end the session.
Also, multiple operations cannot be initiated by the same user, simultaneously. The operation is allowed only after the operation that is in progress is completed.
To go to the CiscoWorks Assistant homepage click Home.
About the CiscoWorks Assistant Server Setup Homepage
Before you start with the Server Setup workflow, read the Before You Begin topic to help you understand the features better.
The initial screen that appears when you enter the workflow displays the Server Application List window. The fields in this window are described in the following table:
LMS Server
IP Address of the LMS Server or Display Name of the LMS server.
Reachability
Reachability status of the LMS server.
When you click the Expand button of the LMS server, a new pane gets added to the Server Application List window. The fields in the new pane are described in the following table:
You can perform the following Server Setup workflow tasks:
•
•
•
•
•
After you complete the Server Setup workflow, you can view a detailed summary of all the tasks that you have performed during the workflow. See Viewing the Server Setup Summary for details.
In a Multi-server setup, if one of the slaves is down, you cannot run the Manage Servers and Change ACS Setup steps in Server Setup workflow. However, you can run all the device related steps such as Setting Default Credentials, Adding Devices, and Managing Devices. This limitation is imposed because changes made during Manage Servers and Change ACS Setup steps have to be uniformly applied across all servers part of the Multi-server setup and cannot be skipped for the server which is down.
Managing LMS Servers
The Manage Servers page displays the CiscoWorks server Details. This page allows you to:
•
•
•
•
You can also:
•
•
•
•
Note
Viewing Server Details
To view server details:
Step 1
The Server Application List table lists the LMS servers.
Step 2
The CiscoWorks server Details table appears with the following details.
•
•
•
•
•
•
•
See the User Guide for CiscoWorks Common Services 3.1 for information on DCR and SSO modes.
Adding a Server
When you add a server, you must:
Step 1
See Adding Server Details for details.
Step 2
See Accepting Certificate Information for details.
Step 3
See Setting up the System for details.
Step 4
See Setting up System Identity User for details.
After you add a server, you can set up the Device Management Mode for all the applications (See Setting and Editing the Device Management Mode). This determines whether the devices should be managed by the different applications when they are added to the DCR.
You can view a summary of server addition, after you complete the necessary tasks. See Viewing Server Addition Summary for details.
Adding Server Details
To add a CiscoWorks server:
Step 1
Step 2
The Add Server dialog box appears.
Step 3
•
•
•
•
•
If the DCR Master (local server) is in ACS mode, you should enter the Network Device Group (NDG) details.
This should be the NDG to which the DCR Master server is added. CiscoWorks Assistant will convert the server you add here too into ACS mode, on a successful completion of the Manage Servers workflow.
If the server you are adding has already been integrated with another ACS server, it will get integrated to the ACS server to which the DCR Master (local server) is integrated, after the successful completion of Manage Servers step.
If you add a server that is already registered with the same ACS server as the DCR Master (local server), CiscoWorks Assistant re-integrates the server with the same ACS server.
On integration, all the custom roles you have created in the ACS server for the CiscoWorks applications will be lost.
You must restart the Daemon Manager in the server that you have added, after the Manage Server Step is complete. If you have added multiple servers, you must restart the Daemon Manager in all the servers that you have added.
If the DCR Master is in CiscoWorks Local mode, you cannot add a server that is in ACS mode.
Step 4
CiscoWorks server is contacted to validate the Device and Credential Repository settings, and to fetch the Certificate information. See Accepting Certificate Information for details.
Accepting Certificate Information
If a CiscoWorks server needs to communicate to another CiscoWorks server, it must possess the certificate of the other server. You can add certificates of any number of peer CiscoWorks servers to the trusted store.
For more information on Certificates, and importing peer server certificates, see the following sections in the User Guide for CiscoWorks Common Services 3.1:
•
•
To view and accept the certificate:
Step 1
The Server Setup window appears with the following certificate information.
•
•
•
•
•
•
•
•
Step 2
Step 3
The Server Setup window is displayed. You can set the SMTP server and the CiscoWorks E-mail ID to receive e-mails from CiscoWorks server. See Setting up the System for details.
