-
User Guide for CiscoWorks Resource Manager Essentials 4.3 (with LMS 3.2)
-
Preface
-
Open Source License Acknowledgements
-
Chapter 1: Overview of RME
-
Chapter 2: What's New in this Release
-
Chapter 3: Adding and Troubleshooting Devices Using Device Management
-
Chapter 4: Managing RME Device, Port and Module Groups Using Group Administration
-
Chapter 5: Understanding RME Device State Transition
-
Chapter 6: Managing Inventory Collection and Polling Using Inventory
-
Chapter 7: Generating Reports
-
Chapter 8: Archiving Configurations and Managing Them Using Archive Management
-
Chapter 9: Using Baseline Templates to Check Configuration Compliance
-
Chapter 10: Making and Deploying Configuration Changes Using NetConfig
-
Chapter 11: Editing and Deploying Configurations Using Config Editor
-
Chapter 12: Using NetShow Commands
-
Chapter 13: Managing Software Images Using Software Management
-
Chapter 14: Tracking Network Changes Using Change Audit
-
Chapter 15: Enabling and Tracking Syslogs Using Syslog Analyzer and Collector
-
Chapter 16: Tracking RME Server Changes Using Audit Trail
-
Chapter 17: Checking Bug Status Using Bug Toolkit
-
Chapter 18: Working With SmartCase
-
Chapter 19: Working With Contract Connection
-
Chapter 20: CLI Utilities
-
Chapter 21: Enabling Approval and Approving Jobs Using Job Approval
-
Chapter 22: Setting System-wide Parameters Using System Preferences
-
Chapter 23: Usage of PSIRT End of Sale and End of Life Data to Generate Reports
-
Chapter 24: Virtual Switching System Support
-
Chapter 25: Usage of Embedded Event Manager in RME
-
Chapter 26: Usage of GOLD in RME
-
Chapter 27: Usage of Cisco Smart Call Home in RME
-
Appendix A : Troubleshooting and FAQ
-
Appendix B : Understanding Syslog Formats
-
Appendix C : RME Command Reference
-
Appendix D : Managing Devices When RME Server is Within a NAT Boundary
-
Index
-
Feedback
Table Of Contents
Making and Deploying Configuration Changes Using NetConfig
Configuring Default Job Policies (Optional)
Assigning Task Access Privileges to Users (Optional)
Enabling Job Approval (Optional)
Rolling Back Configuration Changes
Configuring a Job to Roll Back on Failure
Understanding NetConfig User Permissions
User-defined Tasks Permissions
Administrator Task Permissions
Create a NetConfig Job based on Device
Create a NetConfig Job based on Module or Port
Browsing and Editing Jobs Using the NetConfig Job Browser
Configuring Default NetConfig Job Policies
Password Policy for NetConfig Jobs
Setting the Transport Protocol Order for NetConfig Jobs
Creating and Editing User-defined Tasks
Using NetConfig User-defined Templates and Adhoc Tasks
Understanding the System-defined Task User Interface (Dialog Box)
Interface IP Address Configuration Task
Internet Key Exchange (IKE) Configuration Task
RADIUS Server Configuration Task
SNMP Community Configuration Task
SNMP Security Configuration Task
Telnet Password Configuration Task
Cable DHCP-GiAddr and Helper Task
Cable Spectrum Management Task
Support for Auto Smartports and Smartports
Catalyst Integrated Security Features
Use Case: Using NetConfig Templates to change Configurations for many Devices
Making and Deploying Configuration Changes Using NetConfig
NetConfig allows you to make configuration changes to your network devices, whose configurations are archived in the Configuration Archive. NetConfig is a part of RME Configuration Management applications.
It provides easy access to the configuration files for all RME supported devices, ports and modules.
NetConfig automatically updates the Configuration Archive when it makes device configuration changes.
NetConfig provides many advantages over configuring devices from the CLI. For example, you can:
•
Schedule jobs for future execution. You can schedule periodic jobs.
•
•
•
•
•
This section contains:
•
•
•
•
•
•
•
•
NetConfig Tasks
As a NetConfig user, you can:
•
To make configuration changes to managed devices, modules and ports. You define and schedule NetConfig jobs using the job definition wizard. You can use configuration tasks (system-defined or user-defined) to create the configuration commands that you want to apply to devices.
•
You can browse all NetConfig jobs on your system and edit, copy, stop, retry or delete them. For more information about a particular job, you can click the job details by clicking on the hyperlink of the Job ID in the NetConfig Job Browser.
•
You can use the cwcli command line interface to create and schedule NetConfig jobs from the command line.
As a NetConfig administrator, you can:
•
You can create your own user-defined tasks containing any configuration or rollback commands, and download them to a set of selected devices. You enter the configuration commands by typing them or by importing them from a file.
User-defined tasks can be parameterized. That is, they can contain variables that take values from a specified file that resides on the RME server.
•
As a network administrator, you can assign access to execute tasks, to CiscoWorks users with network operator privilege. You can assign one or more task, to one or more users. By default, only network administrators (users with Network Administrator permissions) can use configuration tasks.
•
You can separately specify the protocol order for configuration download and update operations, for NetConfig jobs. This feature enables you to use your preferred protocols for downloading and fetching configuration.
For example, you can use Telnet to download configuration to the device, and TFTP to fetch the configuration, thus improving the overall performance of NetConfig.
•
Each NetConfig job has job properties (including enabling job password) that define how the job will execute. You can configure defaults for these properties that will be applied to all future jobs. You can specify for each property whether users can change the default when creating a job.
See Understanding NetConfig User Permissions.
For the new features in this release, see What's New in this Release.
Note
Preparing to Use NetConfig
•
•
•
•
Verifying Device Credentials
To verify that every device you want to configure has correct credentials in Device and Credential Repository, use the Device Credential Verification option (Resource Manager Essentials > Devices > Device Management > Device Credential Verification).
For more details see the topic Checking and Viewing Device Credentials in the section Adding and Troubleshooting Devices Using Device Management.
NetConfig must have access to the credentials to make device configuration changes.
Modifying Device Security
NetConfig must be able to run certain commands on devices to configure them. You must disable security that prohibits NetConfig from running these commands.
For the list of commands, see the topic Modifying Device Security in the section Archiving Configurations and Managing Them Using Archive Management.
Verifying Device Prompts
NetConfig requires particular CLI prompt formats:
If the telnet transport mechanism is used, the following prompts are applicable.
•
–
–
•
–
–
If the secure shell (SSH) transport mechanism is used, the following prompts are applicable.
•
–
–
–
–
–
Default prompts use this formatting. If you have changed your defaults, verify that the prompts meet these requirements, and change them if they do not.
Configuring Default Job Policies (Optional)
NetConfig jobs have properties that determine how they run. You can configure default job policies (Resource Manager Essentials > Admin > Config Mgmt > Config Job Policies) that apply to all NetConfig jobs.
For more details see the topic Configuring Default Job Policies in the section Archiving Configurations and Managing Them Using Archive Management.
Assigning Task Access Privileges to Users (Optional)
You can assign task access privileges that determine which configuration tasks each user can use to create NetConfig jobs. See Understanding NetConfig User Permissions.
Enabling Job Approval (Optional)
You can enable Job Approval, (Resource Manager Essentials > Admin > Approval > Approval Policies) which means all jobs require approval before they can run.
For more details see the topic Setting Up Job Approval in the section Enabling Approval and Approving Jobs Using Job Approval.
Rolling Back Configuration Changes
NetConfig lets you roll back (undo) the configuration changes made to network devices if a job does not complete. How rollback commands (the configuration commands that are used to roll back the configuration changes) are created depends on how the job was created.
You must configure a NetConfig job to automatically roll back configuration changes if the job fails to complete.
NetConfig can rollback configuration only devices whose configurations are archived in the Configuration Archive. For details see Archiving Configurations and Managing Them Using Archive Management.
To verify that devices have an archived configuration and troubleshoot those that do not, use the Configuration Archival Summary dialog box (Resource Manager Essentials > Config Mgmt > Archive Mgmt). For more details see the topic Checking Configuration Archival Status in the section Archiving Configurations and Managing Them Using Archive Management.
This section contains:
•
Creating Rollback Commands
You can create rollback commands for a job in the following ways:
•
•
Configuring a Job to Roll Back on Failure
You can define a job failure policy so it automatically rolls back configuration changes if the job fails to run. You can select one of several rollback options:
•
•
•
Understanding NetConfig User Permissions
Access to NetConfig functionality is controlled by permissions.
Users with only Help Desk permissions cannot use NetConfig as this option will not be displayed for these users. Other users can use NetConfig, but their access to functionality is controlled by permissions.
In your application, see the Permission Report (Common Services > Server > Reports) to check whether you have the required privileges to perform the required NetConfig task.
This section contains:
•
•
Job Approval Permissions
Only users with Approver permissions can approve NetConfig jobs. Jobs must be approved before they can run if Job Approval is enabled on the system.
For more details see the topic Setting Up Job Approval in the section Enabling Approval and Approving Jobs Using Job Approval.
User-defined Tasks Permissions
By default, only users with Network Administrator permissions can create user-defined configuration tasks (see Creating and Editing User-defined Tasks).A network administrator must give other users permission to use them on a task-by-task basis.
Administrator Task Permissions
Only users with Network Administrator permissions can perform administrator tasks, which are listed in the NetConfig Admin menu. Other users will not see this menu.
Administrator tasks are:
•
•
•
For user permissions, see Understanding NetConfig User Permissions.
Job Editing Permissions
After a NetConfig job is created, the owner, another user with the owner's privileges, or a network administrator can:
•
•
•
•
•
Using the NetConfig Tab
The NetConfig tab of RME enables you to do the following tasks:
•
–
•
•
Starting a New NetConfig Job
Use the job definition wizard to create and schedule the following NetConfig job types:
•
•
•
This section describes the following:
•
•
To browse and edit jobs using the NetConfig job browser, see Browsing and Editing Jobs Using the NetConfig Job Browser.
Ensure that you have set the:
•
For more details see the topic Configuring Transport Protocols in the section Archiving Configurations and Managing Them Using Archive Management.
•
For more details see the topic Configuring Default Job Policies in the section Archiving Configurations and Managing Them Using Archive Management.
Note
Create a NetConfig Job based on Device
To create a new NetConfig job based on Device:
Step 1
The NetConfig Job Browser appears.
For the fields in the NetConfig Job Browser, see Browsing and Editing Jobs Using the NetConfig Job Browser.
Step 2
Step 3
•
•
•
Step 4
The Devices and Tasks dialog box appears, with these panes:
Device Selector
Allows you to select the devices on which the NetConfig job has to run. You can select multiple device categories. For cable devices, you should select only one device for which to create a job.
You can also search for devices from the Device Selector. For more details, see Using RME Device Selector
Task Selector
Allows you to select the System-defined tasks or User-defined tasks that you want to run on the selected devices. All System-defined and User-defined tasks are categorized into various task groups. To select the tasks, expand the corresponding Task Group node.
You can also search for a task or a group of tasks in the Task Selector by entering the Search expressions in the Search field.
You can also use the wildcard character "*" along with the Search expression. When you click the Search icon, the Search results are displayed in the Search Results tab.
For descriptions of System-defined tasks and the device categories they support, see Using System-defined Tasks.
For creating and using User-defined tasks, see Creating and Editing User-defined Tasks.
Step 5
See the topic Using RME Device Selector in the section Adding and Troubleshooting Devices Using Device Management.
Step 6
You can select one or more task at a time. Your selection appears in the Selection pane.
Step 7
The Add Tasks dialog box appears with these panes:
Applicable Tasks
Allows you to add a task. The task that you selected using the Task Selector, appears here.
From your selection, only the tasks that are applicable to at least one device that you have selected, appear here. If the task that you have selected does not apply to the categories of any of the devices that you have selected, it will not be displayed in the Applicable Tasks pane.
Select a task and click Add to create an instance for the task (see Step 8).
Added Instances
Allows you to edit the task instance you have added, view its CLI, or delete it. Select the instance of the task, and click the required button (see Table 10-1).
The buttons available in this page are:
Step 8
The Task (system-defined or user-defined) pop-up appears for the selected task.
