Cisco Prime Infrastructure FIPS 3.2 Quick Start Guide
Available Languages
Table of Contents
Cisco Prime Infrastructure FIPS 3.2 Quick Start Guide
About Cisco Prime Infrastructure Licensing
Understanding System Requirements
Improving Performance on Appliances
Scaling for Service Provider Wi-Fi
Before You Begin Installation on a Virtual Machine
Installing Prime Infrastructure on a Virtual Machine
Setting Up Prime Infrastructure on a Virtual Machine or Physical Appliance
Features that are not supported by FIPS
Migrating Data From Previous Releases of Prime Infrastructure
Assurance Data after Migration
Resynchronizing WLC Configurations after Migration
Logging in to the Prime Infrastructure User Interface
Getting Started Using Prime Infrastructure
Ports Used by Prime Infrastructure and Assurance
Removing the Prime Infrastructure Virtual Appliance
Navigation and Documentation Reference
Obtaining Documentation and Submitting a Service Request
Overview
This section provides basic information about the product and this Guide.
About This Guide
This guide describes how to install Cisco Prime Infrastructure 3.2 FIPS as an OVA on VMware, Cisco Prime Infrastructure as an ISO on Hyper-V Virtual Machine.Prime Infrastructure is also available as a hardware appliance. For information on how to install the appliance, see the Cisco Prime Infrastructure 3.2 Appliance Hardware Installation Guide . This guide also describes about the Upgrade & Migration from the supported previous release Cisco Prime Infrastructure versions to Cisco Prime Infrastructure 3.2 FIPS.
For information about configuring and managing this product, see the Cisco Prime Infrastructure FIPS 3.2 Administrator Guide and the Cisco Prime Infrastructure FIPS 3.2 User Guide .
Product Overview
Prime Infrastructure provides a single integrated solution for comprehensive lifecycle management of the wired or wireless access, campus, and branch networks, and rich visibility into end-user connectivity and application performance assurance issues. Prime Infrastructure accelerates the rollout of new services, secure access and management of mobile devices, making “Bring Your Own Device” (BYOD) a reality for corporate IT. Tightly coupling client awareