Explore Cisco
How to Buy

Have an account?

  •   Personalized content
  •   Your products and support

Need an account?

Create an account

Cisco DNA Center Administrator Guide, Release 1.3.1.0

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Book Contents
Find Matches in This Book
Available Languages
Download Options

Book Title

Cisco DNA Center Administrator Guide, Release 1.3.1.0

Chapter Title

Manage Users

Results

Updated:
March 17, 2021

Chapter: Manage Users

Manage Users

About User Profiles

A user profile defines a user's login, password, and role (permissions).

You can configure both internal and external user profiles for any user. Internal user profiles reside in Cisco DNA Center and external user profiles reside on an external AAA server.

One default user profile with SUPER-ADMIN-ROLE permissions is created when you install Cisco DNA Center.

About User Roles

Users are assigned user roles that specify the functions that they are permitted to perform:

  • Administrator (SUPER-ADMIN-ROLE)—Users with this role have full access to all of the Cisco DNA Center functions. They can create other user profiles with various roles, including those with the SUPER-ADMIN-ROLE.

    Although administrators cannot directly change another user's password in the user interface, they can delete and recreate a user with new password.


    Note

    For security reasons, passwords are not displayed to any user, not even those with administrator privileges.

  • Network Administrator (NETWORK-ADMIN-ROLE)—Users with this role have full access to all of the network-related Cisco DNA Center functions. They do not have access to system-related functions, such as backup and restore.

  • Observer (OBSERVER-ROLE)—Users with this role have view-only access to the Cisco DNA Center functions. Users with an observer role cannot access any functions that configure or control Cisco DNA Center or the devices it manages.


Note

A fourth default role, called TELEMETRY-ADMIN-ROLE, also exists, but this role is not accessible from the user interface and is only used for system-level functions within Cisco DNA Center.

Create Local Users

You can create a user and assign it one of the following user roles: SUPER-ADMIN-ROLE, NETWORK-ADMIN-ROLE, or OBSERVER-ROLE. For more information, see About User Roles.

Before you begin

Only a user with SUPER-ADMIN-ROLE permissions can perform this procedure. For more information, see About User Roles.

Procedure

Step 1

From the Cisco DNA Center home page, click > System Settings > Users > User Management.

Step 2

Click .

Step 3

Enter a username for the new user.

Step 4

From the Role drop-down list, choose one of the following roles: SUPER-ADMIN-ROLE, NETWORK-ADMIN-ROLE, or OBSERVER-ROLE.

Note 

Although the TELEMETRY-ADMIN-ROLE appears as an option, it is not available for use, so you cannot choose this role.

Step 5

Enter a password and confirm it.
Step 6

Click Save.

Edit Local Users

You can change only the user role. The username or password cannot be changed.

Before you begin

Only a user with SUPER-ADMIN-ROLE permissions can perform this procedure. For more information, see About User Roles.

Procedure

Step 1

Click > System Settings > Users > User Management.

Step 2

Click the radio button next to the user that you want to modify.
Step 3

Click Edit.

Step 4

From the Role drop-down list, choose a new role: SUPER-ADMIN-ROLE, NETWORK-ADMIN-ROLE, or OBSERVER-ROLE.

Step 5

Click Save.

Delete Local Users

Only an administrator with SUPER-ADMIN-ROLE permissions may delete a user.

Before you begin

Only a user with SUPER-ADMIN-ROLE permissions can perform this procedure. For more information, see About User Roles.

Procedure

Step 1

From the Cisco DNA Center home page, click > System Settings > Users > User Management.

Step 2

Select the radio button next to the user that you want to delete.
Step 3

Click Delete.

Step 4

Click OK.

Change Your Own User Password

Only you can change the password that you enter to log in to Cisco DNA Center. Even a user with administrator privileges cannot change another user's password. If an administrator needs to change another user's password, they need to delete and readd the user with a new password.

Procedure

Step 1

From the Cisco DNA Center home page, click > System Settings > Users.

Step 2

Click Change Password.

Step 3

Enter information in the required fields and click Update.

Reset a Forgotten Password

If you forgot your password, you can reset it through the CLI.