Step 9
(To reset the values that you have selected click Reset. Click Cancel to return to the previous dialog box, without saving your changes.)
You will see the instance of the task in the Added Tasks pane of the Add Tasks dialog box. The instance appears in this format:
Taskname_n, where Taskname is the name of the task you have added, and n is the number of the instance. For example, the first instance of a Banner task is
Banner_1.You can add as many instances as required, for a task.
Step 10
The Job Schedule and Options dialog box appears with these panes:
Allows you to schedule the job.
Allows you to set the job options.
Step 11
Run Type
Select the run type or frequency for the job—Immediate, Once, Daily, Weekly, Monthly, or Last Day of Month.
If Job Approval is enabled, the Immediate option is not available.
Date
Select the start date for the job.
at
Select the start time for the job from the hour and minute drop-down lists.
Job Description
Enter the Job Description. Make each description unique so you can easily identify jobs. This is mandatory.
Enter e-mail addresses to which the job will send status notices. Separate multiple addresses with commas or semicolons.
You must configure the SMTP server to send e-mails (Common Services > Server > Admin > System Preferences).
If the user who has created the job has a valid e-mail address, an e-mail notification is sent with the user's address in the sender address field, when job is started and completed.
If the user who has created the job does not have a valid e-mail address, then the notification e-mails will be sent with the sender address field blank.
Notification e-mails include a URL that displays the job details (see Viewing Job Details for the more information about what details are displayed). If you are not logged in, you must log in using the provided login panel to view the job details.
Comments
Enter your comments for the job. Comments appear in job work order and are stored in configuration archive.
Approver Comments
Enter comments for the job approver. This field is displayed only if you have enabled job approval for NetConfig. For more details the section Enabling Approval and Approving Jobs Using Job Approval.
Maker E-mail
Enter the e-mail-ID of the job creator. This field is displayed only if you have enabled job approval for NetConfig. This is a mandatory field. For more details the section Enabling Approval and Approving Jobs Using Job Approval.
Step 12
Fail on Mismatch of Config Versions
Select to cause job to be considered a failure when the most recent configuration version in the configuration archive is not identical to the most recent configuration version that was in the configuration archive when you created the job.
Sync Archive before Job Execution
Select to cause job to archive running configuration before making configuration changes.
Copy Running Config to Startup
Select to cause job to write the running configuration to the startup configuration on each device after configuration changes are made successfully.
Does not apply to Catalyst OS devices.
Login Username
Enter the Login Username. This option is available to you if you have set the appropriate job password policy in the Configuration Management module.
This overrides the credentials that you have entered at the time of adding the device in the Device and Credentials Administration module of Common Services.
Login Password
Enter the job password. This option is available to you if you have set the appropriate job password policy in the Configuration Management module.
This overrides the credentials that you have entered at the time of adding the device in the Device and Credentials Administration module of Common Services.
Enable Password
Enter the Enable password. This option is available to you if you have set the appropriate job password policy in the Configuration Management module.
This overrides the credentials that you have entered at the time of adding the device in the Device and Credentials Administration module of Common Services.
Failure Policy
Select one of these options to specify what the job should do if it fails to run on a device.
•
If the job fails to execute on a device, the job is stopped. The database is updated only for the devices on which the job was executed successfully.
•
The database is updated only for the devices on which the job was executed successfully.
•
•
•
Roll back configuration changes to failed device or all devices configured by job (see Configuring a Job to Roll Back on Failure.)
Execution
Specify the order in which the job should run on the devices.
•
•
If you select sequential execution, you can click Set Device Order to set the order of the devices.
In the Device Ordering dialog box:
a.
b.
c.
or
Click Cancel to close the dialog box without making any changes.
Step 13
The Set Device Order pop-up appears.
You can reset the order in which the job should be executed on the devices using the Up and Down arrows. When you are done, click Done. The pop-up closes.
Step 14
The Job Work Order dialog box appears with the general information about the job, the job policies, the job approval details (if you have enabled job approval), the device details, the task, and the CLI commands that will be executed on the selected devices as part of this job.
A sample work order is:
------------------------------------------------------------------
General Info
Owner: admin
Description: test job for documenting the workflow
Schedule Type: Run Once
Schedule Time: Mon Aug 22 12:45:00 IST 2011
--------------------------------------------------------------------
Job Policies
Failure Policy: Ignore failure and continue
E-mail Notification: Disabled
Execution Policy: Sequential
Fail on Mismatch of Config Versions : Disabled
Copy Running Config to Startup: Disabled
Sync Archive before Job Execution : Disabled
Job Password: Disabled
------------------------------------------------------------------
Job Approval Details
Job Approval: Disabled
------------------------------------------------------------------
Device Details
Device: 10.76.38.14
Task: Banner
Commands:
banner motd "welcome"
------------------------------------------------------------------Step 15
A notification message appears along with the Job ID. The newly created job appears in the NetConfig Job Browser.
Create a NetConfig Job based on Module or Port
This section provides information for creating a Netconfig job based on Ports or Modules.
You can create a Netconfig job for ports or modules by selecting the devices from "Device and Groups" page and port or module groups from "Group Selector" page in the Netconfig job flow. You need to consider the following use cases while scheduling a Netconfig job:
•
•
Netconfig job for all the devices in the port or module group
To create a Netconfig job for all the devices in the port or module group, you just need to select the applicable ports or module groups from the "Group Selector" page in the Netconfig job flow. The Netconfig job will run for all the devices in the selected port or module groups.
If devices are not available in the port or module groups in the "Group Selector" page, then Netconfig job will not be created and displays the following message
No devices in selected groupNetconfig job for a few devices in the port or module group
To create a Netconfig job for a few devices, you must select the devices or device groups from the "Devices and Groups" page and select the port or module groups from the "Group Selector" page in the Netconfig job flow. In this case, the netconfig job will run only for the devices that are common in both "Devices and Groups" page and port or module groups in the "Group Selector" page.
If devices selected in both "Devices and Groups" page and in port or module groups in the "Group Selector" page are not matching, then the Netconfig job will be created only for the devices selected from the "Devices and Groups" page. At job run time, if the selected devices are not available in the port or module groups, then the Netconfig job will fail because the job will run only for the common devices.
If the device group selected in "Devices and Groups" page does not contain any devices, then the Netconfig job will be created only for the devices that are part of port or module groups.
To start a new NetConfig job based on Modules or Ports:
Step 1
The NetConfig Job Browser appears.
For the fields in the NetConfig Job Browser, see Browsing and Editing Jobs Using the NetConfig Job Browser.
Step 2
The Netconfig Job Type page appears, displaying the following job flows:
•
•
•
Step 3
•
Or
•
Step 4
The Device and Group Selector dialog box appears, with these options:
Device Selector
Allows you to select the devices on which the NetConfig job has to run. You can select multiple device categories.
You can also search for devices from the Device Selector. For more details, see Using RME Device Selector.
Group Selector
Allows you to select the groups on which the NetConfig job has to run. You can select multiple groups.
Step 5
•
Or
•
You can also click Next to directly go to the Group Selector page without selecting the devices or device groups.
Step 6
The Group Selector page appears displaying the Port or Module Groups dialog box with these options:
Select Custom Group
Allows you to select the following group types on which the NetConfig job has to run. You can select multiple groups.
•
•
See Creating Port and Module Groups for information on creating port or module groups.
Define an Adhoc Rule
Allows you to define Adhoc rules.
The rule defined using this option will be available and specific only to this NetConfig job. They will not be available if you create another NetConfig job.
Object Type
Select the following Object Type to form a group:
•
•
Variable
Object type attributes, based on which you can define the group.
Operator
Operator to be used in the rule. The list of possible operators changes based on the Variable selected.
When using the equals operator the rule is case-sensitive.
Value
Value of the rule expression. The possible values depend upon the variable and operator that you have selected. Depending on the operator selected, the value may be free-form text or a list of values.
The wildcard characters are not supported.
Add Rule Expression
(Button)
Used to add the rule expression to the group rules.
Rule Text
Displays the rule.
Check Syntax
(Button)
Verifies that the rule syntax is correct.
Use this button to verify the syntax of the rule created before proceeding to the next step.
Include
(Button)
Lists all the modules or ports from the selected devices that are not matching the rule.
Later you can choose to include those modules or ports for group creation.
Click Include to launch the Include List window. See Table 4-10 for descriptions of the fields in the Include List window.
Exclude
(Button)
Lists all the modules or ports from the selected devices that are matching the rule.
Later you can choose to exclude those modules or ports for group creation.
Click Exclude to launch the Exclude List window. See Table 4-10 for descriptions of the fields in the Exclude List window.
Step 7
The Port or Module Tasks page appears.
Step 8
Gold Health Monitoring Test (See GOLD Health Monitoring Test Task.)
Configure GOLD Health Monitoring tests on modules.
This tasks is available only for the Module based NetConfig job.
Adhoc Task (See Adhoc Task.)
Configures user-defined commands on selected interfaces within a port group.
Manage Auto Smartports (See Manage Auto Smarports.)
Enables or disables auto smartports macros at port level.
Smartports (See Smartports)
Applies smartports macros at port level.
Catalyst Integrated Security Features (See Catalyst Integrated Security Features.)
Configures port security features.
PoE (See PoE Task.)
Configures power policing in ports.
SRE Operation (See SRE Operation Task)
Configures the following operations on Services Ready Engine (SRE) supported devices at port level:
•
•
•
–
–
–
•
•
Reset—Reset service modules in a SRE device.
Your selection appears in the Selection pane.
Step 9
The Add Tasks dialog box appears with these panes:
Applicable Tasks
Allows you to add a task. The task that you selected using the Task Selector, appears here.
From your selection, only the tasks that are applicable to at least one device that you have selected, appear here.
If the task that you have selected does not apply to the categories of any of the devices that you have selected, it will not be displayed in the Applicable Tasks pane.
Select a task and click Add Instance to create an instance for the task (see Step 10).
Added Instances
Allows you to edit the task instance you have added, view its CLI, or delete it. Select the instance of the task, and click the required button (see Table 10-2).
The buttons available in this page are:
Step 10
The Task (system-defined or user-defined) pop-up appears for the selected task.
Step 11
To reset the values that you have selected click Reset.
To return to the previous dialog box without saving your changes, click Cancel.
You will see the instance of the task in the Added Tasks pane of the Add Tasks dialog box. The instance appears in this format:
Taskname_n, where Taskname is the name of the task you have added, and n is the number of the instance. For example, the first instance of a Banner task is
Banner_1.You can add as many instances as required, for a task.
Step 12
The Job Schedule and Options dialog box appears with these panes:
Allows you to schedule the job.
Allows you to set the job options.
Step 13
Run Type
Select the run type or frequency for the job—Immediate, Once, Daily, Weekly, Monthly, or Last Day of Month.
Date
Select the start date for the job.
at
Select the start time for the job from the hour and minute drop-down lists.
Job Description
Enter the Job Description. Make each description unique so you can easily identify jobs. This is mandatory.
Enter e-mail addresses to which the job will send status notices. Separate multiple addresses with commas or semicolons.
You must configure the SMTP server to send e-mails (Common Services > Server > Admin > System Preferences).
If the user who has created the job has a valid e-mail address, an e-mail notification is sent with the user's address in the sender address field, when job is started and completed.
If the user who has created the job does not have a valid e-mail address, then the notification e-mails will be sent with the sender address field blank.
Notification e-mails include a URL that displays the job details (see Viewing Job Details for the more information about what details are displayed). If you are not logged in, you must log in using the provided login panel to view the job details.
Comments
Enter your comments for the job. Comments appear in job work order and are stored in configuration archive.
Approver Comments
Enter comments for the job approver. This field is displayed only if you have enabled job approval for NetConfig. For more details the section Enabling Approval and Approving Jobs Using Job Approval.
Maker E-mail
Enter the e-mail-ID of the job creator. This field is displayed only if you have enabled job approval for NetConfig. This is a mandatory field. For more details the section Enabling Approval and Approving Jobs Using Job Approval.
Step 14
Fail on Mismatch of Config Versions
Select to cause job to be considered a failure when the most recent configuration version in the configuration archive is not identical to the most recent configuration version that was in the configuration archive when you created the job.
Sync Archive before Job Execution
Select to cause job to archive running configuration before making configuration changes.
