-
Using Management Center for VPN Routers 1.3
-
Preface
-
Introduction
-
Getting Started with Router MC
-
Router MC Scenarios
-
Working with Activities
-
Managing Devices
-
Configuring VPN Settings
-
Configuring an IOS Firewall on your VPN Router
-
Defining IKE Policies
-
Defining VPN Tunnel Policies
-
Configuring Translation Rules
-
Working with Building Blocks
-
Uploading Device Configurations
-
Deploying Configurations
-
Viewing Reports
-
Router MC Administration
-
Troubleshooting
-
Router MC Operating Prerequisites
-
Router MC User Permissions
-
Table Of Contents
Managing Deployment in Workflow Disabled Mode
Deploying Configurations to Devices (Workflow Disabled Mode)
Viewing Deployment Status Information (Workflow Disabled Mode)
Redeploying Configurations (Workflow Disabled Mode)
Aborting a Deployment (Workflow Disabled Mode)
Viewing Device Configurations (Workflow Disabled Mode)
Managing Deployment in Workflow Enabled Mode
Reviewing Generation Errors and Warnings
Reverting to the Previous Configuration (Rollback)
Viewing a Job's Deployment Status
Viewing the Deployment Status of Devices
Deploying Configurations
The settings and policies you define in Router MC must be deployed to your devices so that they can be implemented in your network.
In Router MC, the way in which you deploy configurations to your devices differs depending on your workflow mode. When workflow mode is disabled (default), you can save your policy definitions and deploy them immediately. When workflow mode is enabled, you must create a deployment job in which you select the devices and the deployment parameters. You then deploy the job.
See Comparison of Workflow Modes, page 1-7 for more information about the workflow modes.
The following topics provide information about deploying configurations to devices, in each workflow mode:
•
Managing Deployment in Workflow Disabled Mode
•
Managing Deployment in Workflow Disabled Mode
When workflow mode is disabled (default), you do not need to create a job to deploy configurations—Router MC automatically defines a job for you when you save and deploy configuration changes. You deploy configuration changes by clicking the Save and Deploy icon in the Deployment tab, or in the Actions bar of the Home page, Devices tab, or Configuration tab. See Understanding the Router MC Pages, page 1-25 for more information. Router MC translates the committed policy configurations for each device into command line interface (CLI) commands. These CLI commands can be previewed and deployed either directly to the devices in the network or to an output file (by a user with the authority to do so).
From the Deployment tab, you can manage deployment, view the status of your deployment sessions, and view the device CLI commands to be deployed to your devices. See Deployment Tab, page 1-22 for more information.
Note
The following topics provide information about managing deployment in Workflow Disabled mode:
•
•
•
Using the Actions Bar
When workflow mode is disabled, you can use the Actions bar in the Home page, Devices tab, or Configuration tab to generate configurations for changed devices, undo changes, and view changes that were made since the last save.
Table 1-1 shows the icons in the Actions bar.
Table 1-1 Actions Bar Icons (Workflow Disabled Mode)
Save and Deploy
Saves any configuration changes made since the last deployment, generates the configurations for devices and allows you to deploy them. See Deploying Configurations to Devices (Workflow Disabled Mode) for more information.
Undo Changes
Discards all changes to configurations and device inventories since the last save.
View Details
Opens a dialog box that displays the changes made to configurations and device inventories since the last save.
Deploying Configurations to Devices (Workflow Disabled Mode)
When you deploy your configurations, you can transfer the configurations generated for the devices in the deployment session to the devices in the network directly, or to files in a specified output directory.
Note
The following procedure describes the steps required to deploy configurations to your devices, after you have completed the configuration changes.
Procedure
Step 1
Click the Save and Deploy icon in the Deployment tab, or in the Actions bar of the Home page, Devices tab, or Configuration tab. See Table 1-6 on page 1-25 for a description of the elements in the Router MC user interface.
The Select Devices page of the Job wizard appears. See Table 1-5 for a description of the Select Devices page.
Step 2
Step 3
Step 4
Step 5
Step 6
Step 7
Step 8
Step 9
Step 10
a.
b.
c.