Procedure

Step 1

Enter the following command to check if the user is created in the system.

magctl user display <username>

The command returns the tenant-name, which can be used to reset the password. The output looks similar to the following:

User admin present in tenant TNT0 (where TNT0 is the tenant-name)
Step 2

Enter the tenant-name in the following command to reset the password.

magctl user password update <username> <tenant-name>

You are prompted to enter a new password.
Step 3

Enter a new password.

You are prompted to re-enter the new password to confirm.
Step 4

Enter the new password. The password is reset and you can log in to Cisco DNA Center using the new password.

Display Role-Based Access Control Statistics

You can display statistics that show how many users of each user role exist. You can also drill down to view a list of users who have the selected role.

Procedure

Step 1

From the Cisco DNA Center home page, click > System Settings > Users > Role Based Access Control.

Step 2

Click See details to display a list of users with the selected role.

Two-Factor Authentication

Two-factor authentication, also known as 2FA, adds another layer of security to user verification by using an identifier method in addition to a user's name and password. The identifier method is generally something that only the actual intended user possesses (such as a phone app or keyfob) and is intentionally separated from the original login method.

The Cisco DNA Center implementation of two-factor authentication supports the use of a token client (that generates single-use token codes after the appropriate PIN is entered), a token server (that validates token codes), and an authentication server to manage user access. Authentication can be handled using either the RADIUS or TACACS+ protocol.

The topics in this section describe:

  • The requirements that need to be in place in order to implement two-factor authentication.

  • The necessary configuration settings you need to make.

  • The Cisco DNA Center login procedure using two-factor authentication.

Prerequisites for Two-Factor Authentication

The following prerequisites must be in place in order to set up two-factor authentication for use with Cisco DNA Center:

  • Cisco DNA Center 1.2.8 or later

  • An authentication server that is able to return attribute-value pairs to convey RBAC role authorizations for authenticated Cisco DNA Center users. In our example, we use Cisco Identity Services Engine (Cisco ISE) 2.3 Patch 1.

  • A two-factor token server that you will integrate with your authentication server. In our example, we use RSA Authentication Manager 7.2.

  • A token card application on the client’s machine that generates software tokens. In our example, we use RSA SecurID Software Token.

Two-Factor Authentication Workflow

Here is a summary of what happens when a user logs in to a Cisco DNA Center appliance on which two-factor authentication has been configured:

  1. In an RSA SecurID token client, a user enters their PIN to get a token code.

  2. In the Cisco DNA Center login page, they enter their username and token code.

  3. Cisco DNA Center sends the login request to Cisco ISE using either the RADIUS or TACACS+ protocol.

  4. Cisco ISE sends the request to the RSA Authentication Manager server.

  5. RSA Authentication Manager validates the token code and informs Cisco ISE that the user has been authenticated successfully.

  6. Cisco ISE matches the authenticated user with their configured authorization profile and returns the role=NETWORK-ADMIN-ROLE attribute-value pair.

  7. Cisco DNA Center grants access to the features and pages associated with the user's role-based access control (RBAC) role.

Configure Two-Factor Authentication

To configure two-factor authentication on your Cisco DNA Center appliance, complete the following procedure.

Procedure

Step 1

Integrate RSA Authentication Manager with Cisco ISE:

  1. In RSA Authentication Manager, create two users: cdnac_admin (for the Admin user role) and cdnac_observer (for the Observer role).

    For more information, see the "Add a User to the Internal Database" topic in the RSA Self-Service Console Help. To access this topic, do the following:

    1. Open the RSA Self-Service Console Help.

    2. In the Search help field, enter Add a User to the Internal Database and then click Search help.

  2. Create a new authentication agent.

    For more information, see the "Add an Authentication Agent" topic in the RSA Self-Service Console Help.

  3. Generate the Authentication Manager agent configuration file (sdconf.rec):

    1. From the RSA Security Console, choose Access > Authentication Agents > Generate Configuration File.

      The Configure Agent Timeout and Retries tab opens.

    2. For the Maximum Retries and Maximum Time Between Each Retry fields, use the default values.

    3. Click Generate Configuration File.

      The Download Configuration File tab opens.

    4. Click the Download Now link.

    5. When prompted, click Save to Disk to save a local copy of the zip file.

    6. Unzip the file and use this version of the sdconf.rec file to overwrite the version that is currently installed on the agent.

