-
User Guide for CiscoWorks QoS Policy Manager 3.2.3
-
Preface
-
Chapter 1: Introduction
-
Chapter 2: Planning for Quality of Service
-
Chapter 3: Getting Started
-
Chapter 4: Managing Devices
-
Chapter 5: Configuring QoS for IP Telephony
-
Chapter 6: Working with Policy Groups and Policies
-
Chapter 7: Deploying QoS Policies
-
Chapter 8: Working with Deployment Groups
-
Chapter 9: Using QoS Analysis
-
Chapter 10: Additional Administration Features
-
Chapter 11: Troubleshooting QPM
-
Appendix A: Devices Tab Reference
-
Appendix B: Configure Tab Reference
-
Appendix C: Deploy Tab Reference
-
Appendix D: Reports Tab Reference
-
Appendix E: Admin Tab Reference
-
Appendix F: CLI Command Reference for QPM Actions
-
Index
-
Table Of Contents
Understanding the Device Inventory
Adding Devices to the Device Inventory
Importing Devices from a Device Inventory CSV File
Importing Devices from QPM 2.1x
Configuring Default Device Access Parameters
Viewing Device Discovery Status
Viewing and Editing Device Properties
Connecting to a Device Using Telnet
Setting a Device's Policy Group Assignment
Rediscovering Device Information
Organizing Devices with Device Folders
Using Additional Device Functions
Updating Device Access Parameters from RME
Viewing and Editing Network Element Properties
Setting Network Element Policy Group Assignments
Working with Source-Destination Pairs
Creating Source-Destination Pairs
Editing Source-Destination Pairs
Deleting Source-Destination Pairs
Hiding and Displaying Interfaces
Searching for Devices and Network Elements
Setting the Active Device Group
Synchronizing Permissions and Device Group Information
Editing Device Group Properties
Deleting Device Groups from QPM
Integrating QPM with Access Control Server (ACS)
Managing Devices
The device inventory is a collection of information about the network elements that QPM can manage.
The following topics describe how to manage devices in QPM:
•
Understanding the Device Inventory
•
•
•
•
Understanding the Device Inventory
The device inventory is a collection of information about the network elements that QPM can manage. Network elements are devices and components of devices on which QoS can be configured. Examples of network elements include devices (routers, switches, and layer 3 switches), cards, interfaces, subinterfaces, and VLANs. For more information about network elements, see Working with Network Elements.
Using Device Folders To Organize Your Inventory
Device folders are groups of devices that you can create for organizational purposes, for example, to distinguish edge routers from core routers. For more information, see Working with Device Folders.
Using Device Groups
Device groups are groups of devices that are created and administered using ACS. You can use multiple device groups only if you use ACS to manage device access. For more information, see Working with Device Groups.
Default Device Group
The inventory always contains one device group named the default device group. If you are not using ACS device groups to group devices, your inventory will contain only the default device group.
The default device group (like all QPM device groups) has properties that are unique to QPM. You can edit some of these properties. For more information, see Editing Device Group Properties.
Communicating With Devices Using SSH
QPM can communicate with devices in the inventory using either Telnet or secure shell (SSH). SSH provides more security than Telnet because communication with SSH is encrypted and authenticated.
You must configure SSH on the device before QPM can communicate with it using SSH. When you configure SSH on devices, follow these guidelines:
•
•
Use one of the following methods to configure QPM to use SSH to communicate with a device:
•
•
Adding Devices to the Device Inventory
To manage the QoS configuration on a device or any of its elements with QPM, you must first add it to the inventory. When you add a device to the inventory, QPM discovers the device on the network to obtain the properties that it stores about the device. Therefore, devices must be running and accessible on the network before you can add them to the inventory.
You can only add a device to the inventory if you have sufficient access permissions to it. The Import Devices Wizard shows you which devices you cannot import because of insufficient permissions.
When you add a device to the inventory, all of its network elements that QPM supports are automatically added. For more information about network elements, see Working with Network Elements.
Device Group Assignment
If you use ACS for user authentication, QPM assigns each imported device to the same QPM device group to which it is assigned in ACS. If a device is not assigned to an ACS device group, it is assigned to the QPM default device group.
