Have an account?

  •   Personalized content
  •   Your products and support

Need an account?

Create an account

Cisco Managed Service Accelerator (MSX) 3.10 Enterprise Access Service Pack User Guide

Book Contents
Find Matches in This Book
Available Languages
Download Options

Book Title

Cisco Managed Service Accelerator (MSX) 3.10 Enterprise Access Service Pack User Guide

Chapter Title

Setting up Cisco MSX Enterprise Access Services

Results

Updated:
April 8, 2021

Chapter: Setting up Cisco MSX Enterprise Access Services

Setting up Cisco MSX Enterprise Access Services

This chapter explains how to set up Cisco MSX Enterprise Access from MSX. This chapter has the following topics:

Generating Cisco DNA Center Certificate

This section explains how to generate a Cisco DNA Center certificate and upload that certificate into Cisco DNA Center.

To generate a certificate:

Procedure

Step 1

Get the MSX certificate ca.pem and its private key ca-key.pem trusted from one of these environments: SSI, NFVI, or AWS. 


/etc/ssl/vms-certs/ca.pem
/etc/ssl/vms-certs/ca-key.pem
Step 2

Get the certificate IP addresses. To get the IP addresses, SSH to the Maglev instance for your Cisco DNA Center. Note down the IP addresses in the cluster_vip section. You will use these IP addresses in the cert.config file shown in step 3. 


maglev cluster network display
 
 
 
 
Output:
cluster_network:
  cluster_dns: 169.254.20.10
  cluster_subnet: 10.60.8.0/21
  cluster_vip:
  - 192.171.0.12
  - 192.171.1.6
  - 172.23.214.35
  container_subnet: 10.60.1.0/21
  dns_servers:
  - 171.70.170.167
Step 3

Change the values of DNS.1 and commonName from the following configuration and save the configuration to a cert.config file. Add the IP addresses from the cluster_vip section as IP.X in the configuration file.

Note 

Pay close attention to the alt_names section, which must contain all IP addresses and DNS names that are used to access Cisco DNA Center, either by a web browser or by an automated process such as PnP or Cisco ISE. 

[ req ]
prompt = no
distinguished_name = dn
x509_extensions = v3_ca
req_extensions = v3_req
x509_extensions = usr_cert
[ dn ]
# The bare minimum is probably a commonName
countryName = CA
stateOrProvinceName = ON
localityName = Ottawa
organizationName = Cisco
organizationalUnitName = MSX
commonName = dnac-34.infra.ciscomsx.com
emailAddress = msx-inception-team@cisco.com
 
[ usr_cert ]
basicConstraints = CA:FALSE
nsCertType = server
keyUsage = nonRepudiation, digitalSignature, dataEncipherment, keyEncipherment
extendedKeyUsage = serverAuth, clientAuth
nsComment = "OpenSSL Generated Certificate"
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer
[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = keyEncipherment, digitalSignature, dataEncipherment, nonRepudiation
extendedKeyUsage = serverAuth
subjectAltName = @alt_names
[alt_names]
DNS.1 = dnac-34.infra.ciscomsx.com
IP.1 = 1.2.3.4
IP.2 = 172.23.214.35
IP.3 = 192.171.0.12
IP.4 = 192.171.1.6
Step 4

Change the value of DNS.1 from the following configuration and save the configuration to a ext.config file. 

[ v3_ca ]
basicConstraints = CA:FALSE
keyUsage = keyEncipherment, digitalSignature, dataEncipherment, nonRepudiation
extendedKeyUsage = serverAuth, clientAuth
subjectAltName = @alt_names
[alt_names]
DNS.1 = dnac-75.infra.ciscomsx.com
IP.1 = 1.2.3.4
IP.2 = 172.23.214.35
IP.3 = 192.171.0.12
IP.4 = 192.171.1.6
Step 5

Generate a private key.

openssl genrsa -out dnac-73-priv-key.pem 2048 -sha2
Step 6

Generate a certificate signing request.

