Table Of Contents
Configuring LMS Server Using CiscoWorks Assistant
Logging into CiscoWorks Assistant Server Setup Home Page
CiscoWorks Assistant Server Setup Home Page
Accepting Certificate Information
Viewing Server Addition Summary
Setting up System Identity User
Setting and Editing the Device Management Mode
Allocating Device Groups to CiscoWorks Applications
Viewing Auto Allocation Summary Report
Viewing Server Management Status
Setting Default Credential Sets
Editing a Default Credential Set
Viewing Credential Sets Status
Configuring Device Credential Policies
Adding a Device Credentials Policy
Editing a Device Credentials Policy
Deleting a Device Credentials Policy
Defining the Order of Device Credential Policies
Viewing Device Credentials Policy Configuration Status
Adding Devices Using Bulk Import From File
Adding Devices Using Bulk Import From NMS
Adding Devices Using Common Services Device Discovery
Viewing Allocate Devices Status
Viewing the Configure ACS Mode Status
Viewing the Configure ACS Mode Result
Viewing the Server Setup Summary
Configuring LMS Server Using CiscoWorks Assistant
The Server Setup workflow helps you to setup and manage CiscoWorks LAN management Solution (LMS) servers. It helps you to simplify the deployment and setting up of single or multiple LMS servers.
The Server Setup workflow assists you in:
•
Managing LMS Servers—You can add servers, set up System Identity User accounts, and set up the device management mode.
•
•
•
•
•
This chapter also contains:
•
•
•
Before You Begin
Before you start using the Server Setup workflow, review the following topics:
•
•
•
About Single-Server and Multi-Server Setups
If the CiscoWorks applications are installed on a single LMS server, the setup is considered as a Single-server setup.
For large deployments, you may opt to have multiple servers for a single managed network by distributing applications across multiple servers for better performance and scaling. This setup is considered as a Multi-server setup. The Multi-server setup requires the various LMS servers part of the setup work in sync with each other.
You will encounter the following terms and concepts while setting up and working on a Multi-server setup:
•
Peer Server Certificates are used to allow one CiscoWorks server to communicate with another using SSL. In a Multi-server set up you have two or more servers on which CiscoWorks applications are installed. CiscoWorks allows you to add the certificate of another CiscoWorks server (a peer server) into its trusted store.
•
Communication between multiple CiscoWorks servers is enabled by a trust model addressed by certificates and shared secrets. System Identity setup should be used to create a trust user on Slave servers to facilitate communication in Multi-server scenarios. This trust user is called System Identity User. The System Identity User is also used for inter-process communication.
A default System Identify User
adminis created during installation. During the installation, you should provide the password for System Identity user. This password can be different from the password you provide for theadminuser used to log in to CiscoWorks.CiscoWorks Assistant allows you to create a System Identity User in all servers that are part of the Multi-server set up.
The System Identity User is a Local User with all privileges. The user will automatically be made a Peer Server User too.
If the LMS server is in ACS mode, the System Identity User should be present in ACS user data base with Super Admin privileges assigned.
•
Peer Server Account Setup helps you create users who can programmatically login to CiscoWorks servers and perform certain tasks. These users should be set up to enable communication between multiple CiscoWorks servers. Peer Server Account can be set up in Common Services.
•
The DCR lets you manage the device list, and associated credentials and other user-defined device attributes at a single place, in a management domain. In a Multi-server setup, where each server could host one or more LMS application instances, the DCR serves as a single place from where you can manage the device lists and related attributes, for use by all applications in the setup.
DCR helps multiple applications share device lists and credentials using a client-server mechanism, with secured storage and communications. The CiscoWorks applications can read or retrieve the information from this repository.
–
–
The Slave servers keep their copy of the DCR data, in sync with the Master DCR.
The Master DCR server refers to the master repository of device list and credential data. There is only one Master repository for each management domain, and it contains the most up-to-date device list and credentials. DCR Slaves are slave instances of DCR on other servers and provide transparent access to applications installed on those servers.
Any change to the repository data occurs first in the Master with the changes being propagated to all the Slaves. There can be more than one Slave in a management domain but any slave can become a master at any time.
In Standalone mode, DCR maintains an independent repository of device list and credential data. It does not participate in a management domain and its data is not shared with any other DCR. It does not communicate with or contain registration information about any other Master, Slave, or Standalone DCR.
Devices newly added in DCR can be managed by an application in following ways
•
•
•
The Single Sign On (SSO) feature helps you to use a single session to navigate to multiple CiscoWorks servers without having to authenticate to each of them.
For Single Sign On, one of the CiscoWorks servers needs to be set up as the authentication server. The SSO authentication server is called the Master, and the SSO regular server is called the Slave. If there is no SSO Master server configured in your setup, the local server is selected as SSO Master.
You must perform the following tasks if the server is either configured as Master or Slave:
•
•
About AAA Mode
CiscoWorks provides a robust security mechanism to manage identity and access to the CiscoWorks applications, and data in a multi-user environment.
By default, CiscoWorks Server authentication (CiscoWorks Local) is used to authenticate users, and authorize them to access CiscoWorks applications. After authentication, your authorization is based on the privileges that have been assigned to you.
A privilege is a task or an operation defined within the application. The set of privileges assigned to you defines your role. It dictates how much, and what type of system access you have.The CiscoWorks Server authorization scheme has pre-defined roles. In this mode, you cannot change the roles, or the privileges assigned to these roles. However, a user can be assigned a combination of these roles.
CiscoWorks Server can be integrated with Cisco Secure Access Control Server (ACS) to provide improved access control using authentication, authorization, and accounting (AAA). Cisco Secure ACS provides authentication, authorization, and accounting services to network devices that function as AAA clients.
In ACS mode, you can create custom roles to best suit your business workflow and needs. That is, you can create a user, and assign the user with a set of privileges, that would suit your needs.
CiscoWorks Assistant helps you in changing the login module of all servers part of the multi-server set up to ACS mode. See Changing ACS Setup for details. See also, Adding Server Details.
Implications of DCR and SSO Modes on Server Setup Workflow
The Server Setup workflow assists you in setting up a Multi-server set up. You can add servers, create System Identity Users, modify the device mode, add and manage devices, and change the AAA mode to ACS using the workflow.
