Cisco Prime Infrastructure 3.0 Administrator Guide

Before You Begin Setting Up Operations Center

Before setting up Operations Center:

• Verify that the DNS entry for the Prime Infrastructure server that will host the Operations Center matches the host name configured on that server. For example: Running the commands nslookup ipaddress and hostname on the Prime Infrastructure server that will host the Operations Center should yield the same output.
• Ensure that all users who will access network information using Operations Center have both NBI Read and NBI Write access privileges. You can do this by editing these users’ profiles to make them members of the “NBI Read” and “NBI Write” User Groups (see “Changing User Group Memberships ” in Related Topics).
• By default, the maximum SSO login sessions for one user is five in Operation Center. This is also applicable for instances. Hence, ensure that the number of Active SSO Sessions does not exceed five, else the managed instances will go to unreachable state.
• Ensure that Prime Infrastructure is upgraded from 2.2.X to 3.0 before upgrading the Operations Center. Inline upgrading is also available for Operations Center.

Related Topics

• Setting Up Operations Center
• Changing User Group Memberships

Activating Your Operations Center License

Operations Center does not have a separate installation procedure. After you have installed Prime Infrastructure, you enable Operations Center by activating an Operations Center license on that installed server instance. The number of Prime Infrastructure instances you can manage using Operations Center depends on the license you have purchased.

Operations Center requires a Cluster Base License File and Incremental License File. For details, see the Cisco Prime Infrastructure Ordering and Licensing Guide (in Related Topics).

Step 1 Select Administration > Licenses and Software Updates > Licenses . The Licenses Summary page displays.

Step 2 From the left-hand navigation menu, select Files > License Files . The License Files page displays.

Step 3 Click Add . The Add a License File dialog box displays.

Step 4 Click Choose File .

Step 5 Navigate to your license file, select it, and then click Open .

Step 6 Click OK . Your license should now be listed in the Licenses > License Files page.

Step 7 Log out of Prime Infrastructure and then log back in. The login page that appears should display “Cisco Prime Infrastructure Operations Center”, which indicates the license has been applied.

Related Topics

• Setting Up Operations Center
• Cisco Prime Infrastructure Ordering and Licensing Guide

Enabling SSO for Operations Center

Complete the following procedure as many times as needed to enable SSO:

1. First: On the Prime Infrastructure server that will host Operations Center. This server must act as the SSO server.

2. Then: On all the other Prime Infrastructure servers that the Operations Center will manage. These servers must act as the SSO clients.

For additional help, see the related topic, “Troubleshooting Operations Center SSO Issues”.

Please note that you can configure more than one SSO server for Prime Infrastructure. However, the first SSO server you configure will always act as the system SSO server until it fails. In that case, authentication will fall back to the second SSO server, and so on.

Step 1 Select Administration > Users > Users, Roles & AAA . The AAA Mode Settings page displays.

Step 2 In the AAA Mode field, select the Local radio button and then click Save .

Step 3 From the left-hand navigation menu, click SSO Servers to open the SSO Servers page.

Step 4 Choose Select a Command > Add SSO Server > Go . The Add SSO Servers page displays.

Step 5 Enter the following information:

• IP Address : Enter either the IP address of the server on which you activated your Operations Center license (i.e., Operations Center IP).

Note that you must be consistent in specifying either the IP address or the Domain Name across all of the Operations Center clients (that is, the managed instances of Prime Infrastructure) that you add to the SSO server. This is because the browser cookies that provide the Single Sign-On functionality are stored in the browser according to either the IP address or the Domain Name given here.

• DNS Name: DNS name of the server on which you activated the license. Enter the DNS name only when the forward and reverse DNS lookups are the same. Otherwise setup SSO with the Server IP Address.
• Port : The port used to log in to the SSO server. By default, port 443 is set. Do not change this value.
• Retries : The number of retries to attempt when logging into the SSO server. By default, this value is set to 1.
• Certificate Type : Select the type of SSL/TLS certificate that the SSO server uses. Select from either Self-Signed Certificate or Certificate Authority (CA) certificate type.

When you are finished, click Save . The server should now be listed on the Add SSO Servers page.

Step 6 From the left-hand navigation menu, select AAA Mode Settings to reopen the AAA Mode Settings page.

Step 7 Click the SSO radio button (if it is not already selected) and then click Save .

Step 8 After enabling SSO, log out of the instance of Prime Infrastructure on which you enabled SSO and then log back in.

On the login page for the Operations Center instance, you will see “Cisco Operations Center [SSO]”. After you log in, the product title displayed at the top of the page will be “Cisco Prime Infrastructure Operations Center”.

On the login page for each of the managed instances, you will see “Cisco Operations Center [SSO]”. After you log in, the product title will be “Cisco Prime Infrastructure”.

