-
Installation and Configuration Guide for the Cisco NAM 2220 Appliance
-
About This Guide
-
Introducing the Cisco NAM 2220 Appliance
-
Preparing to Install the Cisco NAM 2220 Appliance
-
Installing the NAM 2220 Appliance
-
Installing the NAM 2220 Appliance Hardware Options
-
Configuring the Cisco NAM 2220 Appliance
-
Upgrading NAM Software
-
Maintaining the Cisco 2220 NAM Appliance
-
Monitor Port Requirements
-
Troubleshooting
-
Site Log
-
BIOS Settings
-
Using the Recovery CD
-
Index
-
Feedback
Table Of Contents
Configuring the Cisco NAM 2220 Appliance
Establishing Network Connectivity
Enabling the NAM Traffic Analyzer Web Server
Enabling the Web Server Summary
Checking the NAM Traffic Analyzer Web Server
Additional Configuration Using the NAM GUI
Managing the Cisco NAM 2220 Appliance
Shutting Down and Starting Up NAM 2220 Appliance
Configuring Logging Options and Generating Diagnostics
Resetting the NAM Root Password to the Default Value
Opening and Closing a Telnet or SSH Session to the NAM
Configuring the Monitored Device
Configuring a Monitored Device Interface
Configuring the Cisco NAM 2220 Appliance
This section describes how to configure the Cisco NAM 2220 appliance to establish network connectivity, configure IP parameters, and how to perform other required administrative tasks using the NAM command line interface (CLI). This chapter also provides information about how to get started with the NAM graphical user interface (GUI) and how to perform various system management tasks.
This chapter contains the following sections:
•
Logging In For the First Time
•
•
•
•
Note
http://www.cisco.com/en/US/docs/net_mgmt/network_analysis_module_software/4.0/command/
reference/guide/cmdref.html
Logging In For the First Time
After you turn power on and boot the Cisco NAM 2220 appliance for the first time, the login prompt displays on the attached console. When shipped from the factory, the root user is pre configured on the Cisco NAM 2220 appliance. The default password for the root user is root.
Note
The root user has access to the root (read/write) level of NAM and can enter NAM command-line interface (CLI) commands.
To log in to the Cisco NAM 2220 appliance for the first time, open a console session or a serial session with the NAM appliance:
Note
Step 1
nam.localdomain login: root
Step 2
After you enter the ID and password, you will be prompted to change the root password.
Cisco 2220 NAM Appliance (NAM2220)nam.localdomain login: rootPassword: rootCisco 2220 NAM Appliance (NAM2220) Console, 4.0(1)Copyright (c) 1999-2008 by Cisco Systems, Inc.System Alert! Default password has not been changed!Please enter a new root user password.Enter new UNIX password:Step 3
We recommend that you make a record of the password, and store this information in a secure location. You should change this password regularly in accordance with your site's password security policies. See Changing the Root Password.
Retype new UNIX password:passwd: password updated successfullyroot@nam.localdomain#
Changing the Root Password
This section describes how to change the root user password after the initial login session. To change the root password:
Step 1
Step 2
The Cisco NAM 2220 appliance ships from the factory with default settings for user root with a password of root.
Step 3
After you log in as the root user, you have read and write access to the root level of the NAM appliance, and you can enter and perform CLI commands.
root@hostname#Step 4
password root
New password:Confirm password:Step 5
We recommend that you make a record of the password and store this information in a secure location. You should change this password regularly in accordance with your site's password security policies.
Step 6
Examples
This section provides the following examples:
•
•
Changing the NAM Root Password: Example
root@nam1.company.com# password rootChanging password for user rootNew UNIX password: <rtpswd>Retype new UNIX password: <rtpswd>passwd:all authentication tokens updated successfullyroot@nam1.company.com#root@nam1.company.com# exitVerifying the NAM Root Password: Example
nam1.company.com login: rootPassword: <rtpswd>Terminal type: vt100Cisco Network Analysis Module (NAM 2220 Appliance) Console, 4.0Copyright (c) 2008 by cisco Systems, Inc.root@nam1.company.com#root@nam1.company.com# exitEstablishing Network Connectivity
This section describes how to configure the Cisco NAM 2220 appliance to configure IP parameters and establish network connectivity.
Log in to the Cisco NAM 2220 appliance from the management console and enter the following CLI commands with the appropriate information for your site:
Step 1
ip address ip-address subnet-mask
Example
root@localhost# ip address 172.20.104.126 255.255.255.248
Step 2
ip broadcast broadcast-address
Example
root@localhost# ip broadcast 10.255.255.255
Step 3
ip gateway ip-address
Example
root@localhost# ip gateway 172.20.104.123
Step 4
exsession on (for Telnet)
or
exsession on ssh (for SSH)
Examples
To configure the NAM appliance to enable Telnet access:
root@localhost# exsession on
To configure the NAM appliance to enable SSH access:
root@localhost# exsession on ssh
Note
Step 5
ip domain name
Example
root@localhost# ip domain your_company.com
Step 6
The syntax for this command is as follows:
ip host name
Example
root@localhost# ip host nam_machine
Step 7
The syntax for this command is as follows:
ip nameserver ip-address [ip-address] [ip-address}
Examples
root@localhost# ip nameserver 172.20.104.10
root@localhost# ip nameserver 172.20.104.10 172.20.104.20 172.20.104.30
Checking Your Configuration
After you finish configuring the NAM appliance for network connectivity, it is a good idea to check your connectivity and verify the IP parameters you have just configured for the NAM appliance.
Step 1
The syntax for this command is as follows:
ping {hostname | ip-address}
Examples
root@localhost# ping nam_machine.your_company.com
root@localhost# ping 172.20.104.10
The following is an example of the ping command showing successful connectivity:
root@nam_machine.your_company.com# ping 172.20.104.10PING 172.20.104.10 (172.20.104.10) 56(84) bytes of data.64 bytes from 172.20.104.10: icmp_seq=1 ttl=254 time=1.27 ms64 bytes from 172.20.104.10: icmp_seq=2 ttl=254 time=1.13 ms64 bytes from 172.20.104.10: icmp_seq=3 ttl=254 time=1.04 ms64 bytes from 172.20.104.10: icmp_seq=4 ttl=254 time=1.08 ms64 bytes from 172.20.104.10: icmp_seq=5 ttl=254 time=1.11 ms--- 172.20.104.10 ping statistics ---5 packets transmitted, 5 received, 0% packet loss, time 4003msrtt min/avg/max/mdev = 1.043/1.129/1.278/0.090 msroot@nam_machine.your_company.com#Step 2
The syntax for this command is as follows:
show ip
root@localhost# show ip
root@nam1.company.com# show ipThe following is an example of the show ip command output that shows a configured NAM appliance:
IP address: 172.20.104.10Subnet mask: 255.255.255.240IP Broadcast: 10.255.255.255IP Interface: ExternalDNS Name: nam_machine.your_company.comDefault Gateway: 172.20.105.10Nameserver(s): 172.20.104.30HTTP server: DisabledHTTP secure server: DisabledTACACS+ configured: NoTelnet: EnabledSSH: Disabledroot@nam_machine.company.com#Sample Output for the show ip NAM CLI Command
root@nam1.company.com# show ipIP address: 172.20.105.215Subnet mask: 255.255.255.192IP Broadcast: 10.255.255.255IP Interface: ExternalDNS Name: nam1.company.comDefault Gateway: 172.20.105.210Nameserver(s): 209.165.201.29HTTP server: DisabledHTTP secure server: DisabledTACACS+ configured: NoTelnet: EnabledSSH: Disabledroot@nam1.company.com#Enabling the NAM Traffic Analyzer Web Server
This section describes how to enable the NAM Traffic Analyzer web server and browser-based access to the NAM Traffic Analyzer graphical user interface (GUI).
Note
To enable the NAM web server and provide browser-based access, the following prerequisites must be met:
•
http://www.cisco.com/en/US/products/products_security_advisory09186a00801c110e.shtml
The ip http secure commands remain disabled until you install the patch. You can download the NAM software K9 cryptographic patch from Cisco.com.
•
To enable the NAM web server:
Step 1
telnet {ip-address | hostname}
or
ssh {ip-address | hostname}
Step 2
To enable the NAM HTTP web server:
ip http server enable
To enable the NAM HTTPS secure web server:
ip http secure server enable
The NAM requests a web administrator user name.
Enabling HTTP server...No web users are configured.Please enter a web administrator user name [admin]: <CR>The NAM web server requires at least one properly-configured web administrator. If the NAM does not prompt you for a web username and password, then at least one web administrator was previously configured.
Step 3
The NAM requests a password for the web administrator, then requests the password to be entered again to ensure accuracy.
New password: <adminpswd>Confirm password: <adminpswd>Step 4
Note
Enabling the Web Server Summary
The following summarizes the steps or interaction when you enable the NAM web server and access to it.
root@nam1# ip http server enableEnabling HTTP server...No web users are configured.Please enter a web administrator user name [admin]: <CR>New password: admin_passwordConfirm password: admin_passwordUser admin added.starting httpdstarting polldstarting swpolldSuccessfully enabled HTTP server.root@nam1#Checking the NAM Traffic Analyzer Web Server
After you have configured the NAM Traffic Analyzer web server and enabled access to it, you should check that the web server is working by launching a browser and trying to log in to the NAM.
To check the NAM Traffic Analyzer web server functionality, launch an approved internet browser and enter the IP address or host and domain name in the browser address field.
Note
http://www.cisco.com/en/US/docs/net_mgmt/network_analysis_module_software/4.0/release/notes/
nam40note.html#wp71802If the Cisco NAM 2220 Appliance web server is properly configured, you should access the NAM Traffic Analyzer login window as shown in Figure 5-1.
Figure 5-1 NAM Traffic Analyzer Login Window
At this point, the only user able to log in to the NAM Traffic Analyzer web server is the administrative user you configured when you enabled the web server.
Additional Configuration Using the NAM GUI
After you log in through the NAM Traffic Analyzer login window, you have access to the NAM graphical user interface (GUI). The NAM GUI is a browser-based interface that uses six main windows for you to set up and use the NAM. The six main windows are:
•
•
•
•
•
•
For detailed information on the NAM GUI, see the User Guide for the Network Analysis Module Traffic Analyzer for your NAM software release. You can find a PDF file of the user guide in the online help of the NAM GUI and on Cisco.com at the following URL:
After you log in to the NAM GUI, perform the following tasks:
Step 1
Figure 5-2 shows the Managed Device Information window. You can find more detailed information about the parameters required to set up a managed device in Chapter 3 of the User Guide for the CIsco Network Analysis Module Traffic Analyzer, 4.0.
Step 2
Figure 5-2 Managed Device Information Window
Step 3
Figure 5-3 shows an example of the Network Parameters window. Use this window to enter additional network connectivity parameters such as your site's name servers.
Figure 5-3 Network Parameters Window
Step 4
Figure 5-4 shows the content menu of the Admin > System window. The default view of that window is the System Overview window.
Figure 5-4 Admin > System Content Menu
You can find detailed information about the options in the Admin > System window content menu in the Admin chapter of the User Guide for the Cisco Network Analysis Module Traffic Analyzer, 4.0.
Step 5
Step 6
If NTP is used for time synchronization, enter at least one NTP server name or IP address.
Note
Step 7
Step 8
Step 9
Step 10
If you plan to use the local user database for authentication and authorization, continue with the next step. If you plan to use a TACACS+ database, proceed to Step 11.
Step 11
Figure 5-5 shows an example of the default local user database window.
Figure 5-5 Admin > Users > Local User Database Window
Step 12
Enter the IP address of the TACACS+ server and the secret key to communicate with the server. The secret key must be the same as the one configured in the TACACS+ server. Figure 5-6 shows an example of the Admin > Users > TACACS+ window.
Figure 5-6 Admin > Users > TACACS+ Window
Step 13
Regarding MPLS monitoring:
•
•
•
Note
Managing the Cisco NAM 2220 Appliance
This section contains the following information:
•
•
•
•
Note
–
(Example: user@nam_host.domain# ?).–
(Example: nam_host.domain# ip ?).•
Shutting Down and Starting Up NAM 2220 Appliance
To shut down the Cisco NAM 2220 appliance, issue the NAM CLI shutdown command.
The Cisco NAM 2220 appliance reboots after you press the Power button.
Verifying System Status
To verify the status of an installation, upgrade, or downgrade or to troubleshoot problems, use commands from those listed in Table 5-1, Common Diagnostic and Show Commands.
Note
Configuring Logging Options and Generating Diagnostics
To configure logging options for NAM 2220 Appliance, use commands as needed from the list of common network module commands shown in Table 5-2.
Note
Resetting the NAM Root Password to the Default Value
If you lose the password you set up for the root user, you can reset the root password to its default value. To reset the NAM root password to default value:
Step 1
When the NAM begins to boot, it will display the bootloader for approximately ten seconds as shown in Figure 5-7.
Figure 5-7 GNU GRUB Boot Loader
Per the instructions, use the ^ and v keys to select and highlight an entry. Press Enter to boot the selected OS, `e' to edit the commands before booting or `c' for a GNU command-line.
Step 2
The helper utility menu displays as shown in Figure 5-8.
Figure 5-8 Helper Utility Menu
==============================================================================Cisco Systems, Inc.Network Analysis Module (NAM2200) helper utilityVersion 1.1(0.5-Eng)-----Main menu1 - Download application image and write to HDD2 - Download application image and reformat HDD3 - Install application image from CD4 - Display software versions5 - Reset application image CLI passwords to default6 - Change file transfer method (currently ftp/http)7 - Send Pingn - Configure networkr - Exit and reset Services Engineh - Exit and shutdown Services EngineSelection [1234567dnfrh]:Step 3
The default password for user root is changed back to the default value of root.
What to Do Next
Verify that the default root password of root is accepted by performing the steps described in the "Opening and Closing a Telnet or SSH Session to the NAM" section.
To change the NAM root password, see the "Changing the Root Password" section.
Opening and Closing a Telnet or SSH Session to the NAM
This procedure opens and closes a Telnet or SSH session to the NAM. This procedure is not commonly performed, because you would typically use the NAM Traffic Analyzer (web GUI) to monitor and maintain the NAM. If, however, you cannot access the NAM Traffic Analyzer, then you might want to use Telnet or SSH to troubleshoot from the NAM CLI.
If your Cisco NAM 2220 appliance is not properly configured for Telnet or SSH access (see the following Prerequisites section), then you can open a Telnet session to the managed device to which the Cisco NAM 2220 appliance is connected, then open a NAM console session from the managed device.
Prerequisites
•
•
–
–
Telnet Prerequisites
•
SSH Prerequisites
•
•
SUMMARY STEPS
1.
or
ssh {ip-address | hostname}2.
3.
or
If you have not changed the password from the factory-set default, enter root as the root password.4.
5.
6.
DETAILED STEPS
Step 1
telnet {ip-address | hostname}
or
ssh {ip-address | hostname}
Example:host.domain# telnet 10.20.30.40
Example:host.domain# ssh 10.20.30.40
Logs in to a host that supports Telnet.
or
Starts an encrypted session with a remote networking device.
•
Step 2
At the login prompt, enter root.
Example:login: root
Accesses the root (read/write) level of NAM.
Step 3
At the password prompt, enter your password.
or
If you have not changed the password from the factory-set default, enter root as the root password.
Example:Password: root
—
Step 4
Perform the tasks that you need to perform in the NAM CLI. When you want to end the Telnet or SSH session to the NAM and return to the Cisco IOS CLI, complete Step 5 and Step 6.
For help using NAM CLI commands.
Step 5
exit
Example:root@localhost(sub-custom-filter-capture)# exit
root@localhost#
Leaves a subcommand mode.
•
Step 6
logout
Example:root@localhost# logout
Connection closed by foreign host.
Logs out of the NAM system.
Examples
Opening and Closing a Telnet Session to the NAM Using the NAM System IP Address: Example
nam_host> telnet 172.20.105.215Trying 172.20.105.215 ... OpenCisco Network Analysis Module (NAM 2220 Appliance)login: rootPassword: <password>Terminal type: vt100Cisco Network Analysis Module (NAM 2220 Appliance) Console, 4.0Copyright (c) 2008 by cisco Systems, Inc.WARNING! Default password has not been changed!root@nam.company.com#root@nam.company.com# logout[Connection to 172.20.105.215 closed by foreign host]nam_host>Opening and Closing an SSH Session to the NAM Using the NAM System Hostname: Example
host [/home/user] ssh -l root@namapplroot@namappl's password: <password>Terminal type: vt100Cisco Network Analysis Module (NAM 2220 Appliance) Console, 4.0Copyright (c) 2008 by cisco Systems, Inc.WARNING! Default password has not been changed!root@namappl.company.com#root@namappl.company.com# logoutConnection to namappl closed.host [/home/user]Configuring the Monitored Device
After you connect an output interface of a monitored (or managed) device to the monitoring ports of the Cisco NAM 2220 appliance, you must also configure the monitored device to send data to that interface. You do this in two steps:
•
•
Configuring a Monitored Device Interface
At the monitored device, configure the connection to the Cisco NAM 2220 appliance as a trunk port, but use the no negotiate option. Using the no negotiate option on the monitored device, precludes the switch or router from performing dynamic trunk protocol (DTP) with the appliance monitoring port.
The following example shows how to configure a switch port connected to the appliance monitoring port as Te 7/29.
From the monitored device command line, enter a CLI command like the following:
show run interface Te 7/29
C7600_SUP720_69# show run interface Te 7/29Building configuration...Current configuration : 178 bytes!interface Te7/29description connected to pilot unit NAM2204switchportswitchport trunk allowed vlan 10-20switchport mode trunkswitchport nonegotiateendCreating a SPAN Session
A SPAN session is required to you can SPAN the monitored device's traffic to the port connected to the monitoring port of the appliance. You can create a SPAN session using the monitored device's CLI or using the NAM appliance GUI.
See user guide for information about how to use the NAM GUI to set up the SPAN session.