Setting up the System
The Server Setup window allows you to set up the SMTP server, and the CiscoWorks E-mail ID.
The SMTP settings in CiscoWorks Assistant is specific to a server. If you change the SMTP settings in DCR master (local server), the SMTP server name and e-mail ID is set in the DCR master (local server) alone. To change the SMTP settings in slaves, you have to go to the individual servers and set up SMTP details.
Step 1
This is the system-wide name of the SMTP server used by CiscoWorks applications to deliver reports. The default server name is localhost.
Step 2
This is the CiscoWorks e-mail ID from which applications send e-mail notifications. There is no default e-mail ID.
These fields will be already populated if the SMTP server and e-mail ID have been set up in the Common Services > Server > Admin > System Preferences screen or using the LMS Setup Center.
Step 3
Viewing Server Addition Summary
The Add Server Summary page provides the following details:
•
•
•
–
–
•
–
–
When you add a server to the existing setup, the added server will become SSO and DCR Slave. However, if you want to make the added server the SSO Master, select the Set as Master check box.
CiscoWorks Assistant does not provide the option to convert the DCR mode of the added server from Slave to Master as this could result in applications losing data. You can proceed to Setting up System Identity User step, after you complete the Add Server steps.
To go to the Set Default Credentials Page Setting Default Credentials, click Skip.
Editing Server Details
To edit a server:
Step 1
Step 2
The Edit Server dialog box appears.
This dialog box has pre-populated values in Hostname/IP address, Protocol, Port and Current SSO Settings fields. All fields in the Edit Server dialog box can be edited, except the Hostname/IP address, Protocol, Port, and Current SSO settings fields.
If the server is in SSO Slave mode, you can set it as SSO Master, by selecting the Set as Master check box.
If the server is in SSO Master Mode, you can change it to Slave mode by selecting the Set as Slave check box. The Set as Slave check box is not present in the local server.
Step 3
Step 4
The Current System Identity User pop-up appears.
In a Single-server setup, if you have provided the admin user name and password, you will not be prompted to enter System Identity User details. In a Multi-server setup, if you have provided admin user name and password for all servers, you will not be prompted to enter System Identity User details.
Step 5
The New System Identity User window appears.
Step 6
•
Or
•
The Device Management Mode page appears.
Step 7
See for Setting and Editing the Device Management Mode more information.
If you do not want to change the settings, click Next when you get to this page without making any modifications to the existing Device Management mode. The Skip button is disabled in this page.
The workflow initiates after you click Next button. The modifications you made are saved when the tasks are complete.
Deleting a Server
To delete a server from the setup:
Step 1
Step 2
Step 3
The Delete Confirmation popup appears.
Step 4
The Marked for Deletion tag appears adjacent to the server you selected in Step 2.
Step 5
The Current System Identity User pop-up appears.
Step 6
Step 7
The New System Identity User window appears.
You can skip the New System Identity User step if you do not want to change the current System Identity User details. To do this, click Skip.
The Device Management Mode page appears.
Step 8
You may choose to change the device management mode here, or leave the values as such. This page does not have the Skip button. You need to click the Next button to proceed with the tasks. The workflow initiates after you click Next button.
The server marked for deletion will be removed from the set up after the Manage Servers tasks are complete.
Marked for deletion tag appears only for servers that are already added.
If you add a server and delete it immediately after adding it, that is, if you perform the Add Server and the Delete Server tasks in same UI session, the Marked for deletion tag does not appear in the screen. In this case, the newly added server is not marked for deletion, and is removed from the screen when you click OK in the Delete Confirmation pop-up.
Retaining a Server Marked for Deletion
To retain a server marked for deletion:
Step 1
Step 2
Note
The Undelete Confirmation pop up appears
Step 3
If you try to add a server that is marked for deletion back to the set up again using the Add button, the Undelete Confirmation pop-up is displayed. Click OK to retain the server in the setup.
After the server is deleted from the setup, the deleted server goes into DCR Standalone and SSO Standalone modes. The workflow also removes the Trust that is set up from all the deleted servers.
You cannot remove the local server from the setup.
If you remove the SSO Master, you can assign any other server as the SSO Master. If you do not select another server as the SSO Master, the workflow will assign the local server as the SSO Master. If you remove the SSO Master, the Multi-server setup is not removed.