  4. Generate a PIN for the cdnac_admin and cdnac_observer users you created in Step 1a.

    For more information, see the "Create My On-Demand Authentication PIN" topic in the RSA Self-Service Console Help.

  5. Start Cisco ISE, choose Administration > Identity Management > External Identity Sources > RSA SecurID, and then click Add.

  6. In the RSA SecurID Identity Sources page, click Browse, choose the sdconf.rec file you downloaded, and then click Open.

  7. Check the Reauthenticate on Change PIN check box, then click Submit.

Step 2

Create two authorization profiles, one for the Admin user role and one for the Observer user role.

  1. In Cisco ISE, choose Policy > Policy Elements > Results > Authorization > Authorization Profiles.

  2. For both profiles, enter the following information:

    • Name field: Enter the profile's name.

    • Access Type field: Choose ACCESS_ACCEPT.

    • Advanced Attributes Settings area: Choose Cisco:cisco-av-pair from the first drop-down list.

      If you are creating an authorization profile for the Admin user role, choose Role=NETWORK-ADMIN-ROLE from the second drop-down list.

      If you are creating an authorization profile for the Observer user role, choose Role=OBSERVER-ROLE from the second drop-down list.

Step 3

Create an authentication policy for your Cisco DNA Center appliance.

In the Cisco Identity Services Engine Administrator Guide, Release 2.3, see the "Configure Authentication Policies" topic.

Step 4

Create two authorization policies, one for the Admin user role and one for the Observer user role.

In the Cisco Identity Services Engine Administrator Guide, Release 2.3, see the "Configure Authorization Policies" topic.

Step 5

In the RSA Authentication Manager Security Console, verify that software tokens have been assigned to both users.

For more information, see the "View a Token" topic in the RSA Self-Service Console Help.

Note 

If you need to assign tokens, complete the steps described in the "Assign a Software Token to a User" topic.

Enable Two-Factor Authentication Using RADIUS

To enable two-factor authentication that uses a Cisco ISE server configured for RADIUS, complete the following procedure:

Procedure
Step 1

Integrate Cisco ISE with Cisco DNA Center.

In the Cisco DNA Center installation guide, see the "Integrate Cisco ISE with Cisco DNA Center" topic.

Step 2

Configure Cisco DNA Center to use your Cisco ISE server for authentication.

See Configure External Authentication.

Important 

Ensure that you specify the same shared secret for both Cisco ISE and Cisco DNA Center.

Enable Two-Factor Authentication Using TACACS+

To enable two-factor authentication that uses a Cisco ISE server configured for TACACS+, complete the following procedure:

Procedure
Step 1

In Cisco ISE, choose Administration > Network Resources > Network Devices to open the Network Devices window.

Step 2

Click TACACS Authentication Settings to view its contents and ensure that a shared secret has already been configured for the Cisco DNA Center device you added previously.

Step 3

Choose Work Centers > Device Administration > Policy Elements to open the TACACS Profiles window.

Step 4

Create TACACS+ profiles for the cdnac_admin and cdnac_observer user roles:

  1. Click Add.

  2. Complete the following tasks:

    • Enter the profile's name.

    • After clicking the Raw View tab, enter the following text into the Profile Attributes text box:

      • For the cdnac_admin user role, enter Cisco-AVPair=ROLE=NETWORK-ADMIN-ROLE

      • For the cdnac_observer user role, enter Cisco-AVPair=ROLE=OBSERVER-ROLE

  3. Click Save.

Step 5

Integrate Cisco ISE with Cisco DNA Center.

In the Cisco DNA Center installation guide, see the "Integrate Cisco ISE with Cisco DNA Center" topic.

Step 6

Configure Cisco DNA Center to use your Cisco ISE server for authentication.

See Configure External Authentication.

Important 

Ensure that you specify the same shared secret for both Cisco ISE and Cisco DNA Center.

Configure External Authentication

If you are using an external server for authentication and authorization of external users, you must enable external authentication in Cisco DNA Center.

Before you begin

  • Only a user with SUPER-ADMIN-ROLE permissions can perform this procedure. For more information, see About User Roles.

  • You must configure at least one authentication server.

Procedure
Step 1

From the Cisco DNA Center home page, click > System Settings > Users > External Authentication.