OR
If Summary does not appear in the TOC, click Finish to generate the configurations for the devices, or go back to a previous step in the wizard to change your definitions, as required.
Step 11
Viewing Deployment Status Information (Workflow Disabled Mode)
The Deployment Status page is accessed by selecting Deployment > Deployment Status. In this page you can view the status of your deployment sessions. From this page, you can also open a deployment session to view the CLI commands that were generated for its devices, redeploy a deployment session that failed, and abort a deployment session that is not yet deployed. See Table 1-2 for a description of the Deployment Status page.
The currently open deployment session is displayed in the top right corner of pages in the Deployment tab. This enables you to see the context within which you are working. If no deployment session is open, the word None will be displayed.
Understanding Deployment Statuses
Deployment sessions can have the following statuses:
•
•
•
•
See Viewing a Job's Deployment Status for more information about deployment statuses.
The following topics provide information about:
•
•
Table 1-2 describes each element in the Deployment Status page.
Table 1-2 Deployment Status—GUI Reference
# column
Sequentially numbers the deployment sessions in the list.
Radio button column
Enables you to select a deployment session and then perform the required action on it, for example, open it, redeploy it, and so forth.
Name field
Displays the name of the deployment session. You can click on a name to see details about the deployment, including the deployment status of each device relative to the overall deployment status. For example, if the overall deployment status is Deploying, you can see if the deployment process for each device is pending, in progress, failed, or completed. Likewise, if the overall deployment status is Generating, you can see the generation status of each device in the deployment session. In addition, if a process on a device has failed, you can see the reason for the failure.
See Viewing a Job's Deployment Status for more information.
Status field
Displays the status of the deployment session, for example, deploying, deployed, rejected, and so forth. See Understanding Deployment Statuses for more information.
Last Action field
Displays the last action done on the deployment session, for example, opened by user, redeployed by user, and so forth.
Rows per page list box
Enables you to change the number of deployment sessions displayed per page.
Open button
Click to open a selected deployment session, for viewing the CLI commands that were generated for its devices. The name of the open deployment session appears in the top right corner of the page.
See Viewing Device Configurations (Workflow Disabled Mode) for more information.
Redeploy button
Click to redeploy a selected deployment session. See Redeploying Configurations (Workflow Disabled Mode) for more information.
Abort button
Click to stop the deployment session. See Aborting a Deployment (Workflow Disabled Mode) for more information.
Redeploying Configurations (Workflow Disabled Mode)
You can redeploy a deployment session if necessary. For example, if the previous deployment failed, you could correct the problems that caused the deployment to fail and then redeploy it. Another example is if you want to change the directory to which configurations are deployed. You can also use the redeploy option to resume an aborted deployment session.
During redeployment, configurations are only written to devices for which the previous deployment failed.
You can redeploy a deployment session from the Deployment Status page, as described in the procedure below.
Note
Procedure
Step 1
Step 2
Step 3
Step 4
Step 5
Aborting a Deployment (Workflow Disabled Mode)
You can stop a deployment session. If Router MC has not yet begun to write commands to a device during deployment, the device's deployment status will become "Failed". If commands are currently being written to a device, the deployment will continue to completion. Aborting a deployment has no effect on devices in the deployment session that have already been deployed.
To resume a deployment session, you can redeploy it. See Redeploying Configurations (Workflow Disabled Mode) for more information.
Note
Procedure
Step 1
To abort the deployment session, click Abort in the Job Deployment Status page. Alternatively, you can return to the Deployment Status page (select Deployment > Deployment Status), select the deployment session, and click Abort.
A dialog box appears requesting confirmation of the Abort operation.
Step 2
Viewing Device Configurations (Workflow Disabled Mode)
Router MC enables you to view the CLI commands that will be written to your devices (or to configuration files) to implement your VPN and firewall definitions. You can preview device configurations before deployment, or you can confirm the configurations after deployment.