You cannot delete the DCR Master.
In a Multi-server setup that has two servers, the workflow will remove the Multi-server setup if you remove one server. In such a case, the local server switches to Standalone mode.
Setting up System Identity User
System Identity setup helps you to create a trust user on servers that are part of a Multi-server setup. This user enables communication among servers that are part of a management domain. There can only be one System Identity user for each server.
The System Identity user you configure must be a Peer Server user.
•
•
See User Guide for CiscoWorks Common Services 3.1 for more details on System Identity setup.
Before you set up the System Identity user, you must add the server.
To set up the System Identity user:
Step 1
Step 2
The Current System Identity User Setup dialog box appears
This dialog box appears only when the admin user details are not entered for at least one of the servers. If the admin user details are entered for all servers, the New System Identity Setup page appears.
Step 3
Step 4
The New System Identity Setup page appears.
If you want to change the System Identity setup values, enter the new System Identity Username and Password in the text field, re-enter the password in the confirm password field, and click Next to complete the System Identity User setup.
CiscoWorks Assistant ensures the new user you create has all the necessary privileges. CiscoWorks Assistant ensures the new user you create has all privileges.
Otherwise, click Skip.
To set up, or edit the Device Management Mode page, click Next.
Setting and Editing the Device Management Mode
The Device Management mode determines whether the new devices are automatically managed by CiscoWorks applications.
You have to add your server before you get to this stage. If you are in a Multi-server setup, you must also set up a System Identity User before you begin this task.
See application specific User Guides to know more about device management modes in different CiscoWorks applications.
To set the Device Management Mode:
Step 1
The Device Management Mode page appears.
The possible modes are:
•
•
By default, the Device Management Mode shows the current status of device management mode of applications that have been set up in their respective Device Management Settings pages.
Step 2
Step 3
The workflow executes the assigned tasks when you click Next in the Device Management Mode page. The Manage Servers progress page displays the Server Management status. See Viewing Server Management Status.
Viewing Server Management Status
The Manage Servers progress page that appears after you complete the Device management mode set up displays the status of the Manage Server tasks that you have performed.
For information on setting up Device Management mode, see Setting and Editing the Device Management Mode.
To view the Manage Severs tasks status:
Step 1
The Manage Servers Progress page appears.
The process of checking the status of various tasks might take some time.
You can either:
•
Or
•
The status on the following is displayed:
•
•
•
•
•
•
•
•
•
•
Step 2
If a step fails, the Last Accessed URL column in the report will display the shortcut URL for that particular step. It will not display anything, if the step is successful.
Setting up E-mail Notification After Managing Server Tasks
You can exit the workflow after you complete the tasks and return later to view the status. You should do this after getting an e-mail notification.
To do this:
Step 1
Step 2
The e-mail ID will be displayed in the text field if you had entered an e-mail ID in the Manage Servers flow. Only one e-mail ID is allowed.
The e-mail ID can contain alphabets, numbers, and special characters ($, _, ^, &, #).
For example:
•
user_cwa1@cisco.com•
Name_12#@abc.co.inThe following message appears:
An e-mail will be sent to the selected E-mail address after the process has completed.Step 3
The initial Server Setup workflow page is displayed.
You will receive an e-mail when the tasks have completed.
Step 4
Setting Default Credentials
Default credentials are stored in DCR, and are not associated with any device. DCR maintains only one default credential set.
The default credential set comprises:
•
•
•
•
•
•
•
You can use the default credentials for devices and edit their credentials appropriately. You can configure the default credentials and use them in the applications. Applications use the default credentials for the devices they manage if they cannot retrieve the required device credentials from DCR.
All the credential information will be populated from the DCR Master. If the credentials are already available in DCR, they will be overwritten by the new values you enter. The DCR database is updated after you set the default credentials.
To set the default device credentials:
Step 1
The Default Credentials page appears.
You can:
•
•
•
•
•
Setting Standard Credentials
To set Standard Credentials:
a.
The Standard Credential page appears.
b.
–
–
You can also enter the Enable password for these credentials.
c.