Step 2

To enable external authentication on Cisco DNA Center, check the Enable External User check box.

Step 3

(Optional) Configure the AAA attribute.

For most cases, the default AAA attribute setting (Cisco-AVPair) is sufficient, as long as you have set the Cisco DNA Center user profile on the AAA server with Cisco-AVPair as the AAA attribute. You only need to change the default setting in Cisco DNA Center if you have a different value set in the Cisco DNA Center user profile on the AAA server. For example, you might manually define the AAA attribute as Cisco-AVPair=Role=SUPER-ADMIN-ROLE.

  1. In the AAA Attribute field, leave the default value of Cisco-AVPair or enter the new AAA attribute value.

  2. Click Update.

Step 4

(Optional) Configure the AAA servers.

Configure these settings only if you want to swap the current primary and secondary AAA servers or define different AAA servers. To view the AAA servers that are available to Cisco DNA Center, choose System Settings > Settings > Authentication and Policy Servers to open the Authentication and Policy Servers window.

  1. From the Primary AAA Server IP Address drop-down list, choose an IP address of one of the preconfigured AAA servers.

  2. From the Secondary AAA Server IP Address drop-down list, choose an IP address of one of the preconfigured AAA servers.

  3. (Optional) If you are using a Cisco ISE server, you can update the settings, if necessary.

    For information about Cisco ISE policies, see "Configure and Manage Policies" in the Cisco Identity Services Engine Administrator Guide.

    Table 1. Cisco ISE Server Settings

    Name

    Description

    Shared Secret

    Key for device authentications. The shared secret can be up to 128 characters in length.

    Username

    Name that is used to log in to the Cisco ISE CLI.

    Password

    Password for the Cisco ISE CLI username.

    FQDN

    Fully qualified domain name (FQDN) of the Cisco ISE server. The FQDN consists of two parts, a hostname and the domain name, in the following format:

    hostname.domainname.com

    For example, the FQDN for a Cisco ISE server might be ise.cisco.com.

    Subscriber Name

    A unique text string—for example, acme—that is used during Cisco DNA Center-to-Cisco ISE integration to set up a new pxGrid client in Cisco ISE.

    SSH Key

    Diffie-Hellman-Group14-SHA1 SSH key used to connect and authenticate with Cisco ISE.

    Virtual IP Address(es)

    Virtual IP address of the load balancer behind which the Cisco ISE policy service nodes (PSNs) are located. If you have multiple PSN farms behind different load balancers, you can enter a maximum of six virtual IP addresses.

  4. (Optional) To update advanced settings, click View Advanced Settings and update the settings, if necessary.

    Table 2. AAA Server Advanced Settings

    Name

    Description

    Protocol

    TACACS or RADIUS.

    Authentication Port

    Port used to relay authentication messages to the AAA server.

    • For RADIUS, the default is UDP port 1812.

    • For TACACS, the port is 49 and cannot be changed.

    Accounting Port

    Port used to relay important events to the AAA server. The information in these events is used for security and billing purposes.

    • For RADIUS, the default UDP port is 1813.

    • For TACACS, the port is 49 and cannot be changed.

    Retries

    Number of times that Cisco DNA Center attempts to connect with Cisco ISE before abandoning the attempt to connect. The default number of attempts is 1.

    Timeout

    Length of time that Cisco DNA Center waits for Cisco ISE to respond before abandoning the attempt to connect.

  5. Click Update.

Log In Using Two-Factor Authentication

To log in to Cisco DNA Center using two-factor authentication, complete the following procedure:

Procedure

Step 1

From the Cisco DNA Center login page, enter the appropriate username.

Step 2

Open the RSA SecurID token client and enter the PIN you configured previously to generate a one-time token.
Step 3

Copy this token and paste it in to the Cisco DNA Center login page's Password field.

Step 4

Click Log In.

Display External Users

You can view a list of external users who have logged in through Radius/TACACS for the first time. The information that is displayed includes their user names and roles.

Procedure

Step 1

From the Cisco DNA Center home page, click > System Settings > Users > External Authentication.

Step 2

Scroll to the bottom of the window. The External Users area lists the external users.

Was this Document Helpful?

FeedbackFeedback

Contact Cisco