Table Of Contents

Guidelines to Post-Upgrade Activities

Guidelines for DFM 2.0.3 Post-Upgrade Activities

Configuring SNMP Trap Receiving and Forwarding

Guidelines for CS 3.0.5 Post-Upgrade Activities

Pre-CS 3.0 AAA Methods

CS 3.0.5 AAA Methods

ACS Mode

Non-ACS Mode

Resetting the Login Module

Guidelines to Post-Upgrade Activities

---

This chapter contains:

•Guidelines for DFM 2.0.3 Post-Upgrade Activities

•Guidelines for CS 3.0.5 Post-Upgrade Activities

•Resetting the Login Module

Guidelines for DFM 2.0.3 Post-Upgrade Activities

After the upgrade script completes, DFM discovers devices and updates its managed inventory. DFM might take some time to complete this task. After the task completes:

•Familiarize yourself with new device management procedures; see Installation and Setup guides for DFM, "Performing Device Management" section in Chapter 4, "Getting Started".

•Verify discovery status; see Installation and Setup guides for DFM, "Verifying Devices Added to DFM" section in Chapter 4, "Getting Started".

•Complete basic configuration steps; see Configuring SNMP Trap Receiving and Forwarding.

•Start using DFM to monitor the network; see Installation and Setup guides for DFM, "Viewing Alerts" section, and "What Next?" section in Chapter 4, "Getting Started".

Configuring SNMP Trap Receiving and Forwarding

If you plan to use HPOV or NetView adapters on a remote system with Device Fault Manager 2.0.3 on a local system:

---

Step 1 Make sure the system running DFM is registered with DNS.

Step 2 Upgrade all remote adapters as described in Installation and Setup guide for DFM, Section "Installing and Upgrading HPOV-NetView Adapters", available at http://www.cisco.com/en/US/products/sw/cscowork/ps2421/prod_installation_guides_list.html

---

By default, DFM receives SNMP traps on port 162 (or, if port 162 is occupied, port 9000). If you need to change the port:

---

Step 1 Go to CiscoWorks homepage and select DFM >Configuration >
Other Configurations > SNMP Trap Receiving.

The configuration page for SNMP trap receiving is launched.

Step 2 Enter the port number in the Receiving Port entry box.

Step 3 Click Apply.

---

If you want DFM to forward traps to a remote NMS:

---

Step 1 Go to CiscoWorks home page and select DFM > Configuration >
Other Configurations > SNMP Trap Forwarding.

The configuration page for SNMP trap forwarding is launched.

Step 2 Enter these for each host:

•An IP address or DNS name for the hostname.

•A port number on which the host can receive traps.

Step 3 Click the Apply button.

Step 4 Make sure the NMS is configured to receive traps at the port you specified in Step 2. See the appropriate documentation for the NMS.

---

If a local version of HP OpenView or NetView is already installed, CiscoWorks automatically configures the adapters to forward SNMP traps to DFM.

To configure remote versions of HP OpenView and NetView to forward SNMP traps to DFM, you must install the HPOV-NetView adapters on the remote systems.

For more details on Basic configuration steps, see Installation and Setup guides for DFM, "Configuring SNMP Trap Receiving and Forwarding" section in Chapter 4, "Getting Started".

Guidelines for CS 3.0.5 Post-Upgrade Activities

This section contains:

•Pre-CS 3.0 AAA Methods

•CS 3.0.5 AAA Methods

Pre-CS 3.0 AAA Methods

Before CS 3.0:

•The CiscoWorks server supported two types of authentication methods. One method used an external PAM (Pluggable Authentication Module) and the other was the CiscoWorks local method.

•Both CiscoSecure ACS (Access Control Server) and third party AAA (Authentication, Authorization, Accounting) servers were treated as external PAMs.

•If you selected an external authentication method using a PAM, the CiscoWorks server would only perform authentication. It would not perform authorization against either the CiscoSecure ACS or the third party AAA server that you selected.

•Authorization was done by the CiscoWorks server, regardless of the authentication method.

•If you selected the CiscoWorks local authentication method, both authentication and authorization were done by the CiscoWorks server.

CS 3.0.5 AAA Methods

CS 3.0.5 supports two AAA modes:

•ACS Mode

•Non-ACS Mode

ACS Mode

If you select ACS mode, the CS 3.0.5 server uses both authentication and authorization from the CiscoSecure ACS server. Since authorization is based on the roles of the user in the CS 3.0.5 server, note the following:

•CS 3.0.5 only supports ACS 3.2, 3.2.3, 3.3.2, and 4.0(1)

•CS 3.0.5 does not support Kerberos PAM

•We recommend that you install the Admin HTTPS PSIRT patch (on ACS 3.2.3). The patch is available at: http://www.cisco.com/public/sw-center/ciscosecure/cs-acs.shtml

•AAA is done by sending a query to ACS using TACACS+ protocol

•To configure the CiscoWorks server to use CiscoSecure ACS, you need:

–The ACS Administrator username and password

–To add the CiscoWorks server as a AAA client (in ACS)

–To configure the secret key to be used (at AAA Mode setup in CS and in ACS)

–To ensure that the login user in CiscoWorks is a valid user in ACS

Non-ACS Mode

CS 3.0.5 supports two types of non-ACS modes: CiscoWorks local and non-CiscoWorks local.

By default, CS 3.0.5 uses CiscoWorks server authentication (CiscoWorks local) to authenticate users and authorize them to access CiscoWorks applications. If you select CiscoWorks local mode, CS 3.0.5 performs the authentication and authorization.

However, you can use a third party AAA server (non-CiscoWorks local) to do authentication (not authorization). If you use a third party AAA server, you can only use it for authentication, not authorization.

Modifying User Information in CiscoWorks Local Mode

The information for parsing and verifying the password / role of a user are present in the cwpass file. This file is located at:

Solaris:

NMSROOT/lib/classpath/com/cisco/nm/cmf/servlet

Windows:

NMSROOT\lib\classpath\com\cisco\nm\cmf\servlet

Resetting the Login Module

You can run the following commands to reset the Login Module to CiscoWorks local mode:

---

Step 1 Stop the LMS system by entering:

On Solaris:

/etc/init.d/dmgtd stop

On Windows:

net stop crmdmgtd

Step 2 Run the following script:

On Solaris:

NMSROOT/bin/perl ResetLoginModule.pl

On Windows:

NMSROOT\bin\perl ResetLoginModule.pl

Step 3 Start the LMS system by entering:

On Solaris:

/etc/init.d/dmgtd start

On Windows:

net start crmdmgtd

---