Setting SNMP Credentials
To set SNMP Credentials
a.
The SNMP Credential page appears.
b.
–
–
c.
d.
e.
f.
The Authentication Algorithm field can be MD5, SHA-1 or None.
Setting HTTP Credentials
To set HTTP Credentials:
a.
The HTTP Credential page appears. You can add the following credentials:
–
–
b.
c.
d.
–
–
–
The Current Mode can be HTTP, HTTPS, or None. Select the value from the drop-down list.
Setting Auto Update Server
To set Auto Update Server Managed Device Credentials:
a.
The Auto Update Server Managed Device Credential page appears.
b.
c.
Setting Rx Boot Mode Credentials
To set Rx Boot Mode Credentials:
a.
The Rx Boot Mode Credentials page appears.
b.
c.
Step 2
The Set Default Credentials Progress page is displayed. This page provides the status of the Set Default Credentials tasks. See Viewing Set Default Credentials Status.
Viewing Set Default Credentials Status
To view the set default credentials status:
Step 1
The Set Default Credentials Progress page is displayed.
The process of checking the status of various tasks might take some time.
You can either:
•
Or
•
Step 2
If a step fails, the Last Accessed URL column in the report will display the shortcut URL for that particular step. It will not display anything, if the step is successful.
See the User Guide for CiscoWorks Common Services 3.1, for more information on Default Credentials.
Click Next to go to the Add Devices step. See Adding Devices for details.
Setting up E-mail Notification After Setting Default Credentials
You can exit the workflow after you complete the tasks and return later to view the status. You should do this after getting an e-mail notification.
To do this:
Step 1
Step 2
The e-mail ID will be displayed in the text field if you had entered an e-mail ID in the Manage Servers flow. Only one e-mail ID is allowed.
The e-mail ID can contain alphabets, numbers, and special characters ($, _, ^, &, #).
For example:
•
user_cwa1@cisco.com•
Name_12#@abc.co.inThe following message appears:
An e-mail will be sent to the selected E-mail address after the process has completed.Step 3
The initial Server Setup workflow page is displayed.
You will receive an e-mail after the tasks have completed.
Step 4
Adding Devices
You can add devices to the Device and Credentials Repository (DCR) using the following methods:
•
•
•
CiscoWorks Assistant allows you to add devices using multiple methods simultaneously. You can add devices using the Import from File feature, and Campus Device Discovery at the same time.
Campus Device Discovery can be run only if Campus Manager is installed in the CiscoWorks server. It can be installed either on a local or on a remote server.
You can also:
•
•
•
To add devices you can either:
•
Or
•
Adding Devices Using Bulk Import From File
To import from a file:
Step 1
The File Information pane appears. This is the default.
Step 2
Or
a.
The Server Side File selector dialog box appears
b.
The Server Side File Selector dialog box displays the files from the remote server on which the Server Setup workflow is running.
Step 3
Only CSV 2.0 and CSV 3.0 file formats are supported.
See the User Guide for CiscoWorks Common Services 3.1 for sample CSV and XML files.
Step 4
•
•
Step 5
•
•
Adding Devices Using Bulk Import From NMS
To import from NMS:
•
Or
•
The NMS Information screen appears.
You can do a bulk import either from:
•
Or
•
Performing Bulk Import From Local NMS
To perform a bulk import from Local NMS:
Step 1
Step 2
Step 3
For example:
C:\Program Files\HP OpenViewStep 4
•
•
Step 5
•
•
Performing Bulk Import From Remote NMS
To do a bulk import from Remote NMS:
Step 1
Step 2
Step 3
Step 4
Step 5
If you select the NMS type as ACS, enter the root password, port and protocol along with the hostname and root username in the corresponding fields.
Step 6
•
•
Step 7
•
•
Adding Devices Using Campus Device Discovery
Discovery can be done only if Campus Manager is installed in the server. Before running Discovery on a server you must specify the SNMP settings and Seed Device configuration.
To run Discovery:
•
Or
•
Add Devices page appears. This page contains the Run Discovery check box for each server.
To specify Device Discovery settings:
Step 1
This option is available only if Campus Manager is installed on the server.
The Discovery window appears with the following tabs.