Copy Running Config to Startup
Select to cause job to write the running configuration to the startup configuration on each device after configuration changes are made successfully.
Does not apply to Catalyst OS devices.
Login Username
Enter the Login Username. This option is available to you if you have set the appropriate job password policy in the Configuration Management module.
This overrides the credentials that you have entered at the time of adding the device in the Device and Credentials Administration module of Common Services.
Login Password
Enter the job password. This option is available to you if you have set the appropriate job password policy in the Configuration Management module.
This overrides the credentials that you have entered at the time of adding the device in the Device and Credentials Administration module of Common Services.
Enable Password
Enter the Enable password. This option is available to you if you have set the appropriate job password policy in the Configuration Management module.
This overrides the credentials that you have entered at the time of adding the device in the Device and Credentials Administration module of Common Services.
Failure Policy
Select one of these options to specify what the job should do if it fails to run on a device.
•
If the job fails to execute on a device, the job is stopped. The database is updated only for the devices on which the job was executed successfully.
•
The database is updated only for the devices on which the job was executed successfully.
•
•
•
Roll back configuration changes to failed device or all devices configured by job (see Configuring a Job to Roll Back on Failure.)
Execution
Specify the order in which the job should run on the devices.
•
•
If you select sequential execution, you can click Set Device Order to set the order of the devices.
In the Device Ordering dialog box:
a.
b.
c.
or
Click Cancel to close the dialog box without making any changes.
Step 15
You can reset the order in which the job should be executed on the devices using the up and down arrows. When you are done, click Done. The pop-up closes.
Step 16
The Job Work Order dialog box appears with:
•
•
•
•
•
•
•
Step 17
A notification message appears along with the Job ID. The newly created job appears in the NetConfig Job Browser.
Browsing and Editing Jobs Using the NetConfig Job Browser
You can browse the NetConfig jobs that are registered on the system. Using the NetConfig Job Browser dialog box you can also manage NetConfig jobs using the job browser. That is, you can edit, copy, retry, stop, or delete jobs using this job browser.
To create and start a new NetConfig job, see Starting a New NetConfig Job.
Note
To invoke the NetConfig job browser:
Select Resource Manager Essentials > Config Mgmt > NetConfig > NetConfig Jobs.
The NetConfig job browser dialog box appears with a detailed list of all scheduled report jobs.
The columns in the NetConfig job browser dialog box display the following information:
Job ID
Unique number assigned to job when it is created.
For periodic jobs such as Daily, Weekly, etc., the job IDs are in the number.x format. The x represents the number of instances of the job. For example, 1001.3 indicates that this is the third instance of the job ID 1001.
Click on the hyperlink to view the Job details (see Viewing Job Details).
Status
Status of the job:
•
•
The number, within brackets, next to Failed status indicates the count of the devices that had failed for that job. This count is displayed only if the status is Failed.
For example, If the status displays Failed(5), then the count of devices that had failed amounts to 5.
This count of failed devices is not displayed for jobs restored from RME 4.0.4 or lesser versions.
•
•
•
•
Description
Description of the job, entered at the time of job creation.
Owner
Username of the job creator.
Scheduled at
Date and time at which the job was scheduled.
Completed at
Date and time at which the job was completed.
Flow Type
Type of the job flow—Port, Module, Device.
Schedule Type
Type of job schedule—Immediate, Once, Daily, Weekly, Monthly, Last day of the month.
You can specify when you want to run the NetConfig job.
To do this, select one of these options from the drop down menu:
•
•
•
•
•
•
For periodic jobs, the subsequent instances of periodic jobs will run only after the earlier instance of the job is complete.
For example: If you have scheduled a daily job at 10:00 a.m. on November 1, the next instance of this job will run at 10:00 a.m. on November 2 only if the earlier instance of the November 1 job has completed. If the 10.00 a.m. November 1 job has not completed before 10:00 a.m. November 2, then the next job will start only at 10:00 a.m. on November 3.
Using the Filter by field in the NetConfig Job Browser, you can filter the jobs displayed in the browser.
You can filter the jobs displayed in the NetConfig Job Browser using any of the following criteria and clicking Filter:
Records for NetConfig jobs need to be purged periodically. You can schedule a default purge job for this purpose. For more details see the topic Job Purge in the section Setting System-wide Parameters Using System Preferences.
You can perform the following operations using the NetConfig job browser. (See Table 10-3):
Table 10-3 Operations Using the NetConfig Job Browser
Edit
Edits selected pending job.
•
The Job definition opens at the Devices and Tasks dialog box, with current information about the job.
•
The Job definition opens at the Devices and Groups dialog box, with current information about the job.
•
The Job definition opens at the Devices and Groups dialog box, with current information about the job.
You can edit a job the same way you define and schedule a new job (see Starting a New NetConfig Job).
The Job ID of an edited job remains unchanged.
Unless you own job, your login ID determines whether you can use this option.
If the job start time occurs during editing, it runs without edits. You can complete edits and schedule the job to run again, but you cannot re-edit the job.
To prevent the job from running without edits, either:
•
Or
•
Copy
Copies selected job.
You can copy a job and give it a new schedule.
•
The Job definition opens at the Devices and Tasks dialog box, with all your selections for the job that you are copying.
•
The Job definition opens at the Devices and Groups dialog box, with all your selections for the job that you are copying.
•
The Job definition opens at the Devices and Groups dialog box, with all your selections for the job that you are copying.
You can edit the copied job in the same way you define and schedule a new job (see Starting a New NetConfig Job).
A new Job ID with the copied job details is created.
-
Retry
Retry a failed job.
•
The Job definition opens at the Devices and Tasks dialog box.
You can edit the job the same way as you would define and schedule a new job. However, you cannot add new devices or change the tasks for the job that you are retrying.
You can select a few number of failed devices to retry the job.
•
The Job definition opens at the Devices and Groups dialog box.
You can edit the job the same way as you would define and schedule a new job. However, you cannot add new devices, modules or change the tasks for the job that you are retrying.
You can select a few number of failed devices to retry the job.
•
The Job definition opens at the Devices and Groups dialog box.
You can edit the job the same way as you would define and schedule a new job. However, you cannot add new devices, ports or change the tasks for the job that you are retrying.
You can select a few number of failed devices to retry the job.
Unless you own the job, your login determines whether you can use this option.
There may be some devices whose configuration has been downloaded. However, their running configuration has not been written to the Startup configuration.
You can perform Retry Job on these devices just as you can on a failed job.
Stop
Stops or cancels a running job.
You can stop/cancel a running job. You will be asked to confirm the cancellation of the job.
However, the job will be stopped only after the devices currently being processed are successfully completed. This is to ensure that no device is left in an inconsistent state.
If the job that you want to stop is a periodic job, you will also be asked whether you want to cancel all the instances of the job.
Click OK to cancel all instances.
If you click Cancel, only the selected instance of the job is cancelled. The next instance of the job will appear in the Job browser with the status
Scheduled.Unless you own the job, your login determines whether you can use this option.
You cannot re-start the stopped job. You can however copy the stopped job and Job ID.
Delete
Deletes the selected job from the job browser. You can select more than one job to delete.
You will be asked to confirm the deletion. If the job that you have selected for deletion is a periodic job, this message appears:
If you delete periodic jobs, or instances of a periodic job, that are yet to be run, the jobs will no longer run, nor will they be scheduled to be run again. You must then recreate the deleted jobs. Do you want to continue?Click OK to confirm the deletion. The job, and its instances will be deleted.
You can delete a job that has been successful, failed, or stopped, but you cannot delete a running job.
Unless you own the job, your login determines whether you can use option.
You must stop a running job before you can delete it.
Viewing Job Details
From the Job Browser dialog box, you can learn more about any job by viewing its details.
Step 1
The Job Details pop-up appears, displaying the day, date and time details in the header at the top of the report. The Job ID and the Status appear in the header of the report.
The Job Details dialog box has two panes. The left pane contains a table of contents for the job results. The results appear in the right pane.
Step 2
Double-click a folder in the left pane to open and close it.
If the folder has subfolders, the next level of subfolders appears under it. Otherwise, its corresponding report appears in the right pane.
The contents of the left pane depends on the state of the job. The left pane can contain:
•
•
•
Job Details
Job Summary
Click to display summary of completed job:
•
–
–
–
•
–
–
•
–
–
–
–
–
The URL https://tools.cisco.com/sch/pendingDevices.do is displayed only for SCH NetConfig jobs.
Click the URL to register the devices that are pending to process SCH messages at Cisco.com.
For more information on Devices Pending Registration for SCH, see the Smart Call Home User Guide at:
Device Details
Downloaded Devices
Contains detailed job results for each device in a table:
•
•
•
–
–
You can filter the devices by selecting a status and clicking Filter.
This page displays the number of rows you have set for display in the Rows per Page field. You can increase the rows up to 500 in each page.
You can navigate among the pages of the report using the navigation icons at the right bottom of this table.
Click on a device to view the details such as protocol, status and reason when applicable, task used and the CLI output for that device. These details appear in a pop-up window.
Double-click to display status folders that correspond to possible device status.
Update Successful
Devices were successfully updated.
Update Failed
Devices were not successfully updated.
Includes devices on which rollback was attempted, regardless of whether it was successful.
Not Attempted
Job did not try to update devices, even though they were selected.
Usually occurs when a previous device failed and failure property was set to Stop on Failure.
Work Order
Click to display Job Work Order, which contains same the information as the workorder that was displayed when the job was created. (For the workorder details, see Step 16 in Starting a New NetConfig Job).
For retried jobs, the job definitions are not updated. For such jobs, the original job definitions are retained.
ViewPorts
(button)
Port Details pop-up opens showing the list of devices, their corresponding ports and the group rule.
Click Close to close the pop-up window.
The View Ports button is available only for jobs that are either in Scheduled, Waiting for Approval, or in Rejected states.
To perform actions, click one of the following (For detailed descriptions of these operations see Operations Using the NetConfig Job Browser in Table 10-3):
•
•
•
•
•
Setting Job Approvers
If required, you can enable job approval for NetConfig jobs.
For more details see the topic Setting Up Job Approval in the section Enabling Approval and Approving Jobs Using Job Approval.
Configuring Default NetConfig Job Policies
Ensure that you have configured the default job policies for NetConfig jobs.
For more details see the topic Configuring Default Job Policies in the section Archiving Configurations and Managing Them Using Archive Management.
Password Policy for NetConfig Jobs
Ensure that you have set the password policy for NetConfig jobs. For more details see the topic Configuring Default Job Policies in the section Archiving Configurations and Managing Them Using Archive Management.
Setting the Transport Protocol Order for NetConfig Jobs
Ensure that you have set the Transport protocol order for your job using Resource Manager Essentials > Admin > Config Mgmt. For more details see the topic Configuring Transport Protocols in the section Archiving Configurations and Managing Them Using Archive Management.
Creating and Editing User-defined Tasks
You can create User-defined Tasks and add one or more templates to each task.
The template, in turn, is associated with the Meta-Data Framework (MDF) categories of devices, for which these templates will be applicable.
The templates contain configuration commands and rollback commands (see Creating Rollback Commands). You can enter the configuration commands either by typing them or by importing them from a file.
You can create a new task and add one or more templates to it. You can also add templates to an existing task. You name a task when you create it, and it is saved for future use. You can copy, edit, and reuse your tasks. You can assign access privileges to tasks while or after you create them (see Assigning Tasks to Users).
You cannot add User Defined Templates to System Defined Tasks.
After you successfully create a User-defined Task, this task will appear under the User-defined Tasks group in the Task Selector of the NetConfig Job creation wizard. You can create a NetConfig job using the User-defined task. For details on the Task Selector and job creation, see Step 2 in Starting a New NetConfig Job.
For each template, you should specify all the information including the configuration commands, rollback commands (see Rolling Back Configuration Changes), mode (Config or Enable), and the device category for which these commands will be applicable.
At the time of job creation, you should ensure that the User-defined task that you have selected is applicable to the MDF categories of the devices that you have selected.
If the task that you have selected does not apply to the categories of any of the devices that you have selected, it will not be displayed in the Applicable Tasks pane of the NetConfig job wizard, during job creation.
