Using Management Center for VPN Routers 1.3
Working with Activities
Download this chapter
Working with ActivitiesWorking with Activities
Download the complete book
Using Management Center for VPN Routers 1.3 - full book PDFUsing Management Center for VPN Routers 1.3 - full book PDF (PDF - 4 MB)
give_us_feedback

Table Of Contents

Working with Activities

Understanding Activities

Understanding Activity Statuses

Managing Activities

Creating an Activity

Locking an Object for the Activity

Opening an Existing Activity

Closing an Activity

Viewing Activity Details

Submitting an Activity for Approval

Approving/Rejecting an Activity

Deleting an Activity

Viewing an Activity's Audit Report


Working with Activities

Note This chapter is only relevant if you are working in Workflow Enabled mode. If you are working in Workflow Disabled mode (the default mode of operation in Router MC), you do not need to create and manage activities. See Understanding Router MC Workflow Modes, page 1-5 for more information.

When Workflow mode is enabled, all device management and configuration tasks must be done within the context of an activity.

The following topics provide information about activities:

•Understanding Activities

•Managing Activities

–Creating an Activity

–Locking an Object for the Activity

–Opening an Existing Activity

–Closing an Activity

–Submitting an Activity for Approval

–Approving/Rejecting an Activity

–Deleting an Activity

•Viewing an Activity's Audit Report

Understanding Activities

An activity is a temporary context within which you manage devices and define VPN and/or firewall settings and policies on specific objects (global, device groups, or devices). Before you make any changes to the device inventory or define any policies, you must create a new activity or open an existing activity. When you create an activity, you open a virtual copy of the Router MC policy database. You define your settings and policies within this virtual copy, but they are not committed to the database and made permanent until the activity is approved by a user with the appropriate permissions. After the activity has been approved and its policy definitions committed to the database, you can create a deployment job to generate the relevant CLI commands and deploy them to the devices.

Figure 1-1 illustrates the activity workflow.

Note If you try to manage devices or configure objects without first opening an activity, you will receive a message prompting you to either create a new activity or open an existing activity.

Are changes made within an activity visible to other users?

The changes you make within an activity are visible only within the activity. Other Router MC users will not see your policy definitions unless they open your activity (after you have closed it). Rather, they will see only the last approved committed configurations, meaning the settings and policies that had been defined and approved before you started working on your activity.

For example, assume that the Preshared Key page of the IKE section of the user interface shows that a preshared key of XYZ is defined on Device Group A. You open an activity and change that preshared key to UVW and then close the activity (the activity has not been approved). When other users open Router MC and navigate to the Preshared Key page, they will still see XYZ as the preshared key for Device Group A (unless they open your activity). However, after your activity has been approved and its configurations committed to the database, UVW will appear as the preshared key for Device Group A.

Activity Approval

Within an activity, you select the objects that you want to configure and then you define your policies. For the policies to be committed, the activity must be approved by a person with the appropriate permissions. This approval process at the policy definition level helps to ensure that no inappropriate configurations reach the network devices.

By default, Router MC assumes that the person defining the policies has the permissions to approve them. If your organization requires a different person with higher permissions to approve activities and thus commit the policies to the database, this setting can be changed in system settings under the Admin tab. If this setting is changed, activities must first be submitted for approval and then approved by a user with the appropriate permissions. Figure 1-1 illustrates the activity workflow that includes the submission step. See Defining System Settings, page 1-1 for information about changing the default activity approval setting.

Activities and Object Locking

Activities introduce a locking model, in which the objects for which policies are being defined and all their descendents in the object hierarchy are locked to other users until the activity is approved or deleted. This is useful in large networks where several people have the authority to configure devices. It prevents a potential situation in which two or more people are making configuration changes to the same objects at the same time.

When you start configuring an object, Router MC automatically locks that object and its descendants. You also have the option to lock an object or a set of objects for your activity only, before any configurations are defined.

Note If an object is locked by an activity and you try to configure that object, you will receive a message indicating that the object is locked and stating which activity is locking the object.