If you are installing the CiscoWorks applications for the first time, the setup will be considered as a Single-server setup, and the local host will be displayed in the table.
In a Multi-server setup, the Server Setup workflow runs only on the DCR Master server.
In Server Setup workflow, the local server will be treated as DCR Master server if the setup is converted from Single-server setup to Multi-server setup. That is, using CiscoWorks Assistant if you add another server to a Standalone server, the DCR mode of the Standalone server to which the new server is added will be changed to Master.
A Multi-server setup must have one SSO Master. The other LMS servers must be in SSO Slave mode. If there is no SSO Master server configured in your setup, the local server is set as SSO Master.
If the server is already configured for Multi-server setup, CiscoWorks Assistant automatically performs a Server Discovery to collect all the server information in the setup and displays it. Server Discovery runs once every hour.
The existing server setup will be discovered when you invoke the CiscoWorks Assistant workflow pages, if the last discovery occurred before 60 minutes. Also, Server Discovery runs at the end of the Manage Server tasks and CiscoWorks Assistant collects all the updated information.
If the SSO Master is not reachable, you cannot perform any operation in the Server Setup workflow. Also, if any of the servers is unreachable, you cannot perform the Manage Servers and Change ACS Mode Setup steps.
Navigating Within Server Setup Workflow
If you are starting the workflow for the first time, click Start Setup to enter into the Server Setup workflow.
To get back to the initial Server Setup workflow screen from any other screen, click Cancel.
If you have operated the workflow earlier, and logged out from the CiscoWorks, or closed the browser after a particular task, you can continue from that task. To do this, click Enter Setup.
The links in the Server Setup table-of contents (at the top-left corner of the screen) are disabled after you enter the workflow.
After you enter the Server Setup workflow, you can navigate among the available options using the Back, Skip, Next and Cancel buttons.
•
Takes you to the previous screen. When you click Back, the previous step will not be rolled back. CiscoWorks Assistant does not retain the values you entered previously.
•
Allows you to skip a task, and get to the next task. For example, if you want to get to the Default Credential Sets page from the Manage Servers page, without getting into the System Identity User Setup or Device Management mode page, click Skip.
•
Takes you to the screen that is after the current screen.
•
Takes you to the initial Server Setup workflow screen from any screens. When the cancel action is performed during the middle of an task or a process, the task or the process will not be terminated, instead it will be executed from background.
CiscoWorks Assistant runs only one instance of Server Setup workflow. You can end an active session of another user if there are no operations running in that session. To end the session, you need to enter the System Identity User details. If any operations are running, you cannot end the session.
Also, multiple operations cannot be initiated by the same user, simultaneously. The operation is allowed only after the operation that is in progress is completed.
To go to the CiscoWorks Assistant home page click Home.
Logging into CiscoWorks Assistant Server Setup Home Page
Before you start with the Server Setup workflow, read the Before You Begin topic to help you understand the features better.
The initial screen for the workflow is the Current System Identity screen.
To access the Server Setup workflow,
Step 1
Step 2
Step 3
The Server Application List window appears. See CiscoWorks Assistant Server Setup Home Page for details.
To go back to the CiscoWorks Assistant home page, click Cancel.
CiscoWorks Assistant Server Setup Home Page
The Server Application List window appears after entering the system identify user details in the Current System Identity screen.
Table 3-1 described the fields in the Server Application List window.
Table 3-1 Server Application List Window Details
LMS Server
IP Address of the LMS server or Display Name of the LMS server.
Reachability
Reachability status of the LMS server.
When you click the Expand button of the LMS server, a new pane gets added to the Server Application List window. Table 3-2 described the fields in the new pane.
You can perform the following Server Setup workflow tasks:
•
•
•
•
•
•
After you complete the Server Setup workflow, you can view a detailed summary of all the tasks that you have performed during the workflow. See Viewing the Server Setup Summary for details.
Managing LMS Servers
The Manage Servers page displays the CiscoWorks server Details. This page allows you to:
•
•
•
•
•
You can also:
•
•
•
•
•
Note
Viewing Server Details
To view server details:
Step 1
The Server Application List table lists the LMS servers.
Step 2
The CiscoWorks Server Details table appears with the following details.
•
•
•
•
•
•
•
See the User Guide for CiscoWorks Common Services 3.3 for information on DCR and SSO modes.
Adding a Server
To add a server you must:
Step 1
See Adding Server Details for details.
Step 2
See Accepting Certificate Information for details.
Step 3
See Setting up the System for details.
Step 4
See Setting up System Identity User for details.
After you add a server, you can set up the Device Management mode for all applications (See Setting and Editing the Device Management Mode). This determines whether the devices should be managed by the different applications when they are added to the DCR.
You can view a summary of server addition, after you complete the necessary tasks. See Viewing Server Addition Summary for details.
Adding Server Details
To add details to a CiscoWorks server:
Step 1
Step 2
The Add Server dialog box appears.
Step 3
•
•
•
•
•
If the DCR Master (local server) is in ACS mode, you should enter the Network Device Group (NDG) details.
CiscoWorks Assistant will convert the server you add here into ACS mode, after the Manage Servers workflow has completed.
Select an option "Register all installed applications with ACS" to register all the installed applications with the ACS Server for the first time.
If an application is already registered with ACS, the current registration will overwrite the previous registration.
Hence any custom role that has been created in ACS will be lost for those applications.
If the server you are adding has already been integrated with another ACS server, it will get integrated to the ACS server to which the DCR Master (local server) is integrated, after the successful completion of Manage Servers step.
You must restart the daemon manager in the server that you have added, after the Manage Server process is complete. If you have added multiple servers, you must restart the daemon manager in all of the servers that you have added.
If the DCR Master is in CiscoWorks Local mode, you cannot add servers that are in ACS mode.
Step 4
The CiscoWorks server is contacted to validate the Device and Credential Repository settings, and to fetch the Certificate information. See Accepting Certificate Information for details.
Accepting Certificate Information
If a CiscoWorks server needs to communicate to another CiscoWorks server, it must possess the certificate of the other server. You can add certificates of any number of peer CiscoWorks servers to the trusted store.
For more information on certificates, and importing peer server certificates, see the following sections in the User Guide for CiscoWorks Common Services 3.3:
•
•
To view and accept the certificate:
Step 1
The Server Setup window appears with the following certificate information.