For example, if you have selected an CatalystOS category of device, but selected a user-defined task that is applicable to a Cable device, then the task will not appear in the Applicable Tasks pane of the job wizard and you will not be able to proceed further with the job creation. For details on the Applicable Tasks pane and job creation, see Step 7 in Starting a New NetConfig Job
Caution
View the Permission Report (Common Services > Server > Reports) to check whether you have the required privileges to perform this task.
Step 1
The User-defined Tasks dialog box appears. If you are creating a task for the first time, the system displays a message that there are no user-defined tasks.
The User-defined Tasks dialog box has a Tasks browser in its left pane. After you create a task, the task is displayed in the Tasks browser along with its templates.
Step 2
Name
Enter name for the new task. This is a mandatory field.
To create new task from a copy of an existing task:
1.
2.
3.
To modify a task, select it from the tasks list but do not modify its name.
You can modify a task by adding or deleting templates, modifying existing templates and changing other details.
Template Name
Enter the template name. This is a mandatory field.
Template Name is provided for User Defined Tasks when you create a template for more than one device category which has different commands to execute.
Command Mode
Select mode (config or enable) in which commands will run.
Each user-defined template can run commands in one mode only.
If you select Enable, enter Rollback Commands area is disabled because only config commands can be rolled back.
Parameterized
Select Parameterized if you want to create a parameterized template.
The template parameters will be picked up from a file that you specify, at the time of scheduling a job using this task. See "Parameterized Templates".
Device Type
Select device category template will configure.
You can associate any number of MDF categories with a template, if the command is applicable to them.
CLI Commands
Enter configuration commands or select the configuration commands file.
The configuration commands file should reside in the default location:
On Solaris:
/var/adm/CSCOpx/files/rme/netconfig/cmdFiles/
On Windows:
NMSROOT\files\rme\netconfig\cmdFiles
Where, NMSROOT is the CiscoWorks install directory.
If you want to import the configuration commands from an existing file, enter the default file location in the Import from File field.
Alternatively, when you click on the Browse button, a file browser opens with the default location of the configuration commands file. You cannot change this default import directory.
To enter configuration commands, do any of the following:
•
Or
•
•
A file browser opens with the default location of the configuration commands file. You cannot change this default import directory.
You can also enter interactive commands and multi-line commands. See Handling Interactive Commands.
Rollback Commands
Enter configuration commands for the template to run when the job fails and the failure policy is set to the rollback option.
If you want to import the rollback commands from an existing file, enter the file location in the Import from File field.
The rollback commands file should reside in the default location:
On Solaris:
/var/adm/CSCOpx/files/rme/netconfig/cmdFiles/
On Windows:
NMSROOT\files\rme\netconfig\cmdFiles
Where, NMSROOT is the CiscoWorks install directory.
Alternatively, when you click on the Browse button, a file browser opens with the default location of the rollback commands file. You cannot change this default import directory.
To enter rollback commands, do any of the following:
•
•
•
A file browser opens with the default location of the configuration commands file. You cannot change this default import directory.
•
Or
•
To cancel the user-defined task you are creating, select a command from the Jobs or Admin menu (or a corresponding button) and click Yes in the resulting dialog box.
To add a user-defined task, select Select Resource Manager Essentials > Config Mgmt > NetConfig > User-defined Tasks. The User-defined Tasks dialog box appears with no values.
To copy a user-defined task:
Step 1
The details appear in the right pane of the User-defined Tasks dialog box.
Step 2
To modify a user-defined task:
Step 1
The details appear in the right pane of the User-defined Tasks dialog box.
Step 2
You can change details such as the command mode, parameterization option, the device type, the CLI commands or the rollback commands.
You can add a template or delete an existing one. When you click Save, a message appears that the task is modified.
Parameterized Templates
You can include parameterized templates within User-defined tasks. A parameterized template allows the configuration commands in the templates to contain user-defined variables.
Multiline feature of parameterized templates is not supported. However, interactive command deploy is supported.
You can select the Parameterized option when you create a User-defined task (see Creating and Editing User-defined Tasks).
If you select the Parameterized option, you should enter the actual values for the parameters in the template in a separate Parameters file (see Creating a Parameters File (XML file)) when you create a NetConfig job (see Creating and Editing User-defined Tasks). The Parameters file is the XML file that contains the parameter values.
The Parameters file should reside on the server at this location:
NMSROOT\files\rme\netconfig\cmdFiles
where NMSROOT is the RME install directory.
To create a Parameterized User-defined task and apply this in a NetConfig job:
Step 1
For example:
You can enter the command ntp server $ntpServer in the CLI Commands text box in the User-defined Tasks dialog box. Commands
Step 2
Step 3
Step 4
For example:
<DEVICE NAME = 10.76.38.54>
<CMDPARAM NAME = ntpServer>
<value>mytimeserver</value>
</CMDPARAM>
</DEVICE>Step 5
Alternatively, you can have a global section if that variable does not change for each device. For details, see Creating a Parameters File (XML file).
Step 6
Step 7
You are prompted to enter the filename while adding the task to the NetConfig job.
You can check the syntax of the text file that contains the parameters. To do this, select Check Syntax.
Step 8
Creating a Parameters File (XML file)
A specific format is defined for embedding variables in User-defined tasks and the corresponding Parameters file that contains the values for the parameters.
The variables in the User-defined tasks, which you enter in the CLI Commands text area of the User-defined Tasks dialog box (see Creating and Editing User-defined Tasks), should be preceded by
$.For example, for an NTP server parameter, it should be:
$ntpServerSimilarly, the Parameters file also follows a specified format.
Here is the sample format and example of the Parameters file (the XML command file that contains the values for the parameters) for a parameterized template:
<GLOBAL>
<CMDPARAM NAME =password>
<value>abc</value>
</CMDPARAM>
<CMDPARAM NAME =message>
<value>test all</value>
</CMDPARAM>
</GLOBAL>
<DEVICE NAME =10.76.38.54>
<CMDPARAM NAME =ntpServer>
<value>ServerName</value>
</CMDPARAM>
</DEVICE>You can assign the device-specific values to variables in the
<DEVICE>area. If there are no device-specific values, the default values in the<GLOBAL>area are considered as actual values for these variables. You do not need to add a<GLOBAL>area in the Parameters file if you are referencing each device explicitly (using the<DEVICE>area for each device).Parameters File: More Examples
This section gives more examples of the format of the text to be entered in the CLI Commands body at the time of creating a User-defined Task, and the commands to be entered in the corresponding Parameters file.
For example, you can enter these parameters while creating a User-defined task, in the CLI Commands text box:
ntp serverntpServer
ip http portportValue
ip addressipAddressIn the corresponding Parameters file, which is stored under NMSROOT\files\rme\netconfig\cmdFiles, (where NMSROOT is the RME install directory) enter:
<GLOBAL>
<CMDPARAM NAME =ntpServer>
<value>10.10.10.10</value>
</CMDPARAM>
<CMDPARAM NAME =portValue>
<value>90</value>
</CMDPARAM>
<CMDPARAM NAME =ipAddress>
<value>1.1.1.1</value>
</CMDPARAM>
</GLOBAL>
<DEVICE NAME =10.76.38.54>
<CMDPARAM NAME =ntpServer>
<value>20.20.20.20</value>
</CMDPARAM>
<CMDPARAM NAME =portValue>
<value>55</value>
</CMDPARAM>
</DEVICE>
<DEVICE NAME =10.77.202.229>
<CMDPARAM NAME =ntpServer>
<value>30.30.30.30</value>
</CMDPARAM>
</DEVICE>In such a case, when the NetConfig job contains the device 10.76.38.54, the following commands are generated:
ntp server 20.20.20.20 (taken from the device-specific section of the Parameters file)ip http port 55(taken from the device-specific section of the Parameters file)ip address 1.1.1.1(taken from the global section of the Parameters file)When the job contains the device 10.77.202.229, the following commands are generated:
ntp server 30.30.30.30 (taken from the device-specific section of the Parameters file)ip http port 90(taken from the global section of the Parameters file)ip address 1.1.1.1(taken from the global section of the Parameters file)When the job contains any other devices, all the values are taken from the global section of the XML file, and the following commands are generated:
ip http port 55
If the value for a parameter is not found in the command file, the syntax check (in the job creation flow) displays an error.
You can enter any special character, except <, >, and $, that is accepted by the device as the value for a parameter in the command file. This is because NetConfig does not process the parameter values. NetConfig only reads the value given between
ip address 1.1.1.1andtags and generates the command. Therefore, you can enter any special character that the device accepts.Assigning Tasks to Users
You can assign access privileges to NetConfig tasks, to users with Network Operator privileges or lesser. All other users with privileges higher than Network Operator are assigned all tasks by default.
A network administrator must assign task access privileges to other users. See Understanding NetConfig User Permissions section for details.
Note
To assign tasks to users:
Step 1
The Assign Tasks dialog box appears.
Step 2
This should be a valid CiscoWorks user. If RME has been registered with a Cisco Secure ACS Server, then the user should be a valid ACS user.
Step 3
You can select more than one task, by holding down the Shift key while selecting the task.
The selected tasks appear in the Selected Tasks list box.
To remove assigned tasks, select the tasks from the Selected Tasks list box and click Remove.
Step 4
Step 5
For a specified user, to see the assigned tasks, enter the username in the Username field and click Show Assigned.
The tasks assigned to the user appear in the Selected Tasks list box.
Step 6
The User Task Report shows the list of users and the tasks assigned for each user.
Note
Handling Interactive Commands
An interactive command is the input you will have to enter, following the execution of a command.
For example, on a Catalyst device, a clear counters command on a Cat 5000 will give the following output:
c5000# (enable) clear counters. This command will reset all MAC and port counters reported in CLI and SNMP. Do you want to continue (y/n) [n]?
In RME, such commands can be included in config jobs executed via NetConfig or ConfigEditor. For more details also see Editing and Deploying Configurations Using Config Editor.
You can handle interactive commands using NetConfig user-defined templates, and by using Adhoc tasks. See Using NetConfig User-defined Templates and Adhoc Tasks.
You cannot run interactive commands through NetConfig CLI.
Using NetConfig User-defined Templates and Adhoc Tasks
You can enter an interactive command in the Enter CLI Commands area, using the following syntax:
CLI Command<R>command response 1 <R>command response 2
<R> tag is case-sensitive and this must be entered in uppercase only.
Example
For a Catalyst device, a clear counters command will give the following output
ip http port 90
ip address 1.1.1.1
ntp server 10.10.10.10
ip http port 90
ip address 1.1.1.1
<value>To accept the default value, you do not need o enter any values after the tag
</value>.Handling Multi-line Commands
You can enter multi-line commands as a part of User-defined and Adhoc tasks. The multi-line commands must be within the tag <MLTCMD> and </MLTCMD>.
These tags are case-sensitive and you must enter them only in uppercase. You cannot start this tag with a space.
Example
c5000# (enable) clear counters This command will reset all MAC and port counters reported in CLI and SNMP. Do you want to continue (y/n) [n]?"Welcome to
To clear the counter, the syntax is:
clear counters <R>yMulti-line commands" </MLTCMD>
You can have a blank line within a multi-line command. The commands within the MLTCMD tags are considered as a single command and will be downloaded as a single command onto the device.
Using System-defined Tasks
NetConfig provides you with System-defined configuration tasks. You can create configuration commands using task GUI (see Understanding the System-defined Task User Interface (Dialog Box)).
Each task supports one or more device categories (see Table 10-4). Table 10-4 provides you with a comprehensive list of all the templates available, and a brief description of each.
•
•
•
All System-defined tasks are categorized into various task groups in the Tasks Selector. To select the tasks, you need to expand the corresponding task group node.
After you select the devices and the tasks, and click Next (see Starting a New NetConfig Job), the selected tasks appear in the Applicable Tasks pane of the Add Tasks dialog box (in the Job wizard).
When you select an applicable task and then click Add Instance, a dialog box opens for the selected system-defined configuration task.
This is a dynamic user interface. The task dialog box displays parameters based on your device selection in the Device Selector.
For example, if you have selected IOS devices, you will be able to specify IOS parameters in this dialog box. If not, this section will not be available to you.
When you enter information in the fields of the task and click Save, the task appears as a numbered instance in the Added Instances pane of the Add Tasks dialog box.