If you are using CiscoWorks Common Services for user authentication, all devices you import are added to the QPM default device group.
OS Detection and IOS Mapping
QPM uses the device model type and operating system (OS) version number to load device capabilities to the inventory. All subversions of a certain version are translated to the major version, unless QPM explicitly supports the minor version. In QPM, new minor versions are mapped to the last supported minor version and not to the major version.
Both the device software version and the mapped software version are displayed in the Device Table page:
•
•
If QPM does not support an imported device's Cisco IOS version, the device is assigned the status "Unsupported," and no Mapped OS version is assigned to it. You cannot perform any tasks on devices that have the status Unsupported. If the device model is supported by QPM but the Cisco IOS version is not, you can upgrade the device to a supported Cisco IOS version and then rediscover the device to make it available in QPM.
Device Model Discovery
If QPM does not support an imported device model, then the device is assigned the status "Unsupported" and the model appears as "Unknown" in the Device Table. You cannot perform any tasks on devices that have the status Unsupported. The device's interfaces are not discovered or imported.
Device System Name
You can add a device to the inventory by providing either its IP address or its DNS name (if it is registered in DNS). Whichever of these values you provide becomes the device's primary name in QPM.
If the device has a system name configured, it is detected when QPM discovers the device. The device system name is added to the Device Table, as another method for you to identify the device.
You cannot use device DNS names that contain the backslash (\) character.
Device Access Parameters
Device access parameters are the passwords and community strings that QPM needs to log into and configure devices. QPM obtains device access parameters for devices you add to the inventory in the following ways:
•
•
–
–
–
•
For more information about default device access parameters, see Configuring Default Device Access Parameters.
The following topics describe how to add devices to the inventory:
•
•
•
•
Adding a Single Device
To add a single device you enter the required device information, then QPM discovers the device on the network to obtain the rest of the device information.
Before You Begin
Obtain the following information for each device you are adding:
•
•
For more information about default device access parameters, see Configuring Default Device Access Parameters.
Procedure
Step 1
Step 2
Step 3
a.
b.
c.
d.
For more information about the Import Devices Wizard - General page, see Import Devices Wizard - General Page, page A-357.
Step 4
The Discovery Status page appears, where you can monitor the progress of the add operation. For more information, see Viewing Device Discovery Status.
Related Topics
•
•
Importing Devices from a Device Inventory CSV File
You can add multiple devices simultaneously to the inventory by importing them from a comma-separated value (CSV) device inventory file created using CiscoWorks Resource Manager Essentials (RME).
During the import process, QPM presents a list of the devices in the CSV file. You select which devices to import.
You can import a particular device from a CSV file or directly from RME only once. After you import a device, you update its information and properties in QPM. QPM also tracks which devices you choose not to import from CSV files and RME during the import process. If you re-import from a CSV file or RME again in the future, you can choose to import only those devices that have never been imported before.
When you import from a CSV file, QPM discovers all devices in the file.
QPM assigns access parameters to the devices based on the following sources:
•
•
Before You Begin
Export a device inventory CSV file using RME. For importing the CSV file into QPM, the first data line of the file (not including comments) must be:
Cisco Systems NM data import, source = export utility; Version = 2.0; Type = CsvFor information on the format of the rest of the CSV file, see:
Procedure
Step 1
Step 2
Step 3
a.
b.
c.
d.
Step 4
The Discovery Status page appears, where you can monitor the progress of the add operation. For more information, see Viewing Device Discovery Status.
Tip
Related Topics
•
•
Importing Devices from RME
You can add multiple devices to the inventory by importing them from a supported release of Resource Manager Essentials (RME) directly, without saving the RME device inventory to a file.
During the import process, QPM presents a listing of QPM-supported devices in the RME inventory. It does not include devices that are not supported by QPM. You select which devices to import.
You can import a particular device from RME or a CSV file only once. After you import a device, you update its information and properties in QPM. QPM also tracks which devices you choose not to import from RME or CSV files during the import process. If you re-import from RME or a CSV file again in the future, you can choose to import only those devices that have never been imported before.
When you import a device from RME, QPM checks the device model to see whether it is a supported by QPM. If it is supported, QPM starts the discovery process, and it is imported. If the model is not supported, QPM does not start the discovery process and it is not imported.