Step 2
Seed Devices tab
•
a.
b.
To delete a device, select it, and click Delete.
•
•
SNMPV2 tab
•
For example: 10.*.*.* public1 and 10.*.*.* public2
•
•
•
•
•
•
SNMPV3 tab
•
•
•
•
•
•
•
See Setting SNMP V2 Parameters and Setting SNMP V3 Parameters for more information.
Discovery Settings tab
•
•
Therefore, if you do not use DNS in your network, or if you are experiencing problems with DNS, consider disabling the reverse DNS lookup.
•
•
Preferred Management IP
•
•
•
Configure Range tab
•
–
–
•
•
–
–
Step 3
The Add Devices Progress page appears. You can view the device addition status in this page.
See Viewing Add Devices Status for details.
Setting SNMP V2 Parameters
To add or edit SNMP V2 and SNMP v3 parameters:
Step 1
Step 2
Step 3
The SNMP V2 popup appears.
Step 4
•
•
•
•
•
Step 5
•
Or
•
Step 6
The SNMP V2 popup appears with the existing values.
Step 7
•
Or
•
Step 8
Setting SNMP V3 Parameters
To add or edit SNMP V3 parameters:
Step 1
Step 2
Step 3
The SNMP V3 popup appears.
Step 4
•
•
•
•
•
•
•
Step 5
•
Or
•
Step 6
The SNMP V3 popup appears with the existing values.
Step 7
•
Or
•
Select a row, and click Delete to delete the community string.
Viewing Add Devices Status
To view the Add Devices status:
Step 1
The Add Devices Progress page is displayed.
The process of checking the status of various tasks might take some time.
You can either:
•
Or
•
Step 2
If a step fails, the Last Accessed URL column in the report will display the shortcut URL for that particular step. It will not display anything, if the step is successful.
Click Next to go to Manage Devices Tasks. See Managing Devices for details.
Setting up E-mail Notification After Adding Devices
You can exit the workflow after you complete the tasks and return later to view the status. You should do this after getting an e-mail notification.
To do this:
Step 1
Step 2
The e-mail ID will be displayed in the text field if you had entered an e-mail ID in the Manage Servers flow. Only one e-mail ID is allowed.
E-mail ID can contain any characters, numbers, and special characters ($, _, ^, &, #).
For example:
•
user_cwa1@cisco.com•
Name_12#@abc.co.inThe following message appears:
An e-mail will be sent to the selected E-mail address after the process has completed.Step 3
The initial Server Setup workflow page is displayed.
You will receive an e-mail after the tasks have been completed.
Step 4
Deleting SNMP V2 Details
To delete an SNMP V2 device:
Step 1
Step 2
Step 3
Step 4
The Delete SNMP V2 Confirmation dialog box appears.
Step 5
Deleting SNMP V3 Details
To delete an SNMP V3 Device:
Step 1
Step 2
Step 3
Step 4
The Delete SNMP V3 Confirmation dialog box appears.
Step 5
Managing Devices
This page helps you to allocate devices to be managed by the applications installed in the CiscoWorks servers. The page lists the CiscoWorks servers and the applications that are present in each server. You can select devices from the device selector and add it to the application with which you want the device to be managed.
You can also:
•
•
To manage devices:
Step 1
The Manage Devices page appears.
Step 2
Step 3
Initially, devices must be added to DCR. After a device is added to DCR, you can add it to the applications.
Step 4
Or
Click Reset to reset the added devices in the application.
The Manage Devices screen displays:
•
•
•
Step 5
The Device Management Progress page appears. You can view the Device Management status in this page. See Viewing Manage Devices Status for details.
About Device Selector
The Device Selector allows you to search for the devices in Device and Credential Repository (DCR). It helps you to locate the devices and perform the device management tasks quickly. With this device selector, you need not remember the device type or application group hierarchy to locate the devices.
The devices are categorized under the Device Type based groups, User Defined groups, Subnet Based groups, Application Specific groups or under All Groups.
The CiscoWorks Assistant uses the Common Services device selector.