For the detailed procedure, and also for information on how to edit the task instances, view CLI, or delete the instances, see Starting a New NetConfig Job.
You can add multiple instances of a configuration task to a job by selecting an applicable task, adding information and saving the information each time. However, you can include only one instance of a task in a job.
Each System-defined task also creates rollback commands that you can use to roll back the changes to devices if the job fails.
•
•
Table 10-4 NetConfig System-Defined Tasks Supported by the RME 4.3 Device Categories
General
Adhoc (See Adhoc Task.)
Enter any configuration commands as required.
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Authentication Proxy (See Authentication Proxy Task.)
Configure Authentication Proxy.
Yes
-
-
-
-
Yes
Banner (See Banner Task.)
Add, remove, or edit banners.
Yes
Yes
-
-
-
Yes
CDP (See CDP Task.)
Configure Cisco Discovery Protocol (CDP).
Yes
Yes
-
Yes
-
-
Yes
DNS (See DNS Task.)
Configure DNS.
Yes
Yes
Yes
Yes
Yes
-
Yes
HTTP Server (See HTTP Server Task.)
Configure HTTP access on VPN devices.
Yes
Yes
-
-
-
Yes
Configure IGMP of selected cable interfaces.
-
-
-
-
-
-
Yes
IKE Configuration2 (See Internet Key Exchange (IKE) Configuration Task.)
Configure IP security (IPSec).
Yes
-
-
-
-
Yes
Yes
Interface IP Address (See Interface IP Address Configuration Task.)
Configure IP interface address of selected interface.
-
-
-
-
-
-
Yes
NTP Server (See NTP Server Configuration Task.)
Configure Network Time Protocol (NTP).
Yes
Yes
Yes
Yes
-
-
Yes
RCP (See RCP Configuration Task.)
Configure rcp
Yes
-
-
-
-
-
Yes
Reload (See Reload Task.)
Reload devices
Yes
-
-
Yes
Yes
-
Yes
Smart Call Home (See Smart Call Home Task.)
Register devices with Cisco Smart Call Home
Yes
-
-
-
-
-
-
Syslog (See Syslog Task.)
Configure Syslog message logging.
Yes
Yes
Yes
Yes
-
Yes
Yes
Transform Set (See Transform System-Defined Task.)
Configure IPSec.
Yes
-
-
-
-
Yes
Yes
User Defined Protocol (See Use-defined Protocol Task.)
Configure the User-defined protocol on NAM devices.
-
-
-
-
Yes
-
-
Web User (See Web User Task.)
Configure the web user for NAM devices
-
-
-
-
Yes
-
-
Cable
Cable BPI/BPI+ (See Cable BPI/BPI+ Task.)
Assign self-signed certificate, configure cable interface, and set BPI/BPI+ options.
-
-
-
-
-
-
Yes
Cable DHCP-GiAddr and Helper1 (See Cable DHCP-GiAddr and Helper Task.)
Configure DCHP-GiAddr and Helper Address of the selected cable interface.
-
-
-
-
-
-
Yes
Cable Downstream1
(See Cable Downstream Task.)
Activate/Deactivate DS Ports, Interleave Depth, MPEG Framing Format, Modulations, Channel ID and Frequency of the selected cable interfaces.
-
-
-
-
-
-
Yes
Cable Interface Bundling1 (See Cable Interface Bundling Task.)
Configure Interface Bundling on selected cable interface.
-
-
-
-
-
-
Yes
Cable Spectrum Management (See Cable Spectrum Management Task.)
Assign Spectrum Groups and Interfaces on a selected cable interface.
-
-
-
-
-
-
Yes
Cable Trap Source (See Cable Trap Source Task.)
Configure SNMP Traps hosts, notification, message and notification of SNMP Traps on a cable interface.
-
-
-
-
-
-
Yes
Cable Upstream1 (See Cable Upstream Task.)
Activate and configure upstream on selected cable interfaces.
-
-
-
-
-
-
Yes
Credential
Enable Password (See Enable Password Task.)
Configure, or change enable or secret password to enter in the enable mode on devices.
Yes
Yes
-
-
-
Yes
Yes
Local Username (See Local Username Task.)
Configure local username and password authentication on devices.
Yes
-
Yes
-
-
-
Yes
SSH (See SSH Configuration Task.)
Configure SSH.
Yes
-
Yes
Yes
Yes
Yes
Telnet Password (See Telnet Password Configuration Task.)
Add, remove, and edit Telnet passwords.
Yes
Yes
-
-
-
Yes
Yes
Encryption
Certification Authority2 (See Certification Authority Task.)
Create, or modify Certification Authority. Provides manageability and scalability for IP security (IPSec) standards on VPN devices.
Yes
-
-
-
-
Yes
CryptoMap2 (See Crypto Map Task.)
Configure IPSec.
Yes
-
-
-
-
Yes
Yes
EEM
Embedded Event Manager (See Embedded Event Manager Task)
Configure EEM Scripts or Applets on the devices
Yes
-
-
-
-
-
-
EEM Environmental Variables (See EEM Environmental Variables Task)
Configure EEM Environmental Variables on the devices
Yes
-
-
-
-
-
-
GOLD
GOLD Boot Level (See GOLD Boot Level Task)
Configure Boot Level Diagnositc tests on the devices
Yes
-
-
-
-
-
-
GOLD Monitoring Test (See GOLD Monitoring Test Task.)
Configure GOLD Monitoring tests on devices
Yes
-
-
-
-
-
-
SNMP
SNMP Community (See SNMP Community Configuration Task.)
Add, remove, and edit SNMP community strings
Yes
Yes
Yes
Yes
Yes
Yes
Yes
SNMP Security (See SNMP Security Configuration Task.)
Configure SNMP Security feature on devices.
Yes
-
-
Yes
-
-
Yes
SNMP Traps Management (See SNMP Traps Configuration Task.)
Configure SNMP traps.
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Port Macros
Auto Smartports (See Auto Smartports.)
Configure Auto Smartport macros on devices.
Yes
-
-
-
-
-
-
TACACS
TACACS (See TACACS Configuration Task.)
Configure TACACS authentication.
Yes
-
-
-
-
Yes
TACACS+ (See TACACS+ Configuration Task.)
Configure TACACS+ authentication
Yes
Yes
-
Yes
Yes
-
Yes
Radius Server (See RADIUS Server Configuration Task.)
Configure RADIUS server and task.
Yes
-
Yes
Yes
-
-
Yes
User-defined Tasks
Lists all user-defined tasks
1 At a time, you can apply this task only to a single device, because cable templates configure interfaces on devices.
2 You must follow this sequence to complete the configuration of the IPSec on devices:
2 a. IKE configuration system-defined task.
2 b. Transform system-defined task.
2 c. Crypto Map system-defined task.
Understanding the System-defined Task User Interface (Dialog Box)
NetConfig tasks support devices in the following device categories:
•
•
•
•
•
•
•
Each of the system-defined tasks have their own dynamic user interface, or dialog box, that displays fields for a specified category of devices only if you have selected that category of device.
The dialog boxes for system-defined tasks may have these groups, links, and buttons:
•
•
No Category-specific Commands•
•
Save
Saves the information that you have entered in the fields in the task dialog box.
Reset
Clears all the fields.
Cancel
Cancels your changes, and closes the task dialog box.
For the cable devices, you can apply a task only to a single device at a time, because cable templates configure interfaces on devices.
Also, for the cable tasks to work correctly, you must have valid SNMP credentials in Device and Credential Repository (DCR). See Adding and Troubleshooting Devices Using Device Management for more information on setting valid SNMP credentials.
Therefore, if you have selected more than one cable device and selected tasks for them, the task may not appear in the Applicable Tasks pane of the Add Tasks dialog box. For the tasks that are applicable to cable devices, see Table 10-4.
Understanding the NetConfig Credentials Configuration Tasks
NetConfig provides for tasks to configure credentials on devices. These tasks are:
•
•
•
•
•
•
•
The credential store allows only one set of login credentials per device - Primary username and primary password, irrespective of the authentication type.
Hence, this imposes certain limitations on the NetConfig templates, especially, when you are configuring/modifying the authentication method on the device.
To overcome this, an option to specifically update the credential store is provided in the credential tasks. The credential store is updated only when this option is chosen with the values specified.
The usage of NetConfig credentials tasks to configure the credentials on a device should be based on the active credentials (e.g. Telnet, TACACS, etc.) in the device. For example if the device is configured with TACACS+, you should use only TACACS+ template to configure the credentials.
Example
When you remove the TACACS+ authentication for the device, the device reverts to the authentication method that was earlier configured on it. For example, the local username.
However, RME is unaware of the fallback authentication method, and the respective credentials. If Device and Credential Repository is not updated with the right credentials, the subsequent device operations from RME will fail.
In this case, you should select the option to update the local credential store and specify the local username credentials. When the job runs, NetConfig updates Device and Credential Repository with this set of credentials, so that for subsequent devices, access from RME will be successful.
Adhoc Task
You can use the Adhoc system-defined task to add configuration commands to a job, during job definition.
You cannot save an instance of an Adhoc task, for future use. If you need to reuse a template that provides capabilities unavailable from the system-defined tasks, you can create a user-defined tasks (see Creating and Editing User-defined Tasks).
Caution
Groups for each of device categories that you have selected, appear in the Adhoc Configuration dialog box. To invoke the Adhoc Configuration dialog box, see Starting a New NetConfig Job.
You can enter configuration and rollback commands for these device categories:
•
•
•
•
•
•
For more details, see Table 10-4.
Note
For the features of system-defined tasks and a description of the features of a system-defined task dialog box, see Understanding the System-defined Task User Interface (Dialog Box).
The fields in the Adhoc Configuration dialog box are:
Commands
CLI Command
Enter configuration commands.
You can also enter interactive commands (see Handling Interactive Commands) and multi-line commands see Handling Multi-line Commands).
Rollback Command
Enter rollback commands.
Command Mode
Config or Enable
Select the mode (config or enable) in which the task configuration commands will run.
If you have selected Catalyst OS, or NAM devices, then the enable mode is preselected, and you do not have the option to select the config mode.
The Command Mode group is not available for the Adhoc Task selected in the Port Based flow of the NetConfig job.
If you enter any credential command in the CLI Commands or Rollback Commands fields, then those credentials will be masked in the job work order and the job results page.
For example, the command, snmp-server community public ro will be displayed as snmp-server community ***** ro.
For each device category, click on Applicable Devices to view the devices in your selection, to which this task applies.
Authentication Proxy Task
The Authentication Proxy feature helps users to log into the network or access the Internet using HTTP. Their specific profiles are automatically retrieved and applied from a CiscoSecure ACS, or other RADIUS, or TACACS+ authentication server.
The Cisco Secure Integrated Software authentication proxy feature allows network administrators to apply specific security policies on a user to user basis. You can use the Authentication Proxy system-define, configuration Task on IOS devices which have been configured for VPN functionality.
The IOS category of devices (including Cable devices) are supported by this task.
For more details, see Table 10-4.
You can enter the details of this task in the Authentication Proxy Configuration dialog box. (To invoke this dialog box, see Starting a New NetConfig Job.)
For the features of system-defined tasks and a description of the features of a system-defined task dialog box, see Understanding the System-defined Task User Interface (Dialog Box).
The fields in the Authentication Proxy Configuration dialog box are:
Click on Applicable Devices to view the devices in your selection, to which this task applies.
IOS Devices with VPN Images
You can determine VPN images from the naming convention used for IOS images. The naming convention follows xxxx-yyyy-ww format.
Where, xxxx represents platform, yyyy represents features and ww represents format. If the middle value (yyyy) contains, the numeric
To accept the default, the syntaxes are:orclear counters <R>nn, where n is a number between 1 and 9, then this is a VPN image.For example,
oris a VPN image, since it contains the numberclear counters <R>.Banner Task
You can use the Banner system-defined, configuration task to change banners on devices.
The following device categories are supported by this task:
•
•
For more details, see Table 10-4.
You can enter the details of this task in the Banner Configuration dialog box. (To invoke this dialog box, see Starting a New NetConfig Job.)
For the features of system-defined tasks and a description of the features of a system-defined task dialog box, see Understanding the System-defined Task User Interface (Dialog Box).