For information about defining device access parameters during import, see Adding Devices to the Device Inventory.
Procedure
Step 1
Step 2
Step 3
a.
b.
c.
d.
e.
f.
Step 4
The Discovery Status page appears, where you can monitor the progress of the add operation. For more information, see Viewing Device Discovery Status.
Related Topics
•
•
Importing Virtual Devices
You can import virtual devices from a file for testing and demonstration purposes. Virtual devices are not physical devices, but rather are defined in a file that contains the same device information required to import a physical device.
You create a file containing a virtual device by exporting device inventory information. For more information, see Exporting Device Information.
Each device in the inventory must have a unique IP address. If the virtual device file you want to import contains a virtual device with an IP address that is already in the inventory, you must edit the IP address in the file (which is in XML format) before you can import the virtual device.
Procedure
Step 1
Step 2
Step 3
a.
b.
c.
Step 4
The Discovery Status page appears, where you can monitor the progress of the add operation. For more information, see Viewing Device Discovery Status.
Related Topics
•
Importing Devices from QPM 2.1x
You can import devices from a QPM 2.1x database that was exported to an XML file.
During the import process, QPM presents a listing of QPM-supported devices in the import file. It does not include devices that are not supported by QPM. You select which devices to import.
Before You Begin
Export a QPM 2.1x database using the QPM 2.1x export utility. See the Installation Guide for QoS Policy Manager for more information.
Procedure
Step 1
Step 2
Step 3
a.
b.
c.
Step 4
The Discovery Status page appears, where you can monitor the progress of the add operation. For more information, see Viewing Device Discovery Status.
Tip
Related Topics
•
Configuring Default Device Access Parameters
Device access parameters are the passwords and community strings that QPM needs to log into, import, and configure devices. These parameters include TACACS and Telnet passwords.
When QPM connects to a device, it logs into the device using TACACS authentication. If this fails, it uses local authentication. This login process is used for both communication methods—SSH and Telnet.
You can configure default device access parameters that are assigned to devices when you import them into the inventory.
Note
When you add devices to the inventory, the default device access parameters are used to import the devices unless you override them. Each method of importing devices has its own method of overriding the defaults; see the related topics for more information.
You can configure device access parameters for an individual device, or for all devices in a device group.
Before You Begin
QPM assumes you are using standard user name and password prompts. If you have defined non-standard prompts on the devices, you must update the QPM configuration to recognize your prompts. See QPM cannot log into a device, page 11-318, for information on how to update the QPM configuration.
Procedure
Step 1
Step 2
To change parameters for a device group:
a.
b.
Step 3
a.
b.
c.
Related Topics
•
•
•
•
Viewing Device Discovery Status
When you import devices, you can use the Discovery Status report to see the status of each device discovery task (for example, tasks can be finished, in progress, or failed because of incorrect device access parameters).
You can define the refresh interval for this page.
If you add more devices while the previous add device operation is still in progress, the Discovery Status page will display a separate record for each add operation, in order from newest to oldest.
Procedure
Step 1
Step 2
Step 3
a.
b.
Related Topics
•
•
Working with Devices
The following topics describe working with devices:
•
•
•
Viewing and Editing Device Properties
You can view a device's properties and edit some of them. Examples of the properties you can edit include:
•
•
•
You can view and edit device properties from any device list, whether it is in the main device table, or accessed from the device folders, device groups, or search results pages.
Procedure
Step 1
Step 2
•
•
The Device Properties page appears.
Step 3
a.
b.
Related Topics
The following topics describe other tasks you can perform on devices:
•
Exporting Device Information
You can export a device's information to a file on your client system that can then be used to import the device back into QPM as a virtual device. This process allows you to test and demonstrate QoS policies without affecting real devices.
Procedure
Step 1
Step 2
•
•
The Device Properties page appears.
Step 3
The browser file download process begins.
Step 4
Related Topics
Connecting to a Device Using Telnet
You can connect to a device in the device inventory from within QPM using Telnet. QPM starts the default Telnet program on your client system and automatically connects to the device. If there is no Telnet program installed on your client system, this feature will not work.