•
•
•
•
•
•
•
•
Step 2
Step 3
The Server Setup window is displayed. You can set the SMTP server and the CiscoWorks E-mail ID to receive e-mails from CiscoWorks server. See Setting up the System for details.
Setting up the System
The Server Setup window allows you to set up the SMTP server, and the CiscoWorks E-mail ID. The SMTP settings in CiscoWorks Assistant are specific to a server. If you change the SMTP settings in DCR master (local server), the SMTP server name and e-mail ID is set in the DCR master (local server) alone.
To change the SMTP settings in slaves, you need to go to the individual servers and set up SMTP details.
Step 1
This is the system-wide name of the SMTP server used by CiscoWorks applications to deliver reports. The default server name is localhost.
Step 2
This is the CiscoWorks e-mail ID from which applications send e-mail notifications. There is no default e-mail ID.
These fields will be already populated if the SMTP server and e-mail ID have been set up in the Common Services > Server > Admin > System Preferences screen or using LMS Setup Center.
Step 3
Viewing Server Addition Summary
The Add Server Summary page provides the following details:
•
•
•
–
–
•
–
–
When you add a server to the existing setup, the added server will become SSO and DCR Slave. However, if you want to make the added server the SSO Master, select the Set as Master check box.
CiscoWorks Assistant does not allow you to convert the DCR mode of the added server from Slave to Master because this could result in applications losing data. You can go to the Setting up System Identity User procedure, after you complete the Add Server procedure.
To go to the Default Credential Sets Page, click Skip.
Editing Server Details
To edit a server:
Step 1
Step 2
The Edit Server dialog box appears.
This dialog box has pre-populated values in Hostname/IP address, Protocol, Port and Current SSO Settings fields. All fields in the Edit Server dialog box can be edited, except the Hostname/IP address, Protocol, Port, and Current SSO settings fields.
•
•
Step 3
Step 4
The New System Identity User window appears.
Step 5
•
Or
•
The Device Management Mode page appears.
Step 6
See for Setting and Editing the Device Management Mode more information.
If you do not want to change the settings, click Next when you get to this page without making any modifications to the existing Device Management mode. The Skip button is disabled in this page.
The workflow initiates after you click Next. The modifications you made are saved when the tasks are complete.
Deleting a Server
To delete a server from the setup:
Step 1
Step 2
Step 3
The Delete Confirmation popup appears.
Step 4
The Marked for Deletion tag appears adjacent to the server you selected in Step 2.
Step 5
The New System Identity User window appears.
You can skip the New System Identity User procedure if you do not want to change the current System Identity User details. To do this, click Skip.
The Device Management Mode page appears.
Step 6
You can change the Device Management mode here. This page does not have a Skip button. You need to click Next to proceed with the tasks. The workflow initiates after you click Next.
The server marked for deletion will be removed from the set up after the Manage Servers tasks are complete.
The Marked for Deletion tag appears only for servers that are already added.
If you add a server and delete it immediately after adding it, that is, if you perform the Add Server and the Delete Server tasks in same UI session, the Marked for Deletion tag does not appear in the screen.
In this case, the newly added server is not marked for deletion, and is removed from the screen when you click OK in the Delete Confirmation pop-up.
Retaining a Server Marked for Deletion
To retain a server marked for deletion:
Step 1
Step 2
The Undelete button appears only if you select a server that is marked for deletion.
The Undelete Confirmation pop up appears
Step 3
If you try to add a server that is marked for deletion back to the set up, using the Add button, the Undelete Confirmation pop-up is displayed. Click OK to retain the server in the setup.
After the server is deleted from the setup, the deleted server goes into the DCR Standalone and SSO Standalone modes. The workflow also removes the Trust that is set up from all the deleted servers.
You cannot remove the local server from the setup.
If you remove the SSO Master, you can assign any other server as the SSO Master. If you do not select another server as the SSO Master, the workflow will assign the local server as the SSO Master. If you remove the SSO Master, the Multi-server setup is not removed.
You cannot delete the DCR Master.
In a Multi-server setup that has two servers, the workflow will remove the Multi-server setup if you remove one of the servers. In such a case, the local server switches to the Standalone mode.
Setting up System Identity User
System Identity setup helps you to create a trust user on servers that are part of a Multi-server setup. This user enables communication among servers that are part of a management domain. There can only be one System Identity user for each server.
The System Identity user you configure must be a Peer Server user.
•
•
See User Guide for CiscoWorks Common Services 3.3 for more details on System Identity setup.
Before you set up the System Identity user, you must add the server.
To set up the System Identity user:
Step 1
Step 2
The New System Identity Setup page appears.
If you want to change the System Identity setup values, enter the new System Identity username and password in the text field, re-enter the password in the confirm password field, and click Next to complete the System Identity User setup.
CiscoWorks Assistant ensures the new user you create has all the necessary privileges. CiscoWorks Assistant ensures that the new user you create, has all privileges.
Otherwise, click Skip.
Setting and Editing the Device Management Mode
The Device Management mode determines whether the new devices are automatically managed by CiscoWorks applications.
You have to add your server before you get to this stage. If you are in a Multi-server setup, you must also set up a System Identity user before you begin this task.
See the application-specific User Guides to know more about device management modes in different CiscoWorks applications.
To set the Device Management mode:
Step 1
The Device Management Mode page appears.
The possible device management modes are given in Table 3-3.
By default, the Device Management Mode page in CiscoWorks Assistant shows the current status of the device management mode of applications that have been set up in their respective Device Management Settings pages.
Step 2
•
•
•
Note
Step 3
The workflow performs the assigned tasks when you click Next in the Device Management Mode page. The Manage Servers progress page displays the Server Management status and the Manage Server tasks gets completed here. See Viewing Server Management Status for details.
Step 4
Allocating Device Groups to CiscoWorks Applications
You must assign the device groups to CiscoWorks applications when you have configured the device management mode as Auto Allocation - Allocate by Groups. The Auto Allocation page that appears after the Device Management page helps you to perform this task.
The Assign Groups page appears only when at least one CiscoWorks application is configured with Allocate by Groups mode.
To assign the device groups to CiscoWorks applications:
Step 1
The Auto Allocation page appears. It displays:
•
•
You can click Refresh to get the latest information (device groups) in Device Group Selector.