The fields in the Banner Configuration dialog box are:
For each device category, click on Applicable Devices to view the devices in your selection, to which this task applies.
CDP Task
You can use the CDP system-defined task to configure Cisco Discovery Protocol (CDP) on devices.
The following device categories are supported by this task:
•
•
•
For more details, see Table 10-4.
You can enter the details of this task in the CDP Configuration dialog box. (To invoke this dialog box, see Starting a New NetConfig Job.)
For the features of system-defined tasks and a description of the features of a system-defined task dialog box, see Understanding the System-defined Task User Interface (Dialog Box).
The fields in the CDP Configuration dialog box are:
For each device category, click on Applicable Devices to view the devices in your selection, to which this task applies.
Certification Authority Task
You can use the Certification Authority (CA) system-defined configuration task to provide manageability and scalability for IP Security (IPSec) standards. The Certification Authority task can be used only on IOS devices configured for VPN functionality.
This task is applicable to IOS devices (including Cable devices).
For more details, see Table 10-4.
You can enter the details of this task in the Certification Authority Configuration dialog box. (To invoke this dialog box, see Starting a New NetConfig Job.)
For this task to work correctly, you must use any CLI-based protocol (Telnet or SSH) as the download protocol.
For the features of system-defined tasks and a description of the features of a system-defined task dialog box, see Understanding the System-defined Task User Interface (Dialog Box).
The fields in the Certification Authority Configuration dialog box are:
For each device category, click on Applicable Devices to view the devices in your selection, to which this task applies.
IOS Devices with VPN Images
You can determine VPN images from the naming convention used for IOS images. The naming convention follows xxxx-yyyy-ww format.
Where, xxxx represents platform, yyyy represents features and ww represents format. If the middle value (yyyy) contains, the numeric
<R>or<MLTCMD> banner loginn, where n is a number between 1 and 9, then this is a VPN image.For example,
CiscoWorks Resource Manageris a VPN image, since it contains the numberEssentials - you are using.Crypto Map Task
You can use the Crypto Map Server system-define task to configure IPSec on devices.
Note
The following device categories are supported by this task:
•
•
For more details, see Table 10-4.
You can enter the details of this task in the Crypto Map Configuration dialog box. (To invoke this dialog box, see Starting a New NetConfig Job.)
For the features of system-defined tasks and a description of the features of a system-defined task dialog box, see Understanding the System-defined Task User Interface (Dialog Box).
The fields in the Crypto Map Configuration dialog box are:
For each device category, click on Applicable Devices to view the devices in your selection, to which this task applies.
DNS Task
You can use the DNS system-defined task to configure DNS (Domain Name Server) on devices.
The following device categories are supported by this task:
•
•
•
•
•
•
For more details, see Table 10-4.
You can enter the details of this task in the DNS Configuration dialog box. (To invoke this dialog box, see Starting a New NetConfig Job.)
For the features of system-defined tasks and a description of the features of a system-defined task dialog box, see Understanding the System-defined Task User Interface (Dialog Box).
The fields in the DNS Configuration dialog box are:
For each device category, click on Applicable Devices to view the devices in your selection, to which this task applies.
Enable Password Task
You can use the Enable Password system-defined, configuration task to change the enable and secret passwords, which allow users to enter the enable mode on devices.
When you enable or disable an enable password, the change is made on the device and in Device and Credential Repository.
Note
The following device categories are supported by this task:
•
•
•
For more details, see Table 10-4.
You can enter the details of this task in the Enable Password Configuration dialog box. (To invoke this dialog box, see Starting a New NetConfig Job.)
For the features of system-defined tasks and a description of the features of a system-defined task dialog box, see Understanding the System-defined Task User Interface (Dialog Box).
Note
The fields in the Enable Password Configuration dialog box are:
Common Parameters
Setup
Action
Select an option to enable, disable or make no change to the enable password.
Password
Enter the enable password.
Verify
Re-enter the password.
IOS Parameters
Password
Level (1-15)
Set the Enable Password level. The level can be between 1 and 15. 15 is the default level.
For an IOS device, it is not advised to disable both Enable Password and Enable Secret password.
This is because the IOS device will not allow you to go into the Enable mode of the device. You can do this only if you have the console password for the device.
If you have selected Enable Password as No Change in the Common Parameters pane, and selected Disable for Enable Secret in the IOS Parameters pane, then Enable Secret Password is updated in the Device and Credentials database.
If you have selected Enable Password as Disable in the Common Parameters pane, and selected No Change for Enable Secret in the IOS Parameters pane, then Enable Password is updated in the Device and Credentials database.
Encrypted
Select this option to encrypt the password.
Update RME Credentials
Select this to update RME credentials. For details see Understanding the NetConfig Credentials Configuration Tasks
Secret
Action
Select an option to enable, disable or make no change to the secret password.s
Secret
Enter the secret password.
Verify
Re-enter the password.
Level (1-15)
Set the password level. The level can be between 1 and 15. 15 is the default level.
Encrypted
Select this option to encrypt the password.
CatOS Parameters
Password
Apply Command on Modules
Select to apply the command on the modules.
If you have selected Disable as the action in the Common Parameters group, then the password will be removed.
PIX Parameters
Level(0-15)
Set the password level. The level can be between 0 and 15. 15 is the default level.
Encrypted (Password should be 16 characters)
Select this option if the password you are entering is already encrypted. If you select this option ensure that your password is 16 characters.
For each device category, click on Applicable Devices to view the devices in your selection, to which this task applies.
HTTP Server Task
You can use HTTP Sever to configure HTTP access on IOS devices which have been configured for VPN functionality.
The following device categories are supported by this task:
•
•
For more details, see Table 10-4.
You can enter the details of this task in the HTTP Server Configuration dialog box. (To invoke this dialog box, see Starting a New NetConfig Job.)
For the features of system-defined tasks and a description of the features of a system-defined task dialog box, see Understanding the System-defined Task User Interface (Dialog Box).
The fields in the HTTP Server Configuration dialog box are:
For each device category, click on Applicable Devices to view the devices in your selection, to which this task applies.
You will lose Telnet access to the device if you configure HTTP Server. The Device may require TACACS/RADIUS/Local username and password after configuring HTTP Server. You should make sure that the device has the appropriate login configured. The username and password has to be stored in the RME Database.
IOS Devices with VPN Images
You can determine VPN images from the naming convention used for IOS images. The naming convention follows xxxx-yyyy-ww format.
Where, xxxx represents platform, yyyy represents features and ww represents format. If the middle value (yyyy) contains, the numeric
No Category-specific Commandsor56n, where n is a number between 1 and 9, then this is a VPN image.For example,
Kis a VPN image, since it contains the numberC7100-IS56I-MLocal Username Task
You can use the Local Username system-defined task configure local username and password authentication on devices.
The following device categories are supported by this task:
•
•
For more details, see Table 10-4.
You can enter the details of this task in the Local Username Task Configuration dialog box. (To invoke this dialog box, see Starting a New NetConfig Job.)
For the features of system-defined tasks and a description of the features of a system-defined task dialog box, see Understanding the System-defined Task User Interface (Dialog Box).
The fields in the Local Username Task Configuration dialog box are:
Common Parameters
Local User Setup
Action
Select an option to add, remove or make no change to the local username setup.
Username
Enter the local username.
Password
Enter local username password.
Verify
Re-enter the password.
IOS Parameters
Local User Setup
Privilege Level [0-15]
Set the required privilege level.
Local User Setup
Privilege Level [0-15]
Set the required privilege level.
No HangUp
Select this option to enable No Hang Up mode.
No Escape
Select this option to enable No Escape mode.
Local User Login Authentication
Action
Select to enable, disable or make no change to the local user authentication group of fields.
Local Username Credentials (Update RME creds)
Username
Values are entered in Device and Credential Repository only. They do not affect device configuration. For details see Understanding the NetConfig Credentials Configuration Tasks.
Password
Values are entered in Device and Credential Repository only. They do not affect device configuration. For details see Understanding the NetConfig Credentials Configuration Tasks.
Verify
Values are entered in Device and Credential Repository only. They do not affect device configuration. For details see Understanding the NetConfig Credentials Configuration Tasks.
CSS Parameters
For CSS devices:
•
•
•
Local User Setup
SuperUser
Select this option to designate the local user as superuser.
Password Type
Select the password type from these options:
•
•
•
Directory Access
Configure Directory Access
Select this option if you want to configure directory access. Defines the CSS directory access levels.
By default, CSS assigns users with read and write access to the directories. Changing the access level also affects the use of the CLI commands associated with the directories.
Directories
Script
Select the required access option to the Script directory:
•
•
•
•
Log
Select the required access option to the Log directory:
•
•
•
•
Root
Select the required access option to the Root directory:
•
•
•
•
Archive
Select the required access option to the Archive directory:
•
•
•
•
Release Root
Select the required access option to the Release Root directory:
•
•
•
•
Core
Select the required access option to the Core directory:
•
•
•
•
MIB
Select the required access option to the MIB directory:
•
•
•
•
For each device category, click on Applicable Devices to view the devices in your selection, to which this task applies.
IGMP Configuration Task
You can use this task to configure the Internet Group Management Protocol (IGMP) on a cable interface.
Note
You can enter the details of this task in the IGMP Configuration dialog box. (To invoke this dialog box, see Starting a New NetConfig Job.)
For the features of system-defined tasks and a description of the features of a system-defined task dialog box, see Understanding the System-defined Task User Interface (Dialog Box).
The fields in the IGMP Configuration dialog box are:
Click on Applicable Devices to view the devices in your selection, to which this task applies.
For more information regarding the IP addresses and IP multicast addresses refer to:
•
Interface IP Address Configuration Task
You can use this task to configure the IP address of a cable interface.
Note
You can enter the details of this task in the Interface IP Address Configuration dialog box. (To invoke this dialog box, see Starting a New NetConfig Job.)
For the features of system-defined tasks and a description of the features of a system-defined task dialog box, see Understanding the System-defined Task User Interface (Dialog Box).
The fields in the Interface IP Address Configuration dialog box are:
Note
Click on Applicable Devices to view the devices in your selection, to which this task applies.
Internet Key Exchange (IKE) Configuration Task
Use the Internet Key Exchange (IKE) Configuration System task to configure IPSec on devices.
The following device categories are supported by this task:
•
•
For more details, see Table 10-4.
You can enter the details of this task in the IKE Configuration dialog box. (To invoke this dialog box, see Starting a New NetConfig Job.)
For the features of system-defined tasks and a description of the features of a system-defined task dialog box, see Understanding the System-defined Task User Interface (Dialog Box).
For each device category, click on Applicable Devices to view the devices in your selection, to which this task applies.
NTP Server Configuration Task
You can use the NTP Server system-defined task to configure Network Time Protocol (NTP) on devices.
The following device categories are supported by this task:
•
•
•
•
For more details, see Table 10-4.
You can enter the details of this task in the NTP Server Configuration dialog box. (To invoke this dialog box, see Starting a New NetConfig Job.)
For the features of system-defined tasks and a description of the features of a system-defined task dialog box, see Understanding the System-defined Task User Interface (Dialog Box).
RADIUS Server Configuration Task
You can you use the RADIUS system-defined task to configure RADIUS on devices.
The following device categories are supported by this task:
•
•
•
For more details, see Table 10-4.
You can enter the details of this task in the RADUIS Server Configuration dialog box. (To invoke this dialog box, see Starting a New NetConfig Job.)
For the features of system-defined tasks and a description of the features of a system-defined task dialog box, see Understanding the System-defined Task User Interface (Dialog Box).
Common Parameters
Host Configuration
Action
Select to enable, disable, or make no change to the server configuration.
Server Name
Enter the server name.
Auth Port (0-65536)
Enter port used for authentication by RADIUS server.
Key Configuration
Action
Select to enable, disable, or make no change to the key configuration.
Key
Enter RADIUS authentication and encryption key string used by server specified in Host area.
Verify
Re-enter RADIUS key.
Login Authentication
Action
Select to enable, disable, or make no change to the login authentication.
This is not applicable for CSS
RADIUS Credentials (Update RME creds)
Username
Enter the username. For details see Understanding the NetConfig Credentials Configuration Tasks.
