You can install Cisco EPN Manager 7.0 on a virtual machine (VM):

• OVA/VMWare VM installation—For a VM installation, install the Open Virtual Appliance (OVA) file on a dedicated server that complies with the requirements listed in OVA/VM Requirements. We recommend that you run only one Cisco EPN Manager VM instance per server hardware.

Note

For Cisco EPN Manager 7.0 installation on any server that is installed in UEFI (EFI) mode rather than Legacy BIOS mode, please ensure you follow the mandatory steps given below: In CEPNM admin CLI, switch to shell: $ shell. Switch to root: $ sudo -i. Extract the zip file, which contains official RH rpms: $ mkdir rpms; cd rpms. Unzip the grub2_packages.zip file. Install the files using: $ rpm -Uvh *.rpm –force.

Note	To install Cisco EPN Manager on non-Cisco hardware, use VMware and install the OVA file. Using VMware will minimize hardware non-compliance issues, however, you must make sure that your hardware has the resources required to allow provisioning of the VM.

OVA installation includes the following:

• Red-Hat Enterprise Linux 7.9 operating system

• Oracle Database 19c Enterprise Edition Release 19.13.0.0.0

• EPN Manager

Note	Cisco EPN Manager does not support independent user-installed Linux/Oracle patches. Any necessary patches are included in Cisco EPN Manager releases or point patches.

You can upgrade to Cisco EPN Manager 7.0 by following the valid upgrade path relevant for your existing deployment. See Valid Upgrade Paths.

The following methods are available for upgrading to Cisco EPN Manager 7.0:

• Backup-Restore Upgrade—This upgrade option generally requires new hardware (although it is possible to use existing hardware). There is less downtime when performing this type of upgrade as the current version of Cisco EPN Manager remains operational while you install the new version on the new hardware. However, after the installation, you must restore your data from a backup. After starting the restore process, there will be a period during which some data will not be available on the new server until all the data has been copied over. For more information, see Backup-Restore Upgrade.

Note	Cisco EPN Manager does not support automatic rollback to the previous version after an upgrade but you can manually revert to the previous version. See Revert to the Previous Version of Cisco EPN Manager for more information.

The following types of users are created during the installation process:

• Cisco EPN Manager CLI admin user—Used for advanced administrative operations such as stopping and restarting the application and creating remote backup repositories. Provides access to the CEPNM Admin CLI, a Cisco proprietary shell which provides secure and restricted access to the system (as compared with the Linux shell).
  The password for the CLI admin user is user-defined during installation but can be changed at a later stage by entering the following command:

  
  admin# change-password
  

• Linux CLI admin user—Used for Linux-level administration purposes. Provides access to the Linux CLI, a Linux shell which provides all Linux commands. The Linux shell should only be used by Cisco technical support representatives. Regular system administrators should not use the Linux shell. The Linux shell can only be reached through the Cisco EPN Manager admin shell and CLI. The Linux CLI admin user can get Linux root-level privileges, primarily for debugging product-related operational issues. The user can be named differently than admin during initial installation.
• Cisco EPN Manager web GUI root user—Required for first-time login to the web GUI, and for creating other user accounts. The root user password is user-defined at the time of installation.
• ftp-user—Used for internal operations like image distribution to device or other operations that access external servers using FTP. The password is randomly generated and is changed periodically. Users with Admin privileges can change the ftp user password but this user-defined password will expire after a few months. Use this command to change the ftp user password:

  
  admin# ncs password ftpuser username password password
  

• scpuser—Used for internal operations like image distribution to device or other operations that access external servers using SCP. The password is randomly generated and is changed periodically.
• prime—The system-generated account under which all the application processes run. No changes can be made.
• oracle—The system-generated account used by the Oracle process. No changes can be made.

Note	The first four user accounts are associated with actual network users. Cisco EPN Manager uses the scpuser, prime, and oracle user accounts to perform internal operations and they cannot be changed in any way.

For more information about user types and managing users, see the Cisco Evolved Programmable Network Manager User and Administrator Guide.

The following are the client and browser requirements for the Cisco EPN Manager Web GUI:

• Hardware—Mac or Windows laptop or desktop compatible with one of the tested and supported browsers listed below.

• Browsers:

  Note	You can have upto three Cisco EPN Manager tabs open simultaneously in a single browser session.

  • Google Chrome versions 70 onwards

  • Mozilla Firefox ESR version 78

  • Mozilla Firefox versions 70 onwards

• Recommended display resolution—1600x900 pixels or higher (minimum: 1366x768)

To improve loading time and reduce network bandwidth usage, Cisco EPN Manager caches static files (js, css) in the browser in the same version of Cisco EPN Manager (Firefox browser).