See the Configuring Device Selector section in the Managing Device and Credentials chapter of the User Guide for CiscoWorks Common Services 3.1 for information on using Device Selector:
http://www.cisco.com/en/US/products/sw/cscowork/ps3996/products_user_guide_list.html
You can also access this information from Common Services Online help. From CiscoWorks help, select:
Common Services > Managing Device and Credentials > Configuring Device Selector > Searching Devices.
Viewing Manage Devices Status
You can view the device management status after you complete the Manage Devices tasks.
To view the status:
Step 1
The Device Management Progress page is displayed.
The process of checking the status of various tasks might take some time.
You can either:
•
Or
•
Step 2
If a step fails, the Last Accessed URL column in the report will display the shortcut URL for that particular step. It will not display anything, if the step is successful.
Click Next to go to the Change ACS Setup tasks. See Changing ACS Setup for details.
Setting up E-mail Notification After Device Management Tasks
You can exit the workflow after you complete the tasks and return later to view the status. You should do this after getting an e-mail notification.
To do this:
Step 1
Step 2
The e-mail ID will be displayed in the text field if you had entered an e-mail ID in the Manage Servers flow. Only one e-mail ID is allowed.
The e-mail ID can contain alphabets, numbers, and special characters ($, _, ^, &, #).
For example:
•
user_cwa1@cisco.com•
Name_12#@abc.co.inThe following message appears:
An e-mail will be sent to the selected E-mail address after the process has completed.Step 3
The initial Server Setup workflow page is displayed.
You will receive an e-mail, after the tasks have completed.
Step 4
Changing ACS Setup
The CiscoWorks server provides mechanisms used to authenticate users for CiscoWorks applications. The login module determines the type of authentication and authorization CiscoWorks uses.
By default, the login module is set to the native CiscoWorks authentication mechanism, that is, the CiscoWorks Local login module. You can change this default value to use Cisco Secure ACS for user authentication and authorization.
In CiscoWorks Local mode, you cannot create custom roles, or modify the predefined roles. Cisco Secure ACS allows you to create custom roles and also limit the access to network devices within LMS using Network Device Groups (NDGs).
The details for setting up the CiscoWorks server for non-ACS mode are available in User Guide for CiscoWorks Common Service 3.1.
Change ACS Setup page shows the ACS Mode Status for each CiscoWorks server in the setup. From this page you can:
•
•
The tasks to be performed to complete AAA mode change to ACS can be classified as:
•
–
–
The See Cisco Secure ACS Initial Setup Tasks for details.
•
•
Cisco Secure ACS Initial Setup Tasks
You must define an Administrator in ACS server to provide remote access. To access the Cisco Secure ACS HTML interface from a browser on a remote machine, you must log in to Cisco Secure ACS using an administrator account.
You can perform the necessary steps to do this in the Administration Control tab in the ACS UI. See the White paper titled CiscoWorks LMS Integration with Cisco Secure ACS, or the User Guide for Cisco Secure ACS 4.1 for detailed information.
You must then add the CiscoWorks server and the devices it manage as AAA clients in ACS.
The following tasks need to be performed to add CiscoWorks server as an AAA client:
Step 1
The Network Configuration page appears.
Step 2
•
If NDG option is not visible, you can enable Network Device Groups in ACS under Interface Configuration > Advanced.
Or
•
The Add AAA Client page appears.
Step 3
Step 4
Step 5
Step 6
Step 7
Apart from adding your CiscoWorks server as an AAA client, you also need to add the devices to be managed by the CiscoWorks server as AAA clients to Cisco Secure ACS. When you are integrating with Cisco Secure ACS, your devices will not be visible from your CiscoWorks server if you have not added them as AAA clients in Cisco Secure ACS.
For information on adding network device groups and AAA client configuration, see the Network Configuration section of the User Guide for CiscoSecure ACS 4.1.
To change ACS settings:
Step 1
The Change ACS Setup page appears.
Change ACS Setup page contains these ACS Mode Status details.
•
•
If the mode is ACS, there will be a link. Click the link to view the ACS Connection Status for the server.