openssl req -new -key dnac-73-priv-key.pem -out dnac-73.csr -config ./in/cert-73.config -sha256
Step 7

Generate the Cisco DNA Center certificate.

openssl x509 -req -days 365 -in dnac-73.csr -CA ./in/ca.pem -CAkey ./in/ca-key.pem -set_serial 01 -extensions v3_ca -extfile ./in/ext-73.config -out dnac-73.pem -sha256
Step 8

Create a chained certificate.

cp dnac-73.pem dnac-73-chain.pem
cat ./in/ca.pem >> dnac-73-chain.pem

Loading Certificate into Cisco DNA Center

To load certificate:

Procedure

Step 1

Log in to Cisco DNA Center.
Step 2

Choose System Settings > Settings > Certificate.

The Certificate window is displayed with the current certificate name.

Step 3

Click Replace Certificate.

Step 4

Choose the certificate type as PEM.

Step 5

Enter the keys in the corresponding fields.
Step 6

Click Upload/Activate.

Subscribing to Cisco MSX Enterprise Access Service

After you add a tenant, you can subscribe to Cisco MSX Enterprise Access service.

Before you subscribe, ensure the following:

  • Cisco DNA Center is reachable

  • IP network connectivity to the Enterprise is working

  • Credentials of Cisco DNA Center management account are valid

Procedure

Step 1

Log in to the Cisco MSX portal using your credentials. Use super administrator credentials if you are ordering for your tenant.
Step 2

From the left pane, click Tenants Dashboard and then click the tenant name in the Dashboard page.

Step 3

From the left pane, under Tenant Workspace, click Offer Catalog.

The Offer Catalog window appears with the available services.

Step 4

Click Enterprise Access.

Step 5

Click Subscribe and then click OK.

What to do next

You have now created a subscription for a tenant. The next step is to add a Controller (Cisco DNA Center) to the Cisco MSX platform.

Attaching Controllers to Cisco MSX

After you create a subscription, you can attach one or more Controllers (Cisco DNA Centers) to the Cisco MSX platform. You should have the following information ready before you attach a Controller:

  • Name of the Controller. The Controller name can be anything of your choice.

  • Host name (IP address)

  • Username and Password


Note

You can attach a Controller to the Cisco MSX platform even if the Controller is not reachable.

Procedure

Step 1

Log in to the Cisco MSX portal using your credentials.

Step 2

From the left pane, click Tenants Dashboard and then click the tenant name in the Dashboard page.

Step 3

Click Enterprise Access.

Step 4

If you are adding Controller for the first time, click Continue Setup. If you have already added a Controller, click on the plus icon to add another Controller.

A wizard appears with the instructions to attach the Controller.
Step 5

Click Next.

Step 6

Enter the Controller name, IP address, Username, and Password.
Step 7

Enter the physical location of the Controller.
Step 8

Click Next.

Controller is now attached to the MSX platform.
Step 9

Click View Controller to view the Controller you added.

Note 

You can continue to add Controllers, if you choose to.
If you are not able to attach a Controller, check the following:

  • Management credentials of the Controller

  • Hostname or IP address of the Controller

  • Your network connectivity

  • Validity of your certificates


Note

While on-boarding, if you are not able to connect to the Controller, you can do a force connect that will attach the Controller to Cisco MSX. You can troubleshoot the connectivity issues later.

Editing a Controller

To edit the Controller information:

Procedure

Step 1

Log in to the Cisco MSX portal using your credentials.
Step 2

From the left pane, click Tenants Dashboard and then click the tenant name in the Dashboard page.

Step 3

Click Enterprise Access.

Step 4

From the list, choose the Controller you want to edit.
Step 5

Click the Edit icon displayed at the top right corner of the screen.

The Controller information is displayed.
Step 6

Make the changes as required. Click Save Changes.

Step 7

Click OK.

Deleting a Controller

To delete a Controller from MSX:

Procedure

Step 1

Log in to the Cisco MSX portal using your credentials.
Step 2

From the left pane, click Tenants Dashboard and then click the tenant name in the Dashboard page.