Procedure
Step 1
Step 2
•
•
The Device Properties page appears.
Step 3
A Telnet application opens and connects to the device.
Related Topics
•
Viewing Device Configuration
You can view a device's running software configuration from within QPM. This is useful if you are deciding whether to upload the device's configuration into the QPM inventory.
Procedure
Step 1
Step 2
•
•
The Device Properties page appears.
Step 3
Related Topics
Setting a Device's Policy Group Assignment
To configure QoS policies on a device, you assign it to a policy group. You can do this in the following ways:
•
•
This procedure describes how to:
•
•
•
This procedure does not assign interfaces or other elements on a device to policy groups. For information on setting policy groups for network elements other than devices, see Setting Network Element Policy Group Assignments.
Procedure
Step 1
Step 2
The Policy Group Assignment dialog box opens.
Step 3
a.
b.
Related Topics
•
Rediscovering Device Information
Rediscovering a device's information causes QPM to connect to the device on the network and obtain its device information again. You should do this when you make configuration changes to a device to ensure that the device can still support the policies and configurations you assigned to it using QPM.
During the rediscover process, QPM will delete any policy group device or network element assignments that are no longer valid because of changes to the device's information. A report of deleted policy group assignments is generated. For more information see Assignment Conflicts Reports Page, page D-618.
Procedure
Step 1
Step 2
The Discovery Status page appears. Your rediscovery job appears at the top of the list, with an indication of the number of devices for which discovery is in process or completed. The page refreshes according to your selection in the Refresh Rate field at the bottom of the page. Rediscovery is complete when no devices are listed in the In Process field. For more information, see Discovery Status Page, page A-364.
Step 3
For more information, see Assignment Conflicts Reports Page, page D-618.
Related Topics
•
•
Working with Device Folders
You can create device folders to organize the inventory for administrative purposes. For example, you might create a device folder for each building on your corporate campus and assign the devices in each building to their corresponding device folder.
Device folders are contained within device groups. If you are not using ACS and multiple device groups, all device folders are contained within the default device group.
Unlike device groups, you cannot assign access privileges to device folders. Device folders are used primarily to group devices into related groups for the purpose of more easily searching for devices and filtering and sorting lists of devices.
When you use the device folders table to browse device folders, you can perform the same actions on the listed devices that you can perform from the device table. See Working with Devices, for more information about these actions.
The following topics describe how to work with device folders:
•
Creating Device Folders
Create device folders to organize your inventory.
Procedure
Step 1
Step 2
Step 3
Step 4
a.
b.
The Device Folders page appears. The new device folder appears in the table.
Related Topics
Organizing Devices with Device Folders
You can use device folders to organize your inventory. The procedure describes how to add devices to device folders, remove devices from devices folders, and move devices between device folders.
Procedure
Step 1
Step 2
Step 3
a.
b.
Related Topics
Editing Device Folders
Edit a device folder to change properties such as its name and description.
Procedure
Step 1
Step 2
Step 3
•
•
The Device Folder Properties page appears.
Step 4
a.
b.
Related Topics
Deleting Device Folders
Delete a device folder when you no longer want to use it to organize your inventory. Devices assigned to the device folder are not deleted from the inventory, and are no longer assigned to any device folder.
Procedure
Step 1
Step 2
Step 3
The Device Folders page refreshes. The deleted device folders do not appear in the table.
Related Topics
Using Additional Device Functions
The following topics document the additional device functions that are available:
•
Updating Device Access Parameters from RME
You can update device access parameters in the device inventory with device access parameters from RME. This is a convenient way to update the device inventory when device access parameters change.
Procedure
Step 1
Step 2
Step 3
Related Topics
Importing Device Roles
A device role is a device property that specifies the network point for a device in the AVVID network, For example, a device role might identify a device as campus access, campus distribution, or WAN aggregation. Device roles are used by the IP telephony wizard to help automatically identify which interfaces should be assigned to which policies. You can import device roles from a file generated by an application that manages device roles.
Procedure
Step 1
Step 2
Step 3
Removing Devices
If you no longer want to manage QoS on a device, you can remove it from the inventory. When you remove a device, all of its elements are also removed.