The following options are available for viewing a device's configurations:
•
The incremental view can also show the Router MC policies from which the generated CLI commands originated. You can choose whether to show this information by enabling or disabling an option in the System Settings under the Admin tab. See Defining System Settings, page 1-1 for more information.
•
•
If configurations have previously been deployed to the device, the current configuration reflects the full configuration on the device after the last deployment. These include the commands that were on the device previously, and the commands that Router MC wrote to the device to implement the policy definitions.
•
Note
Follow this procedure to view the configurations for a device within a deployment session.
Before you Begin
Make sure that you are working within the context of an open deployment. See Viewing Deployment Status Information (Workflow Disabled Mode) for more information.
Procedure
Step 1
Step 2
Note
Step 3
Managing Deployment in Workflow Enabled Mode
When workflow mode is enabled, the deployment of settings and policies to devices is always done within the context of a deployment job. When you create a job, you specify the devices or device groups to which you want to deploy configurations. Router MC translates the committed policy configurations for each device into command line interface (CLI) commands. These CLI commands can be previewed and deployed either directly to the devices in the network or to an output file (by a user with the authority to do so).
Devices Available For Inclusion in Jobs
When you create a job, you select the devices or device groups to include in the job. When a device is selected for a specific job, it cannot be selected for any other job until the original job has been deployed or rejected. In addition, if a device has been imported within the context of a specific activity and the activity has not yet been approved, the device will not be available for inclusion in jobs. This is because until the activity is approved, the device will not be committed to the Router MC database.
Router MC preselects devices on which policy changes have been made but have not been deployed, as a recommended minimum for the job.
See Selecting Devices for the Job for more information.
Devices Automatically Added to the Job by Router MC
In certain cases, Router MC must generate commands for devices that are affected by the policies defined on the devices selected for the job. Router MC automatically adds the relevant devices to the job and generates the necessary commands. For example, if you define a tunnel policy on a spoke, and you select the spoke for the job, Router MC will add the spoke's assigned hub to the job. During job generation, Router MC generates commands for both peers so that the VPN configuration will be complete and the tunnel can be established.
Deployment Options
You have the following deployment options:
•
•
Note
Preview of CLI Commands to be Deployed
Within the context of an open job, you can view the proposed CLI commands generated for the devices included in that job. These are the commands that will be deployed to the devices to implement the VPN or firewall policy definitions. You can view either the full proposed device configuration, meaning a combination of the device's current configuration and the commands added/removed by Router MC, or the incremental proposed configuration, meaning only the commands added by Router MC to implement the policy definitions.
See Viewing Device Configurations for more information.
The following topics provide information about managing deployment in Workflow Enabled mode:
•
•
Understanding Job Statuses
Jobs can have the following statuses:
•
•
•
•
•
•
•
•
Managing Jobs
The Jobs page is accessed by selecting Workflow > Job Management. It contains a list of existing jobs and their statuses. From this page, you can create new jobs, and perform various actions on existing jobs. See Table 1-3 for a description of the Jobs page.
The currently open job is displayed in the top right corner of pages in the Workflow tab. This enables you to see the job context within which you are working. If no job is open, the word None will be displayed.
The following topics provide information about managing jobs:
•
•
Table 1-3 describes each element in the Jobs page.
Table 1-3 Jobs—GUI Reference
# column
Sequentially numbers the jobs in the list.
Radio button column
Enables you to select a job and then perform the required action on the job, for example, open it, deploy it, and so forth.
Name column
Displays the name of the job. You can click on a job name to see details about the job, including the devices in the job and what stage they have reached relative to the job status. For example, if the job status is Deploying, you can see the devices for which deployment has been completed, pending devices, and failed devices. The Job Details page refreshes automatically every ten seconds.
Status Column
Displays the status of the job, for example, deploying, deployed, rejected, and so forth. See Understanding Job Statuses for information about job statuses.
Last Action Column
Displays the last action done on the job, for example, opened by user, deployed by user, and so forth.
Rows per page list box
Enables you to change the number of jobs displayed per page.
Create button
Click to create a new job.
Open button
Click to open the selected job.