Step 3

Click Enterprise Access.

Step 4

Choose a Controller from the list.

Step 5

Click the cross icon displayed at the top right corner of the screen.

You are prompted before deleting a Controller.
Step 6

Click Remove Controller.

Synchronising Cisco DNA Center Inventory

Cisco MSX retrieves the inventory information periodically from Cisco DNA Center. If a device exists in Cisco DNA Center and not in Cisco MSX, then the device will be added to Cisco MSX. If a device exists in Cisco MSX and not in Cisco DNA Center, then the device will be deleted from Cisco MSX. The synchronization happens within the time you configured. Sometimes, if you do not want to wait for the configured period for the inventory to refresh, you can force a refresh.

Procedure

Step 1

Log in to the Cisco MSX portal using your credentials.
Step 2

From the left pane, click Tenants Dashboard and then click the tenant name in the Dashboard page.

Step 3

Click Enterprise Access.

Step 4

Choose a Controller from the list.

Step 5

Click the Sync with Cisco DNA Center icon displayed at the top right corner of the screen.

A message displays 'Successfully refreshed Cisco DNA Center'.
Step 6

Click Okay.

Note 

When Cisco MSX completes a refresh, the result of the refresh appears in the event log. To view the event logs, from the left pane, click Event Logs.

Note 

You can also refresh the inventory from the page that shows all the Cisco DNA Center and sites. Go to the inventory page, click the Ellipsis (...) that is located on the far right of the row and choose Synchronize with Cisco DNA Center.

Viewing Enterprise Network Health

Enterprise Network Health shows the overall health status of the Enterprise Network. The Health Status displays the following information:

  • Overall Cisco DNA Center status based on reachability

    • Green: Cisco DNA Center is reachable

    • Red: Cisco DNA Center is not reachable

    • Gray: Cisco DNA Center is reachable but has no health data

  • Overall Health Summary

    • Percentage of healthy network devices

    • Percentage of healthy wireless clients

    • Percentage of healthy wired clients

  • Network Snapshot

    • Number of images

    • Network profiles

    • Cisco DNA Center licensed devices (Switches, Routers, and Access Points)

Procedure

Step 1

Log in to the Cisco MSX portal using your credentials.

Step 2

From the left pane, click Tenants Dashboard and then click the tenant name in the Dashboard page.

Step 3

Click Enterprise Access.

The summary of the Enterprise Network health appears on the screen. The black line shows the overall aggregate network health of the Enterprise for the last 24 hours. The gray line shows the overall aggregate network health of the Enterprise prior to the last 24 hours.

Step 4

Choose a Controller from the list.

The status of the Controller and the health of the Enterprise is displayed.

Deleting Cisco MSX Enterprise Access Subscription

To delete a Cisco MSX Enterprise Access subscription:

Procedure

Step 1

Log in to the Cisco MSX portal using your credentials.
Step 2

From the left pane, click Tenants Dashboard and then click the Tenant name in the Dashboard page.

Step 3

Click Enterprise Access.

Step 4

Click the delete icon.

You are prompted before deleting the subscription.
Step 5

Click Delete Subscription.

Launching Cisco DNA Center from Cisco MSX

To launch Cisco DNA Center from Cisco MSX:

Procedure

Step 1

Log in to the Cisco MSX portal using your credentials.
Step 2

From the left pane, click Tenants Dashboard and then click the tenant name in the Dashboard page.

Step 3

Click Enterprise Access.

The list of Controllers attached to a tenant is displayed.
Step 4

Choose a Controller from the list.

The summary of the network health is displayed.
Step 5

Go to the appropriate section and click the launch icon. For instance, to view the healthy Cisco DNA Center devices, click the Visit Cisco DNA Center Healthy Devices icon. The Cisco DNA Center opens up in a separate window.

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

Related Cisco Community Discussions

About Us
Contact Us
Work with Us