You can also create new groups or edit groups in the Common Services Group Administration page. To do so, click Group Admin located at the bottom of the Assign Groups page.
Step 2
Step 3
Step 4
To cancel the selection process, click Cancel.
Step 5
Step 6
Step 7
Step 8
A detailed report containing the device management status is displayed in tabular format. See Viewing Auto Allocation Summary Report for details.
Viewing Auto Allocation Summary Report
After you have completed assigning device groups to all CiscoWorks applications whose Device Management mode is Auto Allocation - Allocate by Groups, you can see a detailed report of the device management status.
To view the Auto Allocation Report:
Step 1
The Auto Allocation Summary Report appears with the details given in Table 3-4.
Step 2
Viewing Server Management Status
The Manage Servers progress page that appears after you complete the Device Management mode and Group Assignment setup, displays the status of the Manage Server tasks that you have performed.
For information on setting up Device Management mode, see Setting and Editing the Device Management Mode.
To view the Manage Severs tasks status:
Step 1
The Manage Servers Progress page appears.
This process takes some time to check the status of various tasks.
You can either:
•
You can view the status after you get an e-mail notification that the tasks have completed. See Setting up E-mail Notification After Managing Server Tasks for details.
Or
•
The status on the following is displayed:
•
•
•
•
•
•
•
•
–
–
•
•
•
Step 2
If a step fails, the Last Accessed URL column in the report will display the shortcut URL for that particular step. It will not display anything, if the step is successful.
Setting up E-mail Notification After Managing Server Tasks
You can exit the workflow after you complete the tasks and return later to view the status. You should do this after getting an e-mail notification.
To do this:
Step 1
Step 2
The e-mail ID will be displayed in the text field if you had entered an e-mail ID in the Manage Servers flow. Otherwise, the default e-mail address
YourName@YourDomainName.comis displayed.Only one e-mail ID is allowed.
The e-mail ID can contain alphabets, numbers, and special characters ($, _, ^, &, #).
For example:
•
user_cwa1@cisco.com•
Name_12#@abc.co.inThe following message appears:
An e-mail will be sent to the selected E-mail address after the process has completed.Step 3
The initial Server Setup workflow page is displayed.
You will receive an e-mail after the tasks have completed.
Step 4
Setting Default Credential Sets
DCR manages the details of multiple default credential sets. Each Default credential set comprises of the components listed below. The Default credential set can be associated with the each device while adding or importing devices into DCR.
Each default credential set comprises:
•
•
•
•
•
•
•
The recommended multiple default credential sets configurations are set to 50 default credential sets. You can use the default credentials for devices and edit their credentials appropriately. You can configure the default credentials and use them in the applications. Similar to Common Services, if the default credentials cannot be accessed from DCR, CiscoWorks Assistant will not assign the credentials.
All the credential information will be populated from the DCR Master. If the credentials are already available in DCR database, they will be updated by the new values you enter, after setting default credentials.
To set the device credentials:
Step 1
The Default Credential Sets page appears.
You can:
•
•
•
•
•
•
Step 2
The Credential Sets Progress page appears. This page provides the status of the Credential Sets tasks. See Viewing Credential Sets Status.
Adding Credential Set Name
To add the Credential Set name:
Step 1
The Credential Set page appears.
Step 2
Step 3
The specified name will be appended with the screen name.
Specify the credential set name with the constrains listed below:
•
•
•
Step 4
Step 5
•
•
•
•
•
Step 6
•
•
•
•
•
You must enter a value for at least one credential before applying the default credentials.
Step 7
To cancel the changes, click Cancel.
To delete a default credential set, click Remove. A delete confirmation popup appears.
Setting Standard Credentials
To set Standard credentials:
Step 1
The Standard Credential page appears.
Step 2
•
•
Step 3
Setting SNMP Credentials
To set SNMP credentials:
Step 1
The SNMP Credential page appears.
Step 2
•
•
You must select the SNMPv3 checkbox to enter the SNMPv3 Credentials. By default, these fields are disabled.
Step 3
Step 4
•
•
•
You can enter the SNMPv3 credentials based on the selected mode.
Step 5
Step 6
The Authentication Algorithm field value can be MD5, SHA-1, or None.
Step 7
Step 8
The Privacy Algorithm field value can be DES, 3DES, AES128, AES192, AES256, or None.
Step 9
Setting HTTP Credentials
To set HTTP credentials:
Step 1
The HTTP Credential page appears.
Step 2
•
•
Step 3
Step 4
Step 5
•
•
Step 6
Setting Auto Update Server
To set Auto Update Server Managed Device credentials:
Step 1
The Auto Update Server Managed Device Credential page appears.
Step 2
Step 3
Setting Rx Boot Mode Credentials
To set Rx Boot Mode credentials:
Step 1
The Rx Boot Mode Credentials page appears.
Step 2
Step 3
Editing a Default Credential Set
To edit a default credential set,
Step 1
The Credential Set page appears.
Step 2
The details relevant to the selected credential set will be displayed for editing.
Specify the credential set name with the constrains listed below:
•
•
•
Step 3
•
•
•
•
•
Step 4
To cancel the changes, click Cancel.
Viewing Credential Sets Status
To view the Credential Sets status:
Step 1
The Credential Sets Progress page is displayed.
This process takes some time to check the status of various tasks.
You can either:
•
You can view the status after you get the e-mail notification that the task have completed. You should do this after getting an e-mail notification.
Or
•
Step 2
If a step fails, the Last Accessed URL column in the report will display the shortcut URL for this step. It will not display anything, if the step is successful.
See User Guide for CiscoWorks Common Services 3.3 for more information on Default Credentials.
Step 3
You can exit the workflow after you complete the tasks and return later to view the status. You should do this after getting an e-mail notification.
You will receive an e-mail notification only if you have configured the e-mail address. See Setting up E-mail Notification After Managing Server Tasks for details.
Configuring Device Credential Policies
You can configure device credential policies and apply the credentials for a range of devices to be added or imported to DCR. The recommended device credentials policy configurations are set to 50.
You can create device credential policies based on the following policy types:
•
•
•
To configure a device credentials policy:
Step 1
The Device Credentials Policy Configuration page appears.
You can:
•
•
•
•
Step 2
The Device Credentials Policy Configuration Progress page appears. This page provides the status of the policy configuration. See Viewing Device Credentials Policy Configuration Status.