Activities and Multiple Users

Only one user can configure settings and policies within an individual activity at one time. However, multiple users can work in the activity in sequence, meaning that if an activity is closed (but not yet approved or submitted for approval), another user can open it and make changes. Multiple users can work in parallel in different activities.

Note If you leave an activity open and do not work on it for a specified amount of time, the activity will automatically be closed by the system.

Understanding Activity Statuses

An activity can have the following statuses:

•Editable—Configuration changes can be made to the objects selected for the activity. An activity remains editable until it is approved (or submitted for approval) or deleted. An activity can be opened and closed and edited any number of times while it is in the editable status. The objects being configured in the activity are locked, meaning that they cannot be configured within the context of another activity. The configuration changes can only be seen in the context of the current activity.

•Submitted—This status is only available if the activity submission step is enabled in the system settings under the Admin tab. It indicates that the activity was submitted for approval. The activity is no longer editable, meaning that no further configuration changes can be made within the activity. The objects selected for the activity are still locked to other activities. The approver can open the activity (in read-only mode) and approve or reject the activity. An approved activity moves to the approved status. A rejected activity becomes editable again.

•Approved—The activity was approved by a person with approval permissions. The configurations defined within the activity are now committed policy configurations and are ready to be deployed to the devices or to a file. The locks are lifted from the activity's object(s) and they can be configured within the context of another activity.

Figure 1-1 shows the stages in the activity workflow when the submission step is disabled (default), and the activity status at each stage.

Figure 1-2 shows the stages in the activity workflow when the submission step is enabled, and the activity status at each stage.

See Defining System Settings, page 1-1 for information about changing activity approval settings.

Figure 1-1 Activity Workflow with the Submission Step Disabled

Figure 1-2 Activity Workflow with the Submission Step Enabled

Managing Activities

You can access activity management options in the following ways:

•By selecting the Activity Management option under the Workflow tab. This opens the Activities page which contains a list of existing activities and their statuses. From this page, you can create new activities, and open, submit, approve, reject, or delete existing activities. See Table 1-1 for a description of the Activities page.

•By clicking an icon in the Activity bar in the top right corner of the Home, Devices and Configuration pages. The activity management icons available in the Activity bar vary depending on whether an activity has been opened and if so, what the status of that activity is. For example, if no activity is open, the Open An Activity icon will be provided, while the Close Activity icon does not appear. The possible options in the Activity bar are the same as those in the Activities page, with two additional options (lock current object and view details). See Table 1-1 for a description of these options.

See Table 1-6 on page 1-25 for a description of the Activity bar within the Router MC user interface elements.

The currently open activity is displayed in the Activity bar next to the icons. This enables you to see, at a glance, the context within which you are working. If no activity is open, the word None is displayed.

Activity management options include:

•Creating an Activity

•Locking an Object for the Activity

•Opening an Existing Activity

•Closing an Activity

•Submitting an Activity for Approval

•Approving/Rejecting an Activity

•Deleting an Activity

Table 1-1 describes the elements in the Activities page.

Table 1-1 Activities—GUI Reference 

UI Element
Description

# column

Sequentially numbers the activities in the list.

Radio button column

Enables you to select an activity to open it, submit it, approve it, or delete it.

Name column

Shows the name of the activity. You can click on an activity name to see the objects selected for the activity and other details about the activity.

Status Column

Shows the status of the activity. See Understanding Activity Statuses for information about activity statuses.

Opened by Column

Identifies the user who currently has the activity open.

Last Action Column

Shows the last action performed on the activity, for example, opened by user, submitted by user, and so forth.

Rows per page list box

Enables you to change the number of activities displayed per page.

Create button

Click to create a new activity.

Open button

Click to open the selected activity (for activities with Editable or Submitted statuses that have not already been opened by another user).

Close button

Click to close the selected activity. Users with Administrator permissions can close other users' activities.

Submit button

Click to submit the selected activity for approval. This button is not present if activity submission is disabled in the system settings under the Admin tab. See Defining System Settings, page 1-1.

When you click Submit, the activity is automatically closed but its objects remain locked until the activity is approved or deleted.

Approve button

Click to approve the selected activity and commit the activity's configurations to the Router MC database.

Reject button

Click to reject the selected activity and return it to the Editable status so that the appropriate changes can be made (for activities with Submitted status). This button is not present if activity submission is disabled in the system settings under the Admin tab. See Defining System Settings, page 1-1.

Delete button

Click to delete the selected activity.


Creating an Activity

Before configuring any object, you must create an activity. See Understanding Activities for information about the concept of activities in Router MC.

You can create an activity from the Activities page in the Workflow tab or by selecting an icon in the Activity bar in the top right corner of pages in the Devices and Configuration tabs.

Procedure

Step 1

Click the Add New Activity icon in the Activity bar.

or

Select Workflow > Activity Management, then click Create in the Activities page.

The New Activity dialog box appears.

Step 2 Enter a name and description for the activity in the relevant fields and click Create. The new activity appears in the list of activities in the Activities page. Its status is Editable and it is automatically opened upon creation.

Locking an Object for the Activity

When you create or open an activity, the objects selected in the Object Selector are only locked to other users when you actually start making configuration changes. Simply selecting objects in the Object Selector does not lock them and they can be selected by other users working in other activities.

To avoid this, you can lock the currently selected object and its descendents for the activity. In effect, you are reserving those objects for your activity so that they cannot be selected by any other activity.

Procedure

Step 1

Click the Lock Current Object icon in the Activity bar.

Step 2 You can verify that the object is locked by viewing the activity details. The object should be listed in the Selected Objects field. See Viewing Activity Details for more information.

Opening an Existing Activity

You can open an existing activity if nobody else has it open. You might open an editable activity to make further configuration changes or a submitted activity to review the activity to approve/reject its configurations (if you have the appropriate authority and if submission of activities is enabled in the system settings under the Admin tab). See Understanding Activities for information about the concept of activities in Router MC.

Note A submitted activity opens in read-only mode.

Procedure

Step 1

Click the Open An Activity icon in the Activity bar. A list of available activities appears.

Step 2 Select the radio button next to the activity you want to open and click Open. The name of the open activity appears in the Activity bar.

OR

Step 1 Select Workflow > Activity Management. The Activities page appears.

Step 2 Select the radio button next to the activity you want to open and click Open. The activity is opened and its name appears in the Activity bar.

Closing an Activity

You can close an editable activity without approving it (or submitting it for approval) if you or other users want to continue configuring the devices at a later stage. See Understanding Activities for information about the concept of activities in Router MC.

Note An administrator can close an activity opened by another user.

Procedure

Step 1

Click the Close Activity icon in the Activity bar. A message appears, giving you the option to approve the activity (or submit it for approval), or continue closing the activity.

Step 2 Select the Proceed with close radio button and click OK. The activity is closed.

OR

Step 1 Select Workflow > Activity Management. The Activities page appears.

Step 2 Select the radio button next to the activity you want to close and click Close. A message appears, giving you the option to approve the activity (or submit it for approval), or continue closing the activity.

Step 3 Select the Proceed with close radio button and click OK. The activity is closed.

Viewing Activity Details

You can view information about a specific activity, including the objects selected for the activity, the activity status, and a history of actions performed on the activity.

Procedure

Step 1

Click the View Details icon in the Activity bar. The Activity Details dialog box appears.

Step 2 When you have finished reviewing the activity details, click Close to close the dialog box.

OR

Step 1 Select Workflow > Activity Management. The Activities page appears.

Step 2 Click on the name of the activity for which you want to view details. The Activity Details dialog box appears.

Step 3 When you have finished reviewing the activity details, click Close to close the dialog box.

Submitting an Activity for Approval

After you have finished your configurations within the activity, you must submit the activity for approval. Upon submission, the activity is automatically closed so that it can be opened by the user who has the permissions to approve it. When the activity is approved, its configurations are committed to the Router MC database, at which point they can be deployed to the devices.

When you submit an activity, you can send email to the relevant approvers to notify them that an activity requires approval. This is optional.

Note By default, submission of activities for approval is disabled in the application settings under the Admin tab. This means that the submission step is not required and you can approve the activity yourself (if you have the appropriate permissions). An administrator can change activity approval settings in the Admin tab if the organization requires one set of users to define configurations and another set to approve and commit them. See Defining System Settings, page 1-1 for information about changing activity approval settings.

Procedure

Step 1

Click the Submit Activity icon in the Activity bar. The Submit Activity Comment dialog box appears.

Step 2 If you want the approver to be notified by email, enter the relevant email address in the Approver Email(s) field. You can enter multiple email addresses, separated by commas.

Step 3 Enter a comment describing the reason for submitting the activity, if desired, and click OK. The activity status changes to Submitted.

OR

Step 1 Select Workflow > Activity Management. The Activities page appears.

Step 2 Select the radio button next to the activity you want to submit and click Submit. The Submit Activity Comment dialog box appears.

Step 3 If you want the approver to be notified by email, enter the relevant email address in the Approver Email(s) field. You can enter multiple email addresses, separated by commas.

Step 4 Enter a comment describing the reason for submitting the activity, if desired, and click OK. The activity status changes to Submitted.

Approving/Rejecting an Activity

If you have approval permissions, you can open a submitted activity, review the settings and policies defined on the selected objects, and then either approve or reject the activity. If you approve the configurations, they will be committed to the Router MC database and will be ready for deployment to the devices or to a file, within the context of a deployment job. If you reject the activity, it can be opened to make the necessary changes, and resubmitted for approval. See Understanding Activities for information about the concept of activities in Router MC.

Note If the submission step of the activity workflow is disabled (in the Admin tab) and you have the authority to approve configurations, click Approve to submit, approve, and commit the activity's configurations in one step. See Defining System Settings, page 1-1 for information about changing activity approval settings.

Before You Begin

•Open the submitted activity. See Opening an Existing Activity.

•Review the settings and policies defined for the activity by selecting the required tabs and options.

Procedure

Step 1

Click the Approve Activity icon in the Activity bar if you want to commit the activity's configurations to the database so that they can be deployed. Click the

Reject Activity icon if you do not want to commit the activity's configurations to the database.

Either the Approve Activity Comment or the Reject Activity Comment dialog box appears, depending on your selected action.

Step 2 Enter a comment describing the reason for approving/rejecting the activity, if desired, and click OK. The activity status changes to Approved or to Editable (if you rejected the activity).

OR

Step 1 Select Workflow > Activity Management. The Activities page appears.

Step 2 Select the radio button next to the required activity.

Step 3 Click Approve if you want to commit the activity's configurations to the database so that they can be deployed. Select Reject if you do not want to commit the activity's configurations to the database. Either the Submit Activity Comment or the Reject Activity Comment dialog box appears, depending on your selected action.

Step 4 Enter a comment describing the reason for approving/rejecting the activity, if desired, and click OK. The activity status changes to Approved or to Editable (if you rejected the activity).

Deleting an Activity

You can delete an activity if it is no longer required. When you delete an activity, you delete all the configurations that were made within the activity. Those configurations will never be included in the database and therefore, could never be deployed. See Understanding Activities for information about the concept of activities in Router MC.

Deleted activities are removed from the system according to the specifications under the Admin tab for maximum history of deleted activities. See Defining System Settings, page 1-1 for more information.

Procedure

Step 1

Click the Delete Activity icon in the Activity bar.

Step 2 Click OK when you are prompted to confirm the deletion. The activity is deleted. It no longer appears in the list of activities in the Activities page.

OR

Step 1 Select Workflow > Activity Management. The Activities page appears.

Step 2 Select the radio button next to the activity you want to delete and click Delete.

Step 3 Click OK when you are prompted to confirm the deletion. The activity is deleted and removed from the list of activities.

Viewing an Activity's Audit Report

You can generate a report showing a history of the actions performed in a specified activity or set of activities over a specified time period.

Procedure

Step 1 Select Reports > Audit Trail. The Audit Trail page appears.

Step 2 Select the Activity check box and deselect the other check boxes.

Step 3 Select the required activity in the Activity Name list box.

Step 4 If required, specify and start and end date to indicate a timeframe for the report.

Step 5 Select the information you want to include in the report by selecting the check boxes next to the relevant fields.

Step 6 Click Apply. The report is generated.