In case of CSS devices, this value will be used to update the Primary login details.
Password
Enter the password. For details see Understanding the NetConfig Credentials Configuration Tasks.
In case of CSS devices, this value will be used to update the Primary login details.
Verify
Re-enter the password to verify. For details see Understanding the NetConfig Credentials Configuration Tasks.
In case of CSS devices, this value will be used to update the Primary login details.
IOS Parameters
Login Authentication
List
Name
Enter default or named list.
Set to Default
Select the set the default list.
Type
Options
(Drop-down list 1)
Select the required option;
•
•
•
•
•
•
•
Similarly, select the type from the other three drop-down lists.
New Model
Action
Select to enable, disable, or make no change to new model state.
Enable mode Authentication
Action
Select to add, remove, or make no change to the enable mode authentication.
Credentials
Username
Enter the enable username.
Password
Enter the enable password.
Verify
Re-enter the enable password.
Type
Options
(Drop-down list 1)
Select the required option:
•
•
•
•
•
•
•
Similarly, select the type from the other three drop-down lists.
Content Engine Parameters
No category-specific commands.
CSS Parameters
Host Configuration
Action
Select to enable, disable, or make no change to the host configuration.
Secondary Server Name (Host Name or IP Address)
Enter the secondary server hostname or IP address.
Secondary Server Key
Enter the key for the secondary server. Defines the secret string for authentication transactions between the RADIUS server and the CSS. Enter a case-sensitive string with a maximum of 16 characters.
Verify
Re-enter the key to verify.
Authentication Port (1-65535)
Enter custom authentication port of RADIUS server. Value must be between 0-65535.
Optional field. Defines the UDP port on the secondary RADIUS server that receives authentication packets from clients. Enter a number from 0 to 65535. The default is 1645.
Other Parameters
Dead Time in seconds (1-255)
Enter the dead time in seconds. the value must be between 0—255.
Enter a number from 0 to 255. The default is 5.
If you enter 0, the dead time is disabled and the CSS does not send probe access-request packets to the non-responsive server. This command applies to primary and secondary servers.
Remove
Select to remove the dead time specification. Use the no form of this command to reset the dead-time period to its default of 5 seconds.
Retransmit (1-30)
Enter the retransmit value (between 1—30). Number of times that the CSS retransmits an authentication request. Enter a number from 1 to 30. The default number is 3.
Remove
Use the no form of this command to reset the retransmission of authentication request to its default of 3.
Source Interface Host (Host Name or IP Address)
Enter the source interface hostname or IP address.
Source Interface Host configuration is required to accept authentication from the RADIUS client. Note that this IP interface address is used for the NAS-IP-Address RADIUS attribute in the RADIUS Authentication Request.
Remove
Select to remove the source interface specification.
Timeout (1-255):
Enter the timeout value (between 1—2555). Timeout specifies the interval that the CSS waits for a reply to a RADIUS request before retransmitting requests to the RADIUS server.
Remove
Select the remove option to reset the interval to its default of 10 seconds.
For each device category, click on Applicable Devices to view the devices in your selection, to which this task applies.
RCP Configuration Task
You can use the RCP system-defined configuration task to configure rcp on devices.
This task supports the IOS category of device including Cable devices.
For more details, see Table 10-4.
You can enter the details of this task in the RCP Configuration dialog box. (To invoke this dialog box, see Starting a New NetConfig Job.)
For the features of system-defined tasks and a description of the features of a system-defined task dialog box, see Understanding the System-defined Task User Interface (Dialog Box)
The fields in the RCP Configuration dialog box are:
For each device category, click on Applicable Devices to view the devices in your selection, to which this task applies.
Reload Task
You can use the Reload task to schedule reload of devices. This task supports the IOS, Cat OS, SFS, NAM, CE, FastSwitch, PIX, CSS and Cable categories of devices. For more details, see Table 10-4.
You can enter the details of this task in the Reload Configuration dialog box. (To invoke this dialog box, see Starting a New NetConfig Job.)
For the features of system-defined tasks and a description of the features of a system-defined task dialog box, see Understanding the System-defined Task User Interface (Dialog Box)
The fields in the Reload Configuration dialog box are:
For each device category, click on Applicable Devices to view the devices in your selection, to which the reload task applies.
SNMP Community Configuration Task
You can use the SNMP Community Configuration system-defined task to replace, add, and remove device SNMP community strings.
The following device categories are supported by this task:
•
•
•
•
•
•
For more details, see Table 10-4.
You can enter the details of this task in the SNMP Community Configuration dialog box. (To invoke this dialog box, see Starting a New NetConfig Job.)
For the features of system-defined tasks and a description of the features of a system-defined task dialog box, see Understanding the System-defined Task User Interface (Dialog Box).
The fields in the SNMP Community Configuration dialog box are:
For each device category, click on Applicable Devices to view the devices in your selection, to which this task applies.
SNMP Security Configuration Task
You can use this task to configure SNMP Security feature on the following device categories:
•
•
For more details, see Table 10-4.
You can enter the details of this task in the SNMP Security Configuration dialog box. (To invoke this dialog box, see Starting a New NetConfig Job.)
For the features of system-defined tasks and a description of the features of a system-defined task dialog box, see Understanding the System-defined Task User Interface (Dialog Box).
The fields in the SNMP Security Configuration dialog box are:
The SNMP Security template enables you to configure Groups as well as Users with certain privileges. These Groups can be rolled back but the Users cannot be rolled back.
This is because the User details will not be available in the running configuration. Since NetConfig uses the running config to do roll back, rolling back Users is not possible.You should run a separate job to remove or add Users as required.
For each device category, click on Applicable Devices to view the devices in your selection.
•
http://www.cisco.com/en/US/products/sw/iosswrel/ps1831/products_installation_and_configuration_guides_list.htmlSNMP Traps Configuration Task
You can use this task to configure the host, trap notification, and trap/inform parameters. You can specify security parameters to communicate securely with the SNMP host. See SNMP Security Configuration Task to configure the SNMP security.
The following device categories are supported by this task:
•
•
•
•
•
For more details, see Table 10-4.
You can enter the details of this task in the SNMP Traps Configuration dialog box. (To invoke this dialog box, see Starting a New NetConfig Job.)
For the features of system-defined tasks and a description of the features of a system-defined task dialog box, see Understanding the System-defined Task User Interface (Dialog Box).
The fields in the SNMP Traps Configuration dialog box are:
For each device category, click on Applicable Devices to view the devices in your selection, to which this task applies.
For more information regarding configuring SNMP, refer to
Syslog Task
You can use the Syslog system-defined task to configure the collection of syslog messages from devices.
The following device categories are supported by this task:
•
•
•
•
•
For more details, see Table 10-4.
You can enter the details of this task in the Syslog Configuration dialog box. (To invoke this dialog box, see Starting a New NetConfig Job.)
For the features of system-defined tasks and a description of the features of a system-defined task dialog box, see Understanding the System-defined Task User Interface (Dialog Box).
The fields in the Syslog Configuration dialog box are:
For each device category, click on Applicable Devices to view the devices in your selection, to which this task applies.
SSH Configuration Task
You can use the SSH system-defined task to configure SSH on devices.
The following device categories are supported by this task:
•
•
•
•
For more details, see Table 10-4.
You can enter the details of this task in the SSH Configuration dialog box. (To invoke this dialog box, see Starting a New NetConfig Job.)
For this task to work correctly, you must use any CLI-based protocol (Telnet or SSH) as the download protocol.
For the features of system-defined tasks and a description of the features of a system-defined task dialog box, see Understanding the System-defined Task User Interface (Dialog Box).
For each device category, click on Applicable Devices to view the devices in your selection, to which this task applies.
For each device category, click on Applicable Devices to view the devices in your selection, to which this task applies.
TACACS Configuration Task
You can use the TACACS system-defined task to configure TACACS authentication.
This task supports the IOS device category including Cable devices.
For more details, see Table 10-4.
You can enter the details of this task in the TACACS Configuration dialog box. (To invoke this dialog box, see Starting a New NetConfig Job.)
For the features of system-defined tasks and a description of the features of a system-defined task dialog box, see Understanding the System-defined Task User Interface (Dialog Box).
Common Parameters
Server Configuration
Action
Select to enable, disable, or make no change to the TACACS Server configuration.
Hostname or IP Address
Enter the hostname or the IP address of the TACACS server.
Login Authentication
Action
Select to enable, disable, or make no change to the login authentication details.
Credentials
Username
Enter the username. These values are entered in Device and Credential Repository only. They do not affect device configuration. For details see Understanding the NetConfig Credentials Configuration Tasks.
Password
Enter the enable password. For details see Understanding the NetConfig Credentials Configuration Tasks.
Verify
Re-enter the enable password. For details see Understanding the NetConfig Credentials Configuration Tasks.
IOS Parameters
Server Retransmit
Action
Select to enable, disable, or make no change to the server retransmit configuration.
Retries [0-100]
Enter the number of re-tries.
Server Timeout
Action
Select to enable, disable, or make no change to the server timeout value.
Timeout [1-1000]
Enter the timeout value.
Enable mode Authentication
Action
Select to enable, disable, or make no change to the enable mode authenticating.
Credentials
Username
Enter the username
Password
Enter the enable password.
Verify
Re-enter the enable password.
TACACS+ Configuration Task
You can use the TACACS+ system-defined template to configure TACACS+ on devices.
This task supports the following device categories:
•
•
•
•
For more details, see Table 10-4.
You can enter the details of this task in the TACACS+ Configuration dialog box. (To invoke this dialog box, see Starting a New NetConfig Job.)
For the features of system-defined tasks and a description of the features of a system-defined task dialog box, see Understanding the System-defined Task User Interface (Dialog Box).
Common Parameters
TACACS Server Configuration
Server
Action
Select to enable, disable, or make no change to the TACACS Server configuration.
Hostname or IP Address
Enter the hostname or the IP address of the TACACS server.
Key
Action
Select to add, remove, or make no change to the TACACS encryption Key.
Key
Enter the TACACS encryption key. The key is used to set authentication and encryption. This key must match the key used on the TACACS+ daemon. The key can be of any size.
Verify Key
Re-enter the Key to confirm.
Login Authentication
Action
Select to enable, disable, or make no change to the TACACS+ authentication.
•
•
Credentials
Username
Enter TACACS+ username. These values are entered in the Device and Credential Repository only. They do not affect device configuration. For details see Understanding the NetConfig Credentials Configuration Tasks.
Password
Enter TACACS+ password. For details see Understanding the NetConfig Credentials Configuration Tasks.
Verify
Re-enter the password to confirm. For details see Understanding the NetConfig Credentials Configuration Tasks.
IOS Parameters
Enable mode Authentication
Action
Select to enable, disable, or make no change to the enable mode authenticating.
Credentials
Password
Enter the enable password.
Verify
Re-enter the enable password.
List
Name
Enter default or named list.
Set to Default
Select the set the default list.
Type
(Drop-down list 1)
Select the required option:
•
•
•
•
•
•
•
Similarly, select the type from the other three drop-down lists.
New Model
Action
Select to enable, disable, or make no change to new model state.
CatOS Parameters
Enable mode Authentication
Action
Select to add, remove, or make no change to the enable mode authentication.
Credentials
Password
Enter the enable password.
Verify
Re-enter the enable password.
Server Options
Primary
Click to designate specified server as primary TACACS server.
All
Click to clear all hosts from list of TACACS servers, if you selected remove in Action field.
ContentEngine Parameters
Server Option
Primary
Select to specify the server as primary.
Password Option
ASCII Password
Select for an ACSII password.
Connection Options
Timeout
Enter the timeout value.
Retries
Enter the number of re-tries.
NAM Parameters
No category-specific commands
The TACACS Server Key should be DES encrypted NAM devices.
At the time of enabling login authentication or enable mode authentication, it is mandatory for you to enter the username and password.
At the time of disabling login authentication or enable mode authentication, these fields are optional. While disabling login authentication or enable mode authentication, if username and password are not provided, then the corresponding fields in DCR are cleared and left blank.
This may make the device unreachable. Therefore we recommend that you provide the username and password at the time of disabling login authentication.
Telnet Password Configuration Task
You can use the Telnet Password system-defined configuration task to change the Telnet password on devices.