Adding a Device Credentials Policy
To add a new device credentials policy:
Step 1
The Add Device Credentials Policy Configuration dialog box appears.
Step 2
a.
The listed parameters are IP Range, Hostname and Display Name.
b.
Examples are provided with the relevant Online help link below, based on the selection made.
See the following sections in the Administering Device and Credential Repository of Managing Device and Credentials chapter in User Guide for CiscoWorks Common Services 3.3 for more details:
–
–
http://www.cisco.com/en/US/products/sw/cscowork/ps3996/products_user_guide_list.html
c.
Step 3
The policy that you have configured is listed in the Device Credentials Policy Configuration page.
To close the Add Device Credentials Policy Configuration dialog box, click Cancel.
Step 4
The Device Credentials Policy Configuration Progress page appears. See Viewing Device Credentials Policy Configuration Status.
Editing a Device Credentials Policy
To edit a device credentials policy:
Step 1
Step 2
The Edit Device Credentials Policy Configuration dialog box appears.
This dialog box has pre-populated values.
Step 3
Step 4
The policy that you have edited is listed in the Device Credentials Policy Configuration page.
To close the Edit Device Credentials Policy Configuration dialog box, click Cancel.
Step 5
The Device Credentials Policy Configuration Progress page appears. See Viewing Device Credentials Policy Configuration Status.
Deleting a Device Credentials Policy
To delete a device credentials policy:
Step 1
Step 2
The Delete Confirmation popup appears.
Step 3
Step 4
The Device Credentials Policy Configuration Progress page appears. See Viewing Device Credentials Policy Configuration Status.
Defining the Order of Device Credential Policies
To specify the order of device credential policies:
Step 1
Step 2
•
or
•
Step 3
The default credential set policies are applied in the order they appear on the Credentials Sets Policy Configuration page. The default credential set policies appearing at the top of the list are applied first.
The Device Credentials Policy Configuration Progress page appears. See Viewing Device Credentials Policy Configuration Status.
See Administering Device and Credential Repository section in the Managing Device and Credentials chapter of the User Guide for CiscoWorks Common Services 3.3 for more information on Defining the Order of Device Credential Policies:
http://www.cisco.com/en/US/products/sw/cscowork/ps3996/products_user_guide_list.html
Viewing Device Credentials Policy Configuration Status
To view the Device Credentials Policy Configuration status:
Step 1
The Device Credentials Policy Configuration Progress page is displayed.
You can either:
•
You can view the status after you get the e-mail notification that the tasks have completed. See Setting up E-mail Notification After Managing Server Tasks for details.
Or
•
Step 2
If a step fails, the Last Accessed URL column in the report displays the shortcut URL for that particular step. It will not display anything, if the step is successful.
Step 3
Adding Devices
You can add devices to the Device and Credentials Repository (DCR) using the following methods:
•
•
•
CiscoWorks Assistant allows you to add devices using multiple methods, simultaneously. You can add devices using the Import from File feature, Import from NMS, and Common Services Device Discovery at the same time.
You can also:
•
•
•
To add devices you can either:
•
Or
•
Adding Devices Using Bulk Import From File
To import from a file:
Step 1
The File Information pane appears. This is the default.
Step 2
Or
a.
The Server Side File selector dialog box appears.
b.
The Server Side File Selector dialog box displays the files on the remote server on which the Server Setup workflow is running.
Step 3
Only CSV 2.0 and CSV 3.0 file formats are supported.
See the User Guide for CiscoWorks Common Services 3.3 for sample CSV and XML files.
Step 4
This is to resolve conflicts that may occur if the devices are present both in the import source and DCR, but differ in their attributes.
•
•
Step 5
•
•
•
Adding Devices Using Bulk Import From NMS
To import from NMS:
•
Or
•
The NMS Information screen appears.
You can do a bulk import either from:
•
Or
•
Performing Bulk Import From Local NMS
To perform a bulk import from Local NMS:
Step 1
Step 2
Step 3
For example:
C:\Program Files\HP OpenViewStep 4
This is to resolve conflicts that may occur if the devices are present both in the import source and DCR, but differ in their attributes.
•
•
Step 5
•
•
•
Performing Bulk Import From Remote NMS
To do a bulk import from Remote NMS:
Step 1
Step 2
Step 3
Step 4
Step 5
If you select the NMS type as ACS, enter the root password, port and protocol along with the hostname and root username in the corresponding fields.
Step 6
This is to resolve conflicts that may occur if the devices are present both in the import source and DCR, but differ in their attributes.
•
•
Step 7
•
•
•
Adding Devices Using Common Services Device Discovery
To run Discovery:
•
Or
•
The Add Devices page appears. This page contains the Run Discovery check box for each server.
To specify Device Discovery Settings:
Step 1
The Discovery window appears with the following tabs.
Step 2
For more information, see the User Guide for Common Services 3.3 on the Discovery Settings.
Discovery Module Tab
The following are the various protocols and options in the Discovery module:
Table 3-5 displays the Layer 3 Discovery Protocols.
Table 3-6 displays the Layer 2 Discovery Protocol.
Table 3-7 displays the Ping Discovery options.
Table 3-8 displays the Cluster Discovery and Hot Standby Router Protocol module details.
Seed Devices Tab
Seed devices are the devices used to initiate network Discovery. A seed device is the starting point from which Common Services Device Discovery discovers the network and its peer or neighbor devices.
The following module specific details are displayed in the Seed Devices tab. These modules are displayed based on the selection in the Discovery Module tab.
•
•
•
•
•
•
•
•
To add seed devices from this tab:
Step 1
The list of modules selected in the Module Settings page is displayed if you have selected
Module Specific.Step 2
The Module Specific or Global Seed Devices settings appears at the right.
Step 3
If you do not know the path, you can click Browse and select a file from the list.
Step 4
This option is not available for the Ping Sweep On IP Range option. You must enter the credentials mentioned in Step 6.
Step 5
This option is available only for CDP Module.
You must be cautious about enabling Discovery to occur beyond router boundaries. This is because Discovery could take much longer if you do not selectively choose the boundaries by excluding specific IP addresses.
Step 6
•
•
•
Step 7
a.
b.
c.
This field is available for all Discovery modules except Ping Sweep On IP Range.