Step 2
If the server is in ACS mode, the Change ACS Setup page will contain ACS tasks pane instead of Login Module pane. ACS tasks pane has these radio buttons:
•
•
Configuring the ACS Mode
To change the mode to ACS:
Step 1
CiscoWorks Assistant checks whether there are pending devices in DFM and RME. If CiscoWorks Assistant finds there are pending devices, the Pending Device Count table is displayed. It shows the following details:
•
•
•
•
Along with the table, a Notification pop up window appears with the following message:
Pending devices exist or could not check for pending devices in some LMS applicationsStep 2
Step 3
LMS server(s) ACS configuration will not be proper if there are pending devices in the LMS applications. Make sure there are no pending devices and click OK to continue.To get further details on pending devices in the applications, go to:
•
•
See RME and Device Fault Manager User Guides for more information on pending devices.
The Change ACS Setup page appears after you click OK.
Step 4
Note
Step 5
Step 6
If the DCR Master (local server) is already in ACS mode, the fields other than the passwords and secret keys will be pre-populated.
Step 7
In case an application is already registered with ACS, the current registration will overwrite the previous registration. When you select the Register all installed applications with ACS check box, you are prompted to confirm whether you want to continue with the settings.
See Common Services Online Help for details.
Step 8
Step 9
The Configure ACS Mode Progress page is displayed. You can view the ACS mode configuration status in this page. See Viewing the Configure ACS Mode Status for details.
User Configuration in Cisco Secure ACS
The System Identity User has to be created in ACS, and assigned Super Admin role in all applications in ACS.
You should create a user in ACS with the current System Identity User name, and assign Super Admin role to that user in all applications in the TACACS + options pane in Group Setup or User Setup UI in ACS.
See Configuring Device Management Command Authorization for a User Group in User Guide for CiscoSecure ACS 4.1.
Note
The final step in integrating CiscoWorks Common Services Software with Cisco Secure ACS is to configure the CiscoWorks users within Cisco Secure ACS. Cisco Secure ACS allows you to define access permissions and policies for the registered CiscoWorks applications on a per user basis or user group basis.
See the following sections of the Cisco Secure ACS User Guide for more information on managing users and user groups:
•
•
When adding the user, you can configure access policies to define what the user is authorized to do depending on the role.
See Configuring Users in ACS section in User Guide for CiscoWorks Common Services 3.1 for information on:
•
•
See also the white paper on CiscoWorks LMS Integration with Cisco Secure ACS, available on cisco.com
Viewing the Configure ACS Mode Status
You can view the ACS mode configuration status after you complete the Configure ACS Mode tasks.
To view the status, click Next after configuring the ACS mode.
The Configure ACS Mode Progress page is displayed.
The process of checking the status of various tasks might take some time.
You can either:
•
Or
•
The Configure ACS Mode Result page is displayed. See Viewing the Configure ACS Mode Result for details.
Setting up E-mail Notification After Configuring ACS Mode
You can exit the workflow after you complete the tasks and return later to view the status. You should do this after getting an e-mail notification.
To do this:
Step 1
Step 2
The e-mail ID will be displayed in the text field if you had entered an e-mail ID in the Manage Servers flow. Only one e-mail ID is allowed.
The e-mail ID can contain alphabets, numbers, and special characters ($, _, ^, &, #).
For example:
•
user_cwa1@cisco.com•
Name_12#@abc.co.inThe following message appears:
An e-mail will be sent to the selected E-mail address after the process has completed.Step 3
The initial Server Setup workflow page is displayed.
You will receive an e-mail after the tasks have been completed.
Step 4
Viewing the Configure ACS Mode Result
Configure ACS Mode Result page displays the ACS Connection Status of all servers in the setup. To access the Configure ACS Result page you should have changed the server into ACS Mode.
To view the Configure ACS Mode Result page:
Step 1
The Configure ACS Mode result page appears with the following popup message:
Restart the LMS Daemon Manager of the following servers for the ACS changes to take effect:
<Server details>
Make sure the configured System Identity User is available in ACS Server.Step 2
Step 3
•
–
Run /etc/init.d/dmgtd stop
–
Run net stop CRMdmgtd or net stop crmdmgtd
•
–
Run /etc/init.d/dmgtd start
–
Run net start CRMdmgtd or net start crmdmgtd
The following ACS Connection Status details are shown:
•
•
•
See the Setting up AAA Mode to ACS section in the User Guide for CiscoWorks Common Services 3.1, for further details.