Approve button
Click to approve the selected job. This button is only present if job approval is enabled in the System Settings under the Admin tab. If so, jobs must be approved before they can be deployed.
Deploy button
Click to deploy the generated CLI commands to the devices or files.
Redeploy button
Click to redeploy the job.
Roll Back button
Click to revert to the previous configuration on the devices in the job.
Reject button
Click to reject the selected job if you are not satisfied with the configurations generated for the devices.
Abort button
Click to stop the selected job during deployment.
Creating a Job
To deploy your policy configurations to your devices, you must first create a job. When creating a job, you specify the devices to which you want to deploy the configurations and whether you want to deploy directly to the devices or to an output file.
You create a job using the Job wizard. The following topics describe the tasks you must do to create a job using this wizard:
•
•
Accessing the Job Wizard
You can access the Job wizard from the Jobs page. To access the wizard, complete the steps in this procedure.
Procedure
Step 1
Step 2
The first page of the Job wizard appears. The steps in the wizard are listed in the TOC on the left side of the page.
Naming the Job
The Name and Description page of the Job wizard appears when you click the Create button in the Jobs page. It enables you to specify a name and description for the job. Each job must have a unique name.
After you have finished creating the job, it is listed by name in the Jobs page (see Table 1-3 for more information). Because the job name enables you to distinguish one job from another, you should assign a logical name and description that reflect the contents of the job.
Procedure
Step 1
Step 2
Table 1-4 describes each element in the Name and Description page of the Job wizard.
Selecting Devices for the Job
The Select Devices page of the Job wizard enables you to specify the devices for which you want to generate and deploy configurations. Configurations can be generated for committed policy definitions only.
The hierarchy of devices available for selection contains only devices that are not currently included in another job.
You can select individual devices for the job or you can select multiple devices simultaneously by selecting Global or a device group. If you select Global, all available devices will be selected for deployment (all devices that are not currently included in another job). If you select a device group, all available device groups and devices that are descendents of that device group in the device hierarchy will be selected for deployment. If you select a High Availability (HA) group, all the hubs in the group will be selected for deployment. Furthermore, if you select one hub in an HA group, all the other hubs in the group will be selected.
Note
Procedure
Step 1
Step 2
Table 1-5 describes each element in the Select Devices page of the Job wizard.
Selecting Deployment Options
The Deployment Options page of the Job wizard enables you to specify whether you want to deploy the generated configurations directly to the devices in the network or to files in an output directory. The main advantage of deploying configurations to a files is that you can create configurations for devices that are not yet in place in your network.
If you deploy to files, Router MC creates a configuration file for each device in the job, in the format DeviceName.cfg. You must specify the directory on the Router MC server in which you want Router MC to create the configuration files. You can specify whether the configuration files should contain the full configuration for the devices or the incremental configuration, meaning only the CLI commands added and removed as a result of the committed policy definitions. Configuration files are in TFTP format so that you can upload them to your devices using TFTP.
If you deploy to files, you are responsible for transferring the configurations to your devices. Router MC assumes that you have done this, so the next time you deploy to the same devices, the generated incremental commands are based on the configurations from the previous deployment.
Procedure
Step 1
Step 2
Step 3
Step 4
Table 1-6 describes each element in the Deployment Options page of the Job wizard.
Reviewing Generation Errors and Warnings
The Error Checking page of the Job wizard enables you to view errors and warnings pertaining to the proposed deployment of configurations to the devices in the job. See Table 1-7 for a description of the Error Checking page.
•
•
Procedure
Step 1
Step 2
Step 3
OR
If Summary does not appear in the TOC, click Finish to complete the job creation, or go back to a previous step in the wizard to change your definitions, as required.
If your application does not require approval of jobs, on clicking Finish, a message appears asking you if you want to deploy the job immediately. If you do, click Yes. Otherwise, you can deploy the job from the Jobs page. See Deploying a Job for more information.
Table 1-7 describes each element in the Error Checking page of the Job wizard.