Note	Google Chrome ignores all caching directives and reloads page content because of known limitations regarding self-signed certificates.

Note	The installation process uses the server's eth0 and eth1 Ethernet ports. If you use a different port, the system might not work properly.

The following table lists the ports that Cisco EPN Manager uses to listen for connection requests from devices. For security hardening, this table also specifies whether it is safe to disable the port without any adverse effects to the product.

As a general policy, any ports that are not needed and are not secure should be disabled. You need to first know which ports are enabled, and then decide which of these ports can be safely disabled without disrupting the normal functioning of Cisco EPN Manager. You can do this by listing the ports that are open and comparing it with a list of ports that are safe to disable. The built-in firewall in Cisco EPN Manager does not expose some of the listening ports. To view a list of the ports used in your deployment, log in as a Cisco EPN Manager CLI admin user and run the show security-status command.

In addition to the built-in firewall, you can also deploy additional network firewalls to block other unused ports and their traffic.

The following table lists the destination ports on external devices that may be protected by a firewall. These ports are used by Cisco EPN Manager to connect to network devices. You must open the required ports to allow Cisco EPN Manager to connect to these devices.

The following figure illustrates the ports information listed in the previous tables. Use this illustration to decide on the appropriate firewall configuration (allowing correct incoming traffic) for your network infrastructure. To identify the class of traffic, refer to the Usage column in Table Listening Ports That Are Open Through Built-in Firewall . We recommend that you disable the ports that are used by services that are not supported in Cisco EPN Manager.

1. Make sure your deployment meets the requirements in System Requirements.

2. Make sure your deployment meets the prerequisites in Prerequisites for OVA/VM Installations. This includes verifying the OVA package.

3. Deploy the OVA from the VMware vSphere Client.

4. Set the System Time of the Deployed OVA

5. Start Cisco EPN Manager Setup Process.

In an HA environment:

• Remove High Availability

• Add the configuration needed for the additional NIC

• Perform High Availability registration between Primary and Secondary Servers

Enter these commands in the admin CLI.

storm-ha-194/admin# configure terminal 
Enter configuration commands, one per line. End with CNTL/Z.
storm-ha-194/admin(config)# interface GigabitEthernet 1
storm-ha-194/admin(config-GigabitEthernet)# ip address 172.23.222.32 255.255.255.0
Changing the hostname or IP may result in undesired side effects,
such as installed application(s) being restarted.
Are you sure you want to proceed? [y/n] y
storm-ha-194/admin(config-GigabitEthernet)# end

Note	This configuration should be applied on both the servers (primary and secondary).

storm-ha-194/admin# configure terminal 
Enter configuration commands, one per line. End with CNTL/Z.
storm-ha-194/admin(config)# ip route 172.0.0.0 255.0.0.0 gateway 172.23.222.32
storm-ha-194/admin(config)# end
storm-ha-194/admin# write memory

Static routes are not migrated as part of Backup restore process. We need to configure it manually after a restore. However, this setting can be retained in the upgraded [Backup Restore Upgrade] server.

In a HA environment:

• Failure of the first interfaces (used for heartbeat (the first interface)) will trigger a HA failover.

• Depending on the configuration, failure of additional NIC will trigger Failover. For more details, please see Enable Multi NIC Monitoring

storm-ha-194/admin# configure terminal 
Enter configuration commands, one per line. End with CNTL/Z.
storm-ha-194/admin(config)# interface gigabitEthernet 1
storm-ha-194/admin(config-GigabitEthernet)# no ip 172.23.222.32 255.255.255.0

Cisco EPN Manager allows you to add multiple interfaces that can be monitored. Upon registration the configuration of the monitored NICs will be copied into the secondary server and starting this point, the system will monitor the interfaces. If the primary server's monitored interfaces go down, the system will perform failover into the secondary server(only if all monitored interfaces are up and running on the secondary server). In case of failback to a new primary server, monitored NICs will be copied to the new primary server. If the primary server and the secondary server have different amount of enabled NICs, registration and failback to fresh primary operations will be prohibited (the system will notify with proper message).

To enable multiple NIC (monitoring) support:

• Log into the server as the Cisco EPN Manager CLI admin user.

• Enter the following command to add an interface:

   ncs ha monitor interface add <interface-name> 

  Note	To delete an interface, enter the following command: ncs ha monitor interface del <interface-name>

• (Optional) Verify the configuration by running the following command:

  show run