Updating ACS Configuration
You can update the ACS server details using this option. You should have already completed the ACS Mode change to do this.
To update ACS server details:
Step 1
CiscoWorks Assistant checks whether there are pending devices in DFM and RME. If CiscoWorks Assistant finds there are pending devices, the Pending Device Count table is displayed. It shows the following details:
•
•
•
•
Along with the table, a Notification pop up window appears with the following message:
Pending devices exist or could not check for pending devices in some LMS applicationsStep 2
Step 3
LMS server(s) ACS configuration will not be proper if there are pending devices in the LMS applications. Make sure there are no pending devices and click OK to continue.To get further details on pending devices in the applications, go to:
•
•
See RME and Device Fault Manager User Guides for more information on pending devices.
The Change ACS Setup page appears after you click OK.
Step 4
The Update ACS Configuration check box appears in the ACS Tasks pane only if the server is in ACS mode.
Step 5
The following popup message appears:
Please ensure that local server is an AAA client to ACS server.Step 6
The Configure ACS Mode page appears with the pre-populated values in the ACS Mode Setup.
Step 7
You need to provide the current System Identity Username and Password. The NDG should be already be preset in ACS. You must also provide the Shared Secret key.
Step 8
Step 9
Assigning Device Group
After you have integrated the CiscoWorks server with Cisco Secure ACS and assigned appropriate roles to the user you would not be able to see the devices added in DCR if the devices are not added as AAA clients to Cisco Secure ACS. CiscoWorks Assistant lets you add the missing devices into the appropriate NDG in ACS.
Common Services displays a report that has the list of DCR devices that need to be configured in ACS. See Generating Reports in DCR section of the User Guide for CiscoWorks Common Services 3.1, for details.
The Assign Device Group check box appears only if there are missing DCR devices in ACS. You can assign the devices to the appropriate NDG.
To assign device groups:
Step 1
CiscoWorks Assistant checks whether there are pending devices in DFM and RME. If CiscoWorks Assistant finds there are pending devices, the Pending Device Count table is displayed. It shows the following details:
•
•
•
•
Along with the table, a Notification pop up window appears with the following message:
Pending devices exist or could not check for pending devices in some LMS applicationsStep 2
Step 3
LMS server(s) ACS configuration will not be proper if there are pending devices in the LMS applications. Make sure there are no pending devices and click OK to continue.To get further details on pending devices in the applications, go to:
•
•
See RME and Device Fault Manager User Guides for more information on pending devices.
The Change ACS Setup page appears after you click OK.
Step 4
Step 5
The Assign Device Group page appears.
Step 6
•
•
•
•
Step 7
Step 8
•
Run /etc/init.d/dmgtd stop
•
Run net stop CRMdmgtd or net stop crmdmgtd
Step 9
•
Run /etc/init.d/dmgtd start
•
Run net start CRMdmgtd or net start crmdmgtd
Viewing the Server Setup Summary
You can view a summary of the tasks that you performed during the workflow, after you complete the workflow steps.
To view the summary, click Next after you perform the workflow steps.
The Server Setup Summary page is displayed. with the following details:
The information on this page depends on the tasks that you performed.
You need not perform all of the Server Setup workflow tasks to view the Summary. You may skip the steps that you do not need to perform during a workflow session.
For example, you may perform the Manage Servers tasks and skip all the other tasks to get to the Summary page. The Summary page in this case, displays only the summary related to the Manage Servers tasks.
Session Details
The Session Details table displays the Start Time and the User Name for the current session.
Server Summary
The Server Summary lists all the servers in the setup. The fields in the Server Summary and their descriptions are given below.
•
•
•
•
•
When you click the Expand button of the CiscoWorks server, it lists the applications installed in that server.
ACS Summary
The ACS Summary table lists all the servers and their current mode. The mode can be ACS or Non-ACS.
Operation Summary
The Operation Summary tables display the tasks that you performed during the Server Setup workflow. The fields in the Operation Summary, and their descriptions are given below
•
•
•
Click Finish to go to the Server Setup home page and end the current session.