This task supports the following device categories:
•
•
•
For more details, see Table 10-4.
You can enter the details of this task in the Telnet Password Configuration dialog box. (To invoke this dialog box, see Starting a New NetConfig Job.)
For the features of system-defined tasks and a description of the features of a system-defined task dialog box, see Understanding the System-defined Task User Interface (Dialog Box).
For details on the NetConfig credentials configuration tasks, see Understanding the NetConfig Credentials Configuration Tasks.
If you change the Telnet password on a Catalyst device with an RSM module using this template, the RSM Telnet password is also changed.
The fields in the Telnet Password Configuration dialog box are:
Transform System-Defined Task
You can use the Transform system-defined task to configure IPSec on devices. You must configure the IKE configuration system-defined task before configuring the Transform system-defined task.
This task supports the following device categories:
•
•
For more details, see Table 10-4.
You can enter the details of this task in the Transform Set Configuration dialog box. (To invoke this dialog box, see Starting a New NetConfig Job.)
For the features of system-defined tasks and a description of the features of a system-defined task dialog box, see Understanding the System-defined Task User Interface (Dialog Box).
The fields in the Transform Set Configuration dialog box are:
Web User Task
You can use the Web User configuration task to configure the web user for NAM devices. This is a System-defined task. For more details, see Table 10-4. You can enter the details of this task in the Web User Configuration dialog box.
To invoke this dialog box, see Starting a New NetConfig Job.
For the features of system-defined tasks and a description of the features of a system-defined task dialog box, see Understanding the System-defined Task User Interface (Dialog Box).. The fields in the in the Web User Configuration dialog box are:
Click Applicable Devices to view the devices to which this task applies.
Use-defined Protocol Task
You can use the User-defined Protocol task to configure the user-defined protocol on NAM devices. This is a system-defined task.
For more details, see Table 10-4.
You can enter the details of this task in the User-defined Protocol Configuration dialog box. (To invoke this dialog box, see Starting a New NetConfig Job.)
For the features of system-defined tasks and a description of the features of a system-defined task dialog box, see Understanding the System-defined Task User Interface (Dialog Box).
The fields in the in the User-defined Protocol Configuration dialog box are:
Click Applicable Devices to view the devices to which this task applies.
Cable BPI/BPI+ Task
You can use the Cable BPI/BPI+ Task to assign BPI/BPI+ options.
This task is applicable to the Cable device category. For more details, see Table 10-4.
You can enter the details of this task in the Cable BPI/BPI+ Configuration dialog box. (To invoke this dialog box, see Starting a New NetConfig Job.)
For the features of system-defined tasks and a description of the features of a system-defined task dialog box, see Understanding the System-defined Task User Interface (Dialog Box).
The fields in the Cable BPI/BPI+ Configuration dialog box are:
Click Applicable Devices to see the devices in your selection, that are applicable for this task.
For more information, refer to:
•
Cable DHCP-GiAddr and Helper Task
You can use this task to configure the GiAddr field of DHCPDISCOVER and DHCPREQUEST packets with a relay IP address before they are forwarded to the DHCP server. You can apply this task only for a single Cable-CMTS device at a time.
This task is applicable to the Cable device category. For more details, see Table 10-4.
You can enter the details of this task in the Cable DHCP-GiAddr and Helper Configuration dialog box. (To invoke this dialog box, see Starting a New NetConfig Job.)
For the features of system-defined tasks and a description of the features of a system-defined task dialog box, see Understanding the System-defined Task User Interface (Dialog Box).
Note
The fields in the Cable DHCP-GiAddr and Helper Configuration dialog box are:
Click Applicable Devices to view the devices to which this task applies.
Cable Downstream Task
You can use this task to configure the Annex, Channel-ID, Frequency, Modulation, Interleave depth, and Set rate limit of downstream cable interface. You can also configure the Radio Frequency (RF) output of a downstream cable interface on a Cisco uBR7100 router.
This task is applicable only to Cable devices.
For more details, see Table 10-4.
You can enter the details of this task in the Downstream Configuration dialog box. (To invoke this dialog box, see Starting a New NetConfig Job.)
For the features of system-defined tasks and a description of the features of a system-defined task dialog box, see Understanding the System-defined Task User Interface (Dialog Box).
Note
The fields in the Downstream Configuration dialog box are:
Click Available Devices to view the list of devices from your selection, to which this task applies.
Cable Upstream Task
Use this task to configure the frequency, minislot size, power level and admission control on upstream cable interfaces. You can apply this task only for a single Cable-CMTS device at a time.
This task is applicable only to Cable devices.
For more details, see Table 10-4.
You can enter the details of this task in the Upstream Configuration dialog box. To invoke this dialog box, see Starting a New NetConfig Job.
For the features of system-defined tasks and a description of the features of a system-defined task dialog box, see Understanding the System-defined Task User Interface (Dialog Box).
Note
The fields in the Upstream Configuration dialog box are:
Click Available Devices to view the list of devices from your selection, to which this task applies
Cable Interface Bundling Task
You can use this task to configure the interface bundling. You can apply this task only to a single Cable-CMTS device at a time.
This task is applicable to the Cable device category. For more details, see Table 10-4.
You can enter the details of this task in husbanded Configuration dialog box. (To invoke this dialog box, see Starting a New NetConfig Job.)
For the features of system-defined tasks and a description of the features of a system-defined task dialog box, see Understanding the System-defined Task User Interface (Dialog Box).
Note
The fields in the Bundle Configuration dialog box are:
Click Applicable Devices to view the devices to which this task applies.
Cable Spectrum Management Task
You can use this task to create and assign spectrum groups to cable interfaces and upstream interfaces.
This task supports cable devices.
For more details, see Table 10-4.
You can enter the details of this task in the Cable Spectrum Management Configuration dialog box. To invoke this dialog box, see Starting a New NetConfig Job.
For the features of system-defined tasks and a description of the features of a system-defined task dialog box, see Understanding the System-defined Task User Interface (Dialog Box).
The fields in the Cable Spectrum Management Configuration dialog box are:
Click Applicable Devices to view the devices to which this task applies.
Cable Trap Source Task
You can use this task to configure SNMP Traps hosts, notification, message and notification of SNMP Traps on a cable interface.
This task supports cable devices.
For more details, see Table 10-4.
You can enter the details of this task in the Trap Source Configuration dialog box. (To invoke this dialog box, see Starting a New NetConfig Job.)
For the features of system-defined tasks and a description of the features of a system-defined task dialog box, see Understanding the System-defined Task User Interface (Dialog Box).
The fields in the Trap Source Configuration dialog box are:
Click Applicable Devices to view the devices to which this task applies.
Support for Auto Smartports and Smartports
Smartport macros provides an easy way to save and share common configurations. Each Smartport macro is a group of CLI commands. When you apply a Smartport macro on a port, the CLI commands within the macro will be deployed on the port. If the command fails when applying a macro, either due to a syntax error or a configuration error, the macro continues to apply the remaining commands on the port.
Auto Smartports macros applies the configuration commands on a port automatically based on the policy definitions configured in the device.
As part of provisioning Smartports and Auto Smartports, RME provides the following Netconfig tasks:
•
•
•
Auto Smartports
RME allows you to configure auto smartports macro policies on a device.
If Auto Smartports macro is enabled at device level, all the available ports in the device will be enabled for auto smartports, except for the ports that are in disabled state.
You can use the Auto Smartports task to:
•
•
You can enter the details of this task in the Auto Smartports Configuration dialog box.
To invoke this dialog box, see Starting a New NetConfig Job.
Note
The fields in the Auto Smartports Configuration dialog box are:
Manage Auto Smarports
You can use the Manage Auto Smartports task to enable or disable auto smartports functionality on a port.
You can enter the details of this task in the Manage Auto Smartports Configuration dialog box. To invoke this dialog box, see Starting a New NetConfig Job.
Note
The fields in the Manage Auto Smartports Configuration dialog box are:
When you schedule a NetConfig job for Manage Auto Smartports task and if you have selected any of the following Failure Policies, in the Job Schedule and Options dialog box, the rollback functionality will happen only if the archived configuration contains the command
fi.•
•
•
Smartports
You can use the Smartports task to apply smartports on a port by selecting the predefined smartports macros.
You can enter the details of this task in the Smartports Configuration dialog box. To invoke this dialog box, see Starting a New NetConfig Job.
Note
The fields in the Smartports Configuration dialog box are:
When you schedule a NetConfig job for Smartports task and if you have selected any of the following Failure Policies, in the Job Schedule and Options dialog box, the rollback functionality will not happen.
•
•
•
PoE Task
You can use the PoE task to configure Power and Power Policing in ports. Power Policing allows you to turn off power while generating syslogs. This is needed if the real-time power consumption exceeds the maximum power allocation on the port.
Power policing and ePoE is supported only on Catalyst 3750-E and Catalyst 3560-E switches with PoE ports.
You can enter the details of this task in the PoE Configuration dialog box. To invoke this dialog box, see Starting a New NetConfig Job.
Note
The fields in the PoE Configuration dialog box are:
You can generate PoE MAX Power Violation syslog report for this task.
To generate this custom report, see Overview: Syslog Analyzer Reports. The fields in the generated Syslog Analyzer PoE MAX Power Violation report are given below:
Catalyst Integrated Security Features
You can use the Catalyst Integrated Security Features task to configure Port Security, DHCP Snooping, Dynamic ARP Inspection and IP Source Guard on ports.
The Catalyst Integrated Security Feature is supported only on Catalyst 2960, 3560, 3560E, 3750, 3750E switches.
You can enter the details of this task in the Catalyst Integrated Security Features Configuration dialog box. To invoke this dialog box, see Starting a New NetConfig Job.
Note
The fields in the Catalyst Integrated Security Features Configuration dialog box are:
You can generate a Syslog Analyzer report for this task which lists only the Syslogs that are specific to Catalyst Integrated Security Features.
To generate this custom report, see Overview: Syslog Analyzer Reports. The fields in the generated Syslog Analyzer Catalyst Integrated Security Features Report are given below:
SRE Operation Task
You can use the SRE Operation task to perform the following operations in the service modules of SRE supported devices:
•
•
•
–
–
–
–
•
•
•
You can enter the details of the SRE Operation task in the SRE Operation Configuration dialog box. To invoke this dialog box, see Create a NetConfig Job based on Module or Port.
The fields in the SRE Operation Configuration dialog box are:
cwcli netconfig
This command is described in the cwcli framework chapter. For details see the topic Running the cwcli netconfig Command in the section CLI Utilities.
Use Case: Using NetConfig Templates to change Configurations for many Devices
Case
As a Network Administrator, you would want to change configuration for a set of devices in few simple steps.
Solution
You can use NetConfig to change the configurations of many devices in one step. You can select the devices and the corresponding system-defined or user-defined tasks and schedule a NetConfig job.
Let us say, you want to change the Local Username and Telnet password for few devices. To perform this:
Step 1
The Devices And Tasks dialog box appears.
Step 2
Step 3
NetConfig Tasks are also referred to as NetConfig templates.
Step 4
From your selection, only the tasks that are applicable to at least one device that you have selected, appear here. If the task that you have selected does not apply to the categories of any of the devices that you have selected, it will not be displayed in the Applicable Tasks pane.
Step 5
Figure 10-1 displays the Local Username Configuration dialog box.
Figure 10-2 displays the Telnet Password Configuration dialog box.
Figure 10-3 displays the Applicable tasks and Added Instances.
Step 6
Alternatively, you can click Edit to edit the selected instance or click Delete to delete an instance. You can only delete one instance at a time.
Figure 10-1 Local Username Configuration
Figure 10-2 Telnet Password Configuration
Figure 10-3 Add Task
Step 7
The Job Schedule and Options page appears.
For more information on how to schedule a NetConfig job, see Starting a New NetConfig Job.
Step 8
The Job Work Order screen appears.
Step 9
A notification indicating the successful creation of a job appears.
Example
endThe NetConfig job will be executed at the scheduled date and time. The Local Username Configuration and Telnet Password Configuration changes effected will be deployed on the selected applicable devices.
To know the status of the job scheduled, go to RME > Config Mgmt > NetConfig > NetConfig Jobs.