Hop count limits the scope of Device Discovery. Device Discovery cycle may take a longer time if you enter a greater value of hop count.
You must enter values greater than 1 as hop count.
d.
The default value is 255.255.255.255. This field is available only for Ping Sweep On IP Range Discovery module.
If you enter a smaller Subnet Mask value, it may result in a longer Discovery cycle because Discovery has to sweep IP Addresses from more networks. The addresses in the Seed Device and Subnet Mask fields also support IPv6.
You can also do the following:
•
•
SNMP Settings Tab
You can configure SNMP credentials to run Device Discovery. You must configure either SNMPv2 or SNMPv3 credentials by selecting the appropriate radio buttons.
•
•
You must configure the respective protocols to enable the fallback options.
For example, to fallback to SNMPv2c from SNMPv3, you should have configured SNMPv2c settings.
Table 3-9 displays the SNMPv2 details.
Table 3-10 displays the SNMPv3 field details.
Filter Settings Tab
Filters allow you to include or exclude devices from the network. For more information on Filters, see Configuring Discovery Filter Settings section in the User Guide for Common Services 3.3.
You can select a filter from the Use Filter drop-down list.
The supported filters are:
•
•
•
•
You can either include or exclude a filter by selecting either the Include or Exclude radio buttons.
From the filter settings you can Add and Delete a Filter.
To add a filter:
Step 1
IP Address is the default filter. The address also supports IPv6.
Step 2
Step 3
For SysObjectID filter, you can either enter the value manually or select a SysObjectID from the Device Type Selector. The Device Type Selector appears after you have selected a SysObjectID filter from the Use Filter drop-down list.
Step 4
The filter is added into the Added List field.
To delete the filter, select the filter from the Added List and click Delete.
Global Settings Tab
In the Global Settings tab, you can view the details shown in Table 3-11.
Setting SNMPv2 Parameters
To add or edit SNMPv2 parameters:
Step 1
Step 2
Step 3
You can select the SNMPv2c to SNMPv1 Fallback check box, to enable fallback to SNMPv1 from SNMPv2c.
Step 4
The SNMP V2 popup appears.
Step 5
•
•
•
•
•
Step 6
•
Or
•
Step 7
The SNMPv2 popup appears with the existing values.
Step 8
•
Or
•
Step 9
Setting SNMPv3 Parameters
To add or edit SNMPv3 parameters:
Step 1
Step 2
Step 3
You can select the SNMPv3 to SNMPv2c Fallback check box, to enable fallback to SNMPv2c from SNMPv3. You should have configured SNMPv2c settings, to enable fallback to SNMPv2c from SNMPv3.
Step 4
The SNMPv3 popup appears.
Step 5
•
•
•
•
•
•
•
Step 6
•
Or
•
Step 7
The SNMPv3 popup appears with the existing values.
Step 8
•
Or
•
Step 9
Viewing Add Devices Status
To view the Add Devices status:
Step 1
The Add Devices Progress page is displayed.
This process takes some time to check the status of various tasks.
You can either:
•
You can view the status after you get the e-mail notification that the tasks have completed. You should do this only after getting an e-mail notification. See Setting up E-mail Notification After Adding Devices for details.
Or
•
Step 2
If a step fails, the Last Accessed URL column in the report will display the shortcut URL for that particular step. It will not display anything, if the step is successful.
Click Next to go to Manage Devices Tasks. See Managing Devices for details.
Setting up E-mail Notification After Adding Devices
You can exit the workflow after you complete the tasks and return later to view the status. You should do this after getting an e-mail notification.
To do this:
Step 1
Step 2
The e-mail ID will be displayed in the text field if you had entered an e-mail ID in the Manage Servers flow. Only one e-mail ID is allowed.
E-mail ID can contain any characters, numbers, and special characters ($, _, ^, &, #). For example:
•
user_cwa1@cisco.com•
Name_12#@abc.co.inThe following message appears:
An e-mail will be sent to the selected E-mail address after the process has completed.Step 3
The initial Server Setup workflow page is displayed.
You will receive an e-mail after the tasks have been completed.
Step 4
Deleting SNMPv2 Details
To delete the SNMPv2 details:
Step 1
Step 2
Step 3
Step 4
The Delete SNMPV2 Confirmation dialog box appears.
Step 5
Deleting SNMPv3 Details
To delete the SNMPv3 details:
Step 1
Step 2
Step 3
Step 4
The Delete SNMPV3 Confirmation dialog box appears.
Step 5
Managing Devices
This page helps you to allocate devices to be managed by the applications installed in the CiscoWorks servers. It lists the CiscoWorks servers and the applications that are present in each server.
You can select devices from the device selector and add them to the application that you want the device to be managed.
You can also:
•
•
To manage devices:
Step 1
The Allocate Devices page appears.
Step 2
Step 3
Initially, devices must be added to DCR. After a device is added to DCR, you can add it to the applications.
Step 4
Or
Click Reset to reset the added devices in the application.
The Manage Devices screen displays:
•
•
•
Step 5
The Device Management Progress page appears. You can view the Device Management status in this page. See Viewing Allocate Devices Status for details.
About Device Selector
The Device Selector allows you to search for the devices in Device and Credential Repository (DCR). It helps you to locate the devices and perform the device management tasks quickly. With the Device Selector, you need not remember the device type or application group hierarchy to locate the devices.
The devices are categorized under the Device Type based groups, User Defined groups, Subnet Based groups, Application Specific groups or under All Groups.
The CiscoWorks Assistant uses the Common Services Device Selector.
See the Configuring Device Selector section in the Managing Device and Credentials chapter of the User Guide for CiscoWorks Common Services 3.3 for information on using Device Selector:
http://www.cisco.com/en/US/products/sw/cscowork/ps3996/products_user_guide_list.html
You can also access this information from Common Services Online help. From CiscoWorks help, select:
Common Services > Managing Device and Credentials > Configuring Device Selector > Searching Devices.
Viewing Allocate Devices Status
You can view the device management status after you complete the Allocate Devices tasks.
To view the status:
Step 1
The Allocate Devices Progress page appears. This process takes some time to check the status of various tasks.
You can either:
•
You can view the status after you get the e-mail notification that the tasks have completed. You should do this only after getting an e-mail notification.