Table 1-7 Error Checking—GUI Reference
Message Type column
Indicates the type of message, either error or warning. Errors are indicated by a red icon. Warnings are indicated by a yellow icon. If there are errors in the list, you cannot continue with the job creation process. See Reviewing Generation Errors and Warnings for more information.
Subject column
Indicates the module or policy type to which the error/warning message relates.
Device/Group column
Indicates the device or group to which the error/warning message relates.
Description column
Provides the reason the error or warning was generated.
Back button
Click to return to the previous page in the wizard.
Next button
Available only if Summary appears in the TOC. See Defining System Settings, page 1-1.
Click to go to the next page in the wizard. Note that if any errors are listed, you will not be able to complete the job creation process.
Finish button
Available only if Summary does not appear in the TOC. See Defining System Settings, page 1-1.
Click to exit the wizard and complete the job creation or modification process.
Cancel button
Click to exit the wizard without saving your settings.
Viewing a Summary of the Job
Note
The Summary page provides an overview of your job definitions for your verification. See Table 1-8 for a description of this page.
Procedure
Step 1
Step 2
If your application does not require approval of jobs, on clicking Finish, a message appears asking you if you want to deploy the job immediately. If you do, click Yes. Otherwise, you can deploy the job from the Jobs page. See Deploying a Job for more information.
Table 1-8 describes each element in the Job Summary page of the Job wizard.
Opening a Job
You must open a job to:
•
•
Procedure
Step 1
Step 2
Approving a Job
In some organizations, jobs must be approved by a user with the appropriate permissions before they can be deployed. By default, jobs do not have to be approved, however, this setting can be changed in the Application Settings page under the Admin tab.
If job approval is required, the approver can preview the proposed configurations for the devices in a job and then either approve or reject the job. See Viewing Device Configurations for information about viewing the CLI commands generated for the devices in the job. See Defining System Settings, page 1-1 for information about job approval settings.
Note
Procedure
Step 1
Step 2
Step 3
The job status changes to Approved.
Deploying a Job
When you deploy a job, you transfer the configurations generated for the devices in the job to the devices in the network directly or to files in a specified output directory (depending on which option you chose when creating the job). See Managing Deployment in Workflow Enabled Mode for more information about jobs.
When a job has been deployed, its devices become available for inclusion in other jobs.
You can deploy a job from the Jobs page, as described in the procedure below. When you deploy a job, the Job Deployment Status page appears, indicating the status of the devices in the job. See Viewing a Job's Deployment Status for more information.
Note
Procedure
Step 1
Step 2
Step 3
The Job Deployment Status page appears. The job status changes to Deploying. When the deployment is complete, the job status changes to Deployed.
Redeploying a Job
You can redeploy a job if necessary. For example, if the previous deployment failed, you could correct the problems that caused the deployment to fail and then redeploy the job. Another example is if you want to change the directory to which configurations are deployed. You can also use the redeploy option to resume an aborted job.
During redeployment, configurations are only written to devices for which the previous deployment failed.
You can redeploy a job from the Jobs page, as described in the procedure below.
Note
Procedure
Step 1
Step 2
Step 3
Step 4
Step 5
Rejecting a Job
You can reject a generated job if necessary and if you have the permissions to do so. For example, if you see problems in the proposed configurations generated for the devices in the job, you can reject the job so that those configurations never reach the devices. When you reject a job, the devices in the job immediately become available for inclusion in other jobs.
A rejected job cannot be deployed but it can be opened to view its generated configurations.
You can reject a job from the Jobs page, as described in the procedure below.
Procedure
Step 1
Step 2
Step 3
Reverting to the Previous Configuration (Rollback)
After deployment, you can revert to the devices' previous configuration, meaning the device configuration prior to deployment. This is known as rollback. You can choose whether to roll back the configuration on all the devices in the job or only on devices for which deployment failed. Rollback will only be implemented on devices that are not currently included in another job.
You can view the configuration that will be restored upon rollback. See Viewing Device Configurations for more information.