Related Topics

• Setting Up Operations Center
• Troubleshooting Operations Center SSO Issues

Troubleshooting Operations Center SSO Issues

As explained in “Enabling SSO for Operations Center”, you must enable single sign-on (SSO) such that the Operations Center server acts as the SSO server and the managed instances of Prime Infrastructure act as SSO clients. Here are some common SSO setup pitfalls and how you can avoid them:

• There are different ways to add the SSO server to the SSO client. Each requires a different level of DNS set up. If you are using:

– Self-signed setting: This requires both forward and reverse DNS lookup of the SSO server from the SSO client. This means that if you take the Fully Qualified Domain Name (FQDN) of the SSO server and resolve it using DNS, you can take the resulting IP address, do a reverse lookup, and get the original FQDN.

– CA-signed setting with IP addresses: Neither reverse nor forward DNS mappings are required.

– CA-signed setting with domain names: Only forward DNS mapping (domain name to IP address) is needed.

• If you are using the self-signed setting: Verify that the DNS entry for the Prime Infrastructure server that will host the Operations Center matches the host name configured on that server. To do this, run nslookup ip-address, replacing ip-address with the IP address of your Operations Center server. Then log in to the admin console of the Operations Center server and run the show running-config command. Ensure that the output of these two commands matches.
• If you are using the self-signed setting: Access the Operations Center server using a browser and check that Common Name (CN) of the certificate matches the FQDN of the Operations Center server. The steps to follow vary with the browser you are using. For example, using Chrome:

a. Click on the lock icon displayed at the far left in the browser’s URL box.

b. Select Certificate Information .

c. Expand the Details field to view the Common Name of the certificate. It must match the correct FQDN of the server. If the two do not match, the Prime Infrastructure administrator must regenerate the SSO certificate.

• When configuring SSO, leave the “Certificate Type” as “CA”. This will result in fewer checks to verify the certificate on the SSO client side
• Ensure that the SSO Server and clients are all added consistently. For example, use either the IP address or FQDN across all instances. Don’t mix and match these.

Once SSO is configured you can check to see if it is working as expected by logging in to Operations Center (the SSO server) and opening a new browser tab to access one of the Prime Infrastructure instances (an SSO client). SSO should automatically log you into the Prime Infrastructure instance automatically, without requiring you to re-authenticate.

If you are still having Operations Center SSO login and connection issues:

1. Download and examine related Prime Infrastructure logs and, where necessary, use enhanced logging to check for errors and timeouts (for details, see the related topics “Downloading and Emailing Error Logs” and “Changing Logging Options to Enhance Troubleshooting”). Be sure to look at the log files from both Operations Center (the SSO server) and the managed instances (SSO clients) of Prime Infrastructure. Log files of special interest to SSO and Operations Center are:

– xmpNbiFw.log

– xmpNbifwPerformance.log: Look at the response times for APIs dispatched from Operations Center to the managed instances.

– cas.log

– ncs-*.log

– XmpUserMgmtRbac.log

– usermgmt.log:

2. Adjust the values for cluster.timeout and cluster.connectionTimeout in the file /opt/CSCOlumos/conf/cluster.properties. These two properties have the following defaults:

– cluster.timeout=40000: This is the timeout (in milliseconds) for all the requests dispatched from Operations Center.

– cluster.connectionTimeout=5000: This is the timeout used when Operations Center tries to establish initial connections with the managed instances.

If there is a high latency between Operations Center and the managed instances having connection issues, increasing these timeout limits can help.

When you are finished changing these values, restart the Operations Center using the commands explained in “Restarting Prime Infrastructure” (see Related Topics).

Related Topics

• Enabling SSO for Operations Center
• Setting Up Operations Center
• Downloading and Emailing Error Logs
• Changing Logging Options to Enhance Troubleshooting
• Restarting Prime Infrastructure

Adding Prime Infrastructure Instances to Operations Center

Once you have configured SSO on Operations Center and the other Prime Infrastructure instances, you must add each of the Prime Infrastructure managed instances to Operations Center.

Prime Infrastructure 3.0 instances can be managed only in Prime Operations Center. Support for Prime Infrastructure 2.2.X (N-1 Version) instances will be provided in later releases.

Step 1 Log in to Prime Infrastructure Operations Center.

Step 2 Select Monitor > Manage and Monitor Servers .

Step 3 Click Add .

Step 4 Enter the IP address and port number of the instance of Prime Infrastructure that you want to manage using Operations Center. You may also enter an alias for the server. Then click OK .

By default, port 443 is set. Do not change this value.

Step 5 Repeat these steps to add other Prime Infrastructure servers, up to the license limit.

Related Topics

• Setting Up Operations Center

Disabling Idle User Timeouts for Operations Center

Be default, Prime Infrastructure automatically signs out all users whose sessions stay idle for too long. This feature is enabled by default to preserve network bandwidth and Prime Infrastructure processing cycles for active use.

This feature can be annoying for Operations Center users, who will typically have sessions opened not only with Operations Center, but with one or more of the instances of Prime Infrastructure that Operations Center is managing. Idleness in one of these sessions can force a global idle-user timeout for all the sessions, resulting in a sudden logout without warning.

To avoid this inconvenience, Prime Infrastructure administrators must:

1. Disable the global idle user timeout feature, as explained in “Changing the Global Idle Timeout” in Related Topics. Note that the administrator must disable this feature separately , on each of the Prime Infrastructure managed instances that Operations Center manages.