See Setting up E-mail Notification After Device Management Tasks for details.
Or
•
Step 2
Table 3-12 describes the fields in the status report.
Step 3
Setting up E-mail Notification After Device Management Tasks
You can exit the workflow after you complete the tasks and return later to view the status. You should do this only after getting an e-mail notification.
To do this:
Step 1
Step 2
The e-mail ID will be displayed in the text field if you had entered an e-mail ID in the Manage Servers flow. Only one e-mail ID is allowed.
The e-mail ID can contain alphabets, numbers, and special characters ($, _, ^, &, #).
For example:
•
user_cwa1@cisco.com•
Name_12#@abc.co.inThe following message appears:
An e-mail will be sent to the selected E-mail address after the process has completed.Step 3
The initial Server Setup workflow page is displayed.
You will receive an e-mail, after the tasks have completed.
Step 4
Changing ACS Setup
The CiscoWorks server provides mechanisms used to authenticate users for CiscoWorks applications. The login module determines the type of authentication and authorization CiscoWorks uses.
By default, the login module is set to the native CiscoWorks authentication mechanism, that is, the CiscoWorks Local Login module. You can change this default value to use Cisco Secure ACS for user authentication and authorization.
In CiscoWorks Local mode, you cannot create custom roles, or modify the predefined roles. Cisco Secure ACS allows you to create custom roles and also limit the access to network devices within LMS using Network Device Groups (NDGs).
The details for setting up the CiscoWorks server for non-ACS mode are available in User Guide for CiscoWorks Common Service 3.3.
Change ACS Setup page shows the ACS Mode Status for each CiscoWorks server in the setup. From this page you can:
•
•
The tasks to be performed to complete AAA mode change to ACS can be classified as:
•
–
–
When you change the mode to ACS using CiscoWorks Assistant, you need to manually add the DCR Master server in ACS as an AAA client.
When you change the mode of a Slave, CiscoWorks Assistant adds it to the NDG group you specify.
See Cisco Secure ACS Initial Setup Tasks for details.
•
•
You can also perform the following tasks:
•
•
•
Cisco Secure ACS Initial Setup Tasks
You must define an Administrator in ACS server to provide remote access. To access the Cisco Secure ACS HTML interface from a browser on a remote machine, you must log in to Cisco Secure ACS using an administrator account.
You can perform the necessary steps to do this in the Administration Control tab in the ACS UI. See the white paper, CiscoWorks LMS Integration with Cisco Secure ACS, or the User Guide for Cisco Secure ACS 4.1 for detailed information.
You must then add the CiscoWorks server and the devices it manages as AAA clients in ACS. The ACS workflow does not support IPv6 devices. Hence, IPv6 devices will not be added in ACS.
To add CiscoWorks server as an AAA client:
Step 1
The Network Configuration page appears.
Step 2
•
If NDG option is not visible, you can enable Network Device Groups in ACS under Interface Configuration > Advanced.
Or
•
The Add AAA Client page appears.
Step 3
Step 4
Step 5
Step 6
Step 7
Apart from adding your CiscoWorks server as an AAA client, you also need to add the devices to be managed by the CiscoWorks server as AAA clients to Cisco Secure ACS.
When you are integrating the AAA clients with Cisco Secure ACS, your devices will not be visible from your CiscoWorks server if you have not added them as AAA clients in Cisco Secure ACS.
For information on adding network device groups and AAA client configuration, see the Network Configuration section of the User Guide for Cisco Secure ACS 4.1.
To change ACS settings:
Step 1
The Change ACS Setup page appears.
Change ACS Setup page contains these ACS Mode Status details.
•
•
If the mode is ACS, a link is displayed. Click this link to view the ACS Connection Status for the server.
Step 2
If the server is in ACS mode, the Change ACS Setup page will contain the ACS Tasks pane instead of the Login Module pane. The ACS Tasks pane has these radio buttons:
•
•
Configuring the ACS Mode
To change the mode to ACS:
Step 1
CiscoWorks Assistant checks whether there are pending devices in DFM and RME. If it finds any pending devices, the Pending Device Count table is displayed. It displays:
•
•
•
•
Along with the table, a Notification pop up window appears with the following message:
Pending devices exist or could not check for pending devices in some LMS applicationsStep 2
Step 3
A confirmation pop up appears with the following message:
LMS server(s) ACS configuration will not be proper if there are pending devices in the LMS applications. Make sure there are no pending devices and click OK to continue.To get further details on pending devices in the applications, go to:
•
•
The details are displayed in the screens that appear when you select these menu paths.
See RME and Device Fault Manager User Guides for more information on pending devices.
The Change ACS Setup page appears after you click OK.
Step 4
Note
Step 5
Step 6
If the DCR Master (local server) is already in ACS mode, the fields other than the passwords and secret keys will be pre-populated.
Table 3-13 describes the fields in the ACS Mode Setup table.
Step 7
In case an application is already registered with ACS, the current registration will overwrite the previous registration. When you select the Register all Installed Applications with ACS check box, you are prompted to confirm whether you want to continue with the settings.
See Common Services Online help for details.
Step 8
Step 9
The Configure ACS Mode Progress page is displayed. You can view the ACS mode configuration status in this page. See Viewing the Configure ACS Mode Status for details.
Note
User Configuration in Cisco Secure ACS
The System Identity User has to be created in ACS, and assigned Super Admin role in all applications in ACS.
You should create a user in ACS with the current System Identity username, and assign Super Admin role to that user in all applications in the TACACS + options pane in Group Setup or User Setup UI in ACS.
See Configuring Device Management Command Authorization for a User Group in User Guide for Cisco Secure ACS 4.1.
Note
The final step in integrating CiscoWorks Common Services Software with Cisco Secure ACS is to configure the CiscoWorks users within Cisco Secure ACS. Cisco Secure ACS allows you to define access permissions and policies for the registered CiscoWorks applications either for individual users or for a group of users.
See the following sections of the Cisco Secure ACS User Guide for more information on managing users and user groups:
•
•
While adding the user, you can configure access policies to define what the user is authorized to do, depending on the role.
See Configuring Users in ACS section in User Guide for CiscoWorks Common Services 3.3 for information on:
•
•
See also the white paper on CiscoWorks LMS Integration with Cisco Secure ACS, available on Cisco.com
Viewing the Configure ACS Mode Status
You can view the ACS mode configuration status after you complete the Configure ACS Mode tasks.