Removing Devices That Are Being Monitored
If you remove a device that contains network elements that are being monitored by a QoS analysis task, QPM continues to monitor these network elements. To stop QPM from monitoring these network elements, you must stop or delete the QoS analysis task. For more information, see the following topics:
•
•
Procedure
Step 1
Step 2
Related Topics
Working with Network Elements
The following topics describe how to work with network elements:
•
•
•
•
Overview of Network Elements
QPM supports both physical and logical network elements. A physical network element physically exists on a device and can be read or calculated using SNMP and Telnet. Examples include device, interface, VLAN, DLCI, and VC.
A user-supplied element is one that does not exist on a device, and its purpose is helping you manage your network elements. An example is source-destination pairs.
The interfaces on a device carry the network traffic. In QPM, the term interfaces refers to router interfaces and subinterfaces, and switch ports. QPM allows you to configure QoS on subinterfaces.
Viewing and Editing Network Element Properties
You can view and change network element properties. An example of the network element properties that you can edit is whether interfaces are ignored (hidden from display in QPM).
Procedure
Step 1
Step 2
Step 3
Step 4
a.
b.
Related Topics
•
Setting Network Element Policy Group Assignments
To configure QoS policies on the network, you assign network elements to policy groups. You can do this in the following ways:
•
•
There are four types of network elements that you can assign to policy groups:
•
•
•
•
The following procedure describes how to do the following to interfaces, interface subelements, and user-supplied elements:
•
•
•
You only need to perform the steps required for the network element types you are working with.
Procedure
Step 1
Step 2
Step 3
a.
b.
Step 4
a.
b.
c.
Step 5
a.
b.
c.
Related Topics
•
Working with Source-Destination Pairs
Source-destination pairs are logical (not physical) user-supplied network elements. You define them for Catalyst 8400 and Catalyst 8500 switches, which have QoS features that allow you to configure QoS policies to inbound and outbound traffic on the same device. To do this, you must define source-destination pairs of interfaces on a device, to which you can apply this type of QoS policy.
The following topics describe how to work with source-destination pairs using QPM:
•
•
•
•
Creating Source-Destination Pairs
You can create source-destination pairs using QPM.
Procedure
Step 1
Step 2
Step 3
Step 4
Step 5
a.
b.
Related Topics
•
Editing Source-Destination Pairs
You can edit source-destination pairs using QPM.
Procedure
Step 1
Step 2
Step 3
Step 4
Step 5
a.
b.
Related Topics
•
Deleting Source-Destination Pairs
You can delete source-destination pairs using QPM.
Procedure
Step 1
Step 2
Step 3
Step 4
Related Topics
•
Hiding and Displaying Interfaces
When you import a device, QPM discovers and imports all of its elements that QPM supports. You can prevent interfaces (not other network elements) from being displayed in QPM by marking them as ignored. You can later redisplay interfaces if you want to see them again. DLCIs and VCs on ignored interfaces are also ignored.
The following topics describe hiding and displaying interfaces:
Hiding Interfaces
You can mark interfaces as ignored, preventing them from displaying in QPM.
Procedure
Step 1
Step 2
Step 3
Step 4
Step 5
The Interfaces page refreshes. The ignored interfaces are no longer displayed.
Related Topics
•
Displaying Interfaces
You can redisplay interfaces that you previously marked as ignored.
Procedure
Step 1
Step 2
Step 3
Step 4
Step 5
Related Topics
•
Searching for Devices and Network Elements
You can search the inventory to find devices and network elements that meet criteria that you specify.
The search criteria are divided into two categories:
•
•
You can create multiple search criteria. You specify whether the search results must match all of the criteria statements (logical AND) or any of them (logical OR).
You can display the search criteria you have configured as a sentence, allowing you to more easily verify that the search will produce the results you want.
The devices and elements that match the search criteria are displayed in tables that allow you to perform all the tasks that QPM provides on these network elements.
Procedure
Step 1
Step 2
Step 3
•
•
•
•
•
•
Step 4
Step 5
Step 6
For information about the results page, see the UI reference for the type of network element you are searching for:
•
•
•
•
•
•
Related Topics
Working with Device Groups
This section is applicable only for users who use ACS permissions, and are working with ACS device groups. If you do not use ACS to create multiple device groups, only the default device group will be available in QPM.