2. Instruct Operations Center users to disable the user-specific idle-user timeout feature for the Prime Infrastructure managed instances they access, as explained in “Changing Your Idle User Timeout” in Related Topics. Note that each Prime Infrastructure user must disable this feature separately , on each of the Prime Infrastructure managed instances they access.

Related Topics

• Setting Up Operations Center
• Changing the Global Idle Timeout
• Changing Your Idle User Timeout

Enabling AAA for Operations Center

Operation Center supports local authentication as well as remote AAA using TACACS+ and RADIUS servers. Using remote AAA is optional, but if you want to use it, you must first add a TACACS+ or RADIUS server to Operations Center. Follow this workflow:

1. On the Operations Center instance of Prime Infrastructure, add one or more TACACS+ or RADIUS servers to provide AAA services. For details, see “Adding TACACS+ Servers” or “Adding RADIUS Servers” in related topics. Remember that the shared secret configured on the TACACS+ or RADIUS server must match the shared secret you enter when adding this AAA server to Operations Center.

2. Set the AAA mode on the Operation Center instance, as explained in “Setting the AAA Mode”

Related Topics

• Setting Up Operations Center
• Adding TACACS+ Servers
• Adding RADIUS Servers
• Setting the AAA Mode

Operations Center Next Steps

When you have completed the setup tasks, you are ready to use Operations Center. See “Monitoring Multiple Prime Infrastructure Instances” for typical tasks you perform when using Operations Center.

Related Topics

• Monitoring Multiple Prime Infrastructure Instances
• Setting Up Operations Center

Configuring SNMP

To ensure that Prime Infrastructure can query SNMP devices and receive traps and notifications from them, you must:

• Set SNMP credentials (community strings) on each device you want to manage using Prime Infrastructure.
• Configure these same devices to send SNMP notifications to the Prime Infrastructure server.

Use the following Cisco IOS configuration commands to set read/write and read-only community strings on an SNMP device:

admin(config)# snmp-server community private RW

admin(config)# snmp-server community public RW

where private and public are the community strings you want to set.

After you set the community strings, you can specify that device notifications be sent as traps to the Prime Infrastructure server using the following Cisco IOS global configuration command on each SNMP device:

admin(config)# snmp-server host Host traps version community notification-type

where:

• Host i s the IP address of the Prime Infrastructure server.
• version is the version of SNMP that is used to send the traps.
• community is the community string sent to the server with the notification operation.
• notification-type is the type of trap to send.

You may need to control bandwidth usage and the amount of trap information being sent to the Prime Infrastructure server using additional commands.

For more information on configuring SNMP, see:

• The snmp-server community and snmp-server host commands in the Cisco IOS Network Management Command Reference .
• The “ Configuring SNMP Support ” section and the list of notification-type values in the Cisco IOS Configuration Fundamentals Configuration Guide, Release 12.2 .

If you are planning on implementing IPSec tunneling between your devices and the Prime Infrastructure server, be advised that you will not receive syslogs transmitted from those devices to the Prime Infrastructure server after implementing IPSec tunneling because IPSec does not support free-form syslogs. However, IPSec does support SNMP traps. To continue getting SNMP notifications of any kind from these devices, you need to configure your devices to send SNMP traps to the Prime Infrastructure server.

Configuring NTP

Network Time Protocol (NTP) must be properly synchronized on all devices in your network as well as on the Prime Infrastructure server. This includes all Prime Infrastructure-related servers: Any remote FTP servers that you use for Prime Infrastructure backups, secondary Prime Infrastructure high-availability servers, the Prime Infrastructure Plug and Play Gateway, VMware vCenter and the ESX virtual machine, and so on.

You specify the default and secondary NTP servers during Prime Infrastructure server installation. You can also use Prime Infrastructure’s ntp server command to add to or change the list of NTP servers after installation. For details, see the section Connecting Via CLI in this Guide and the section on the ntp server command in the Command Reference Guide for Cisco Prime Infrastructure . Note that Prime Infrastructure cannot be configured as an NTP server; it acts as an NTP client only.

Failure to manage NTP synchronization across your network can result in anomalous results in Prime Infrastructure. Management of network time accuracy is an extensive subject that involves the organization's network architecture, and is outside the scope of this Guide. For more information on this topic, see (for example) the Cisco White Paper Network Time Protocol: Best Practices .

Supported Assurance Data Sources

Prime Infrastructure with Assurance needs to collect data from your network devices using the exported data sources shown in Table 2-1 . For each source, the table shows the devices that support this form of export, and the minimum version of Cisco IOS or other software that must be running on the device to export the data.

Use Table 2-1 to verify that your network devices and their software are compatible with the type of data sources Prime Infrastructure uses. If needed, upgrade your hardware or software. Note that each software version given is a minimum . Your devices can run any later version of the same software or Cisco IOS release train.

You may also need to make changes to ensure that Prime Infrastructure can collect data using SNMP, as explained in Configuring SNMP .

Configuring Assurance Data Sources

Before installing Prime Infrastructure, you should enable the supported devices shown in Table 2-1 to provide Prime Infrastructure with fault, application, and performance data, and ensure that time and date information are consistent across your network. The following topics provide guidelines on how to do this.