To view the status, click Next after configuring the ACS mode.
The Configure ACS Mode Progress page is displayed.
This process takes some time to check the status of various tasks.
You can either:
•
Or
•
The Configure ACS Mode Result page is displayed. See Viewing the Configure ACS Mode Result for details.
Setting up E-mail Notification After Configuring ACS Mode
You can exit the workflow after you complete the tasks and return later to view the status. You should do this after getting an e-mail notification.
To do this:
Step 1
Step 2
The e-mail ID will be displayed in the text field if you had entered an e-mail ID in the Manage Servers flow. Only one e-mail ID is allowed.
The e-mail ID can contain alphabets, numbers, and special characters ($, _, ^, &, #).
For example:
•
user_cwa1@cisco.com•
Name_12#@abc.co.inThe following message appears:
An e-mail will be sent to the selected E-mail address after the process has completed.Step 3
The initial Server Setup workflow page is displayed.
You will receive an e-mail after the tasks have been completed.
Step 4
Viewing the Configure ACS Mode Result
Configure ACS Mode Result page displays the ACS Connection Status of all servers in the setup. To access the Configure ACS Result page you should have changed the server into ACS Mode.
To view the Configure ACS Mode Result page:
Step 1
The Configure ACS Mode result page appears with the following popup message:
Restart the LMS Daemon Manager of the following servers for the ACS changes to take effect:
<Server details>
Make sure the configured System Identity User is available in ACS Server.Step 2
To restart daemon manager:
a.
–
Run /etc/init.d/dmgtd stop
–
Run net stop CRMdmgtd or net stop crmdmgtd
b.
–
Run /etc/init.d/dmgtd start
–
Run net start CRMdmgtd or net start crmdmgtd
The following ACS Connection Status details are shown:
•
•
•
See the Setting up AAA Mode to ACS section in the User Guide for CiscoWorks Common Services 3.3, for further details.
Updating ACS Configuration
You can update the ACS server details using this option. You should have already completed the ACS Mode change to do this.
To update ACS server details:
Step 1
CiscoWorks Assistant checks whether there are pending devices in DFM and RME. If it finds any pending devices, the Pending Device Count table is displayed with the following:
•
•
•
•
Along with the table, a Notification pop up window appears with the following message:
Pending devices exist or could not check for pending devices in some LMS applicationsStep 2
Step 3
A confirmation pop up appears with the following message:
LMS server(s) ACS configuration will not be proper if there are pending devices in the LMS applications. Make sure there are no pending devices and click OK to continue.To get further details on pending devices in the applications, go to:
•
•
The details are displayed in the screens that appear when you select these menu paths.
See RME and Device Fault Manager User Guides for more information on pending devices.
The Change ACS Setup page appears after you click OK.
Step 4
The Update ACS Configuration check box appears in the ACS Tasks pane only if the server is in ACS mode.
Step 5
The following popup message appears:
Please ensure that local server is an AAA client to ACS server.Step 6
The Configure ACS Mode page appears with the pre-populated values in the ACS Mode Setup.
Step 7
You need to provide the current System Identity Username and Password. The NDG should be already be preset in ACS. You must also provide the Shared Secret key.
Step 8
Note
Step 9
Assigning Device Group
After you have integrated the CiscoWorks server with Cisco Secure ACS and assigned appropriate roles to the user you would not be able to see the devices added in DCR if the devices are not added as AAA clients to Cisco Secure ACS. CiscoWorks Assistant lets you add the missing devices into the appropriate NDG in ACS.
Common Services displays a report that has the list of DCR devices that need to be configured in ACS. See Generating Reports in DCR section of the User Guide for CiscoWorks Common Services 3.3, for details.
The Assign Device Group check box appears only if there are missing DCR devices in ACS. You can assign the devices to the appropriate NDG.
To assign device groups:
Step 1
CiscoWorks Assistant checks whether there are pending devices in DFM and RME. If it finds any pending devices, the Pending Device Count table is displayed with the following details:
•
•
•
•
Along with the table, a Notification pop up window appears with the following message:
Pending devices exist or could not check for pending devices in some LMS applicationsStep 2
Step 3
A confirmation pop up appears with the following message:
LMS server(s) ACS configuration will not be proper if there are pending devices in the LMS applications. Make sure there are no pending devices and click OK to continue.To get further details on pending devices in the applications, go to:
•
•
The details are displayed in the screens that appear when you select these menu paths.
See RME and Device Fault Manager User Guides for more information on pending devices.
The Change ACS Setup page appears after you click OK.
Step 4
Step 5
The Assign Device Group page appears.
Step 6
•
•
•
•
Step 7
Viewing the Server Setup Summary
You can view a summary of the tasks that you performed during the workflow, after you complete the workflow steps.
To view the summary, click Next after you perform the workflow steps.
The Server Setup Summary page is displayed. with the following details:
The information on this page depends on the tasks that you performed.
You need not perform all of the Server Setup workflow tasks to view the Summary. You may skip the steps that you do not need to perform during a workflow session.
For example, you may perform the Manage Servers tasks and skip all the other tasks to get to the Summary page. In such a case, the Summary page displays only the summary related to the Manage Servers tasks.
Session Details
The Session Details table displays the Start Time and the User Name for the current session.
Server Summary
The Server Summary lists all servers in the setup. The fields in the Server Summary and their descriptions are given below.
•
•
•
•
•
When you click the Expand button of the CiscoWorks server, it lists the applications installed in that server.
ACS Summary
The ACS Summary table lists all the servers and their current mode. The mode can be ACS or Non-ACS.
Operation Summary
The Operation Summary tables display the tasks that you performed during the Server Setup workflow. The fields in the Operation Summary, and their descriptions are given below
•
•
•
Click Finish to go to the Server Setup home page and end the current session.
Related Documentation
For more information on Multi-server setups, DCR and SSO, see the latest versions of following documents on Cisco.com:
•
http://www.cisco.com/en/US/products/sw/cscowork/ps3996/products_user_guide_list.html
•
http://www.cisco.com/en/US/products/sw/cscowork/ps2425/prod_white_papers_list.html
•
http://www.cisco.com/en/US/products/sw/netmgtsw/tsd_products_support_category_home.html