The following topics describe how to work with device groups:
•
•
•
•
Understanding Device Groups
Device groups are groups of devices (and their network elements) within the inventory. They are created and maintained in ACS, but QPM assigns some properties to each device group that you can view and edit in QPM. For more information, see Editing Device Group Properties.
Each device group has its own set of access permissions, so they can be used to divide the network into administrative groups for purposes of controlling who can do what with which devices. Because you create policies in the context of a device group, you can assign policy groups only to devices in the same device group as the policy.
The inventory always contains one device group named the default device group. If you are not using ACS device groups to group devices, your inventory will contain only the default device group.
ACS Device Groups
If you are using multiple ACS device groups, QPM will automatically create the same device groups with the same user permissions that are defined in ACS. When you add a new device to the inventory, QPM assigns it to its ACS device group, with the same user permissions. If a device is not assigned to an ACS device group, it is assigned to the QPM default device group.
QPM automatically synchronizes the inventory with ACS in the following cases:
•
•
In addition, before you deploy a deployment job, QPM synchronizes with ACS to verify that the user permissions allow the job to proceed.
You can also manually refresh the QPM device group information, synchronizing it with ACS. See Synchronizing Permissions and Device Group Information.
Note
Related Topics
Setting the Active Device Group
Only one device group at a time can be active. Throughout the QPM user interface, only the devices, deployment groups, and policy groups that are contained in the active device group are displayed. You must have sufficient user privileges to set the active device group.
Procedure
Step 1
Step 2
Step 3
Related Topics
Synchronizing Permissions and Device Group Information
You can manually synchronize the user permissions and device group information in the inventory with ACS or CiscoWorks Common Services (depending on which you are using to administer device groups and user permissions).
Typically you would synchronize in the following cases:
•
•
The Sync Privileges page displays your permissions to the QPM device groups on the system. If you know you have changed ACS privileges, or changed the device groups in ACS, you see whether the changes are reflected correctly on this page so you can determine if you need to synchronize to update your QPM permissions.
If changes are made to the QPM device groups as a result of the synchronization, the Conflicts Assignment report shows which devices have been moved from the current device group, and all policy group assignments for those devices and their network elements will be deleted.
Note
Procedure
Step 1
Step 2
Step 3
Related Topic
•
•
Editing Device Group Properties
Although you cannot change device group membership within QPM (you must make device group assignment changes in ACS), you can edit the device group properties that are unique to QPM.
Many of the device group properties are the same properties that QPM maintains for devices. These device group properties are assigned to all devices in the device group by default. You can override these defaults by entering different device properties for an individual device.
Examples of the device group properties that you can edit include:
•
•
•
Procedure
Step 1
Step 2
Step 3
Step 4
a.
b.
Related Topics
•
Deleting Device Groups from QPM
QPM device groups are not automatically deleted from QPM when you delete them in ACS, even when you synchronize device group information with ACS. Instead, you must manually delete QPM device groups. Any deployment groups and policy groups contained in the device group are also deleted.
This feature is useful because device groups are not automatically deleted from QPM when you delete them in ACS, even when you synchronize device group information with ACS. This gives you the opportunity to edit your QPM deployment groups and policy groups before manually deleting the device group.
The following are the restrictions for deleting QPM device groups:
•
•
–
–
If you convert from using ACS to CiscoWorks Common Services for device management and user authentication, all devices in the inventory are moved to the default device group (because CiscoWorks Common Services does not support multiple device groups). You can then delete the remaining empty device groups.
Procedure
Step 1
Step 2
Step 3
Step 4
Integrating QPM with Access Control Server (ACS)
To integrate QPM with ACS:
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Step 7
Step 8
Step 9
Step 10
Step 11
Step 12
Step 13
Step 14
Step 15
Specify the Key to be used between QPM and ACS and Finish the process. Enter the same key given when configuring QPM server in ACS (which is in step 8)
Now the above data needs to be synchronized in the AAA server. CiscoWorks main menu
Step 16
Step 17
Step 18
Step 19
Once registration is done, Log out of Cisco Works and Log in back again to reflect the changes.
Step 20
Step 21
Step 22
Note