If a device has been included in multiple jobs, its previous configuration is the configuration prior to the deployment of the last job in which the device was included. When you perform rollback on a job, the devices' previous configuration becomes the current configuration, and the devices no longer have a previous configuration. Therefore, you can only perform successful rollback for a device once. If you roll back another job in which the same device was included, no current configurations will be available for that device when you select View Configs under the Workflow tab.
Note
You can do rollback from the Jobs page, as described in the procedure below.
Note
Procedure
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Aborting a Job
You can stop a job during deployment. If Router MC has not yet begun to write commands to a device in the job, the device's deployment status will become "Failed". If commands are currently being written to a device, the deployment will continue to completion. Aborting a job has no effect on devices in the job that have already been deployed.
To resume deployment, you can redeploy the job. See Redeploying a Job for more information.
Note
Procedure
Step 1
A dialog box appears requesting confirmation of the Abort operation.
Step 2
Viewing a Job's Deployment Status
Router MC enables you to view the deployment status of a job and of each device in the job relative to the job status. For example, if the job status is Deploying, you can see if the deployment process for each device is pending, in progress, failed, or completed. Likewise, if the job status is Generating, you can see the generation status of each device in the job. In addition, if a process on a device has failed, you can see the reason for the failure.
Procedure
Step 1
Step 2
Table 1-9 describes each element in the Job Deployment Status page.
Table 1-9 Job Deployment Status—GUI Reference
Job Name field
Displays the name of the open job.
Status field
Displays the status of the open job.
Last Action field
Displays the last action performed on the job and the date and time at which it was performed.
Description field
Displays the description provided when the job was created.
Deployment Details field
Displays the deployment options selected during job creation.
Last Output Directory field
Displays the directory currently specified as the target directory for deployment or redeployment or rollback.
Device Name column
Displays the name of each device in the job.
Device Group column
Displays the device group to which each device belongs.
Device Type column
Displays whether the device is a hub or a spoke.
Device Status column
Displays the status of the device relative to the job status. The status can be Pending, In Progress, Completed, or Failed. If the status is Failed, you can click on Failed in this column to display the reason(s) for the failure and to see the last commands that were deployed to the device.
Status Time column
Displays the time at which the current status of the device was recorded.
VPN Connection Status column
Indicates whether or not a hub-spoke VPN connection exists. The VPN connection status can be:
•
•
•
•
•
•
Note
Policy Change column
Indicates whether any policy changes were made on the device since the job was created and the configurations for the device were generated.
Refresh button
Click to refresh the page to see the latest device status.
Abort button
Click to stop the deployment. See Aborting a Job for more information.
Rows per page list box
Enables you to change the number of table rows displayed per page.
Viewing the Deployment Status of Devices
In the Reports tab, you can view a report listing all the devices in your inventory and their deployment status. See Viewing the Deployment Report, page 1-2 for more information.
Viewing Device Configurations
Router MC enables you to view the CLI commands that will be written to your devices (or to configuration files) to implement your VPN and firewall definitions. You can preview device configurations before you submit an activity or before deployment, or you can confirm the configurations after deployment.
When viewing configurations for devices within the context of an activity (in the Configuration tab), you will see commands for the policies in the activity, even if the activity has not been approved and the configurations have not been committed to the database. This enables you to preview the commands that will be generated and if necessary, to edit the policies in the activity. You will also see commands for previously committed policies.
When viewing configurations for devices within the context of a job (in the Workflow tab), you will see only commands generated for committed policies. You will not see configurations for policies in activities that have not been approved and whose configurations have not been committed to the database.
Within the context of an open activity or job, you have the following options for viewing a device's configurations:
•
The incremental view can also show the Router MC policies from which the generated CLI commands originated. You can choose whether to show this information by enabling or disabling an option in the System Settings under the Admin tab. See Defining System Settings, page 1-1 for more information.
•
•
If configurations have previously been deployed to the device, the current configuration reflects the full configuration on the device after the last deployment, including the commands that were on the device previously and the commands that Router MC wrote to the device to implement the policy definitions.
•
Note
Follow this procedure to view the configurations for a device.
Before you Begin
Make sure that you are working within the context of an open activity or job.
Procedure
Step 1
Step 2
Note
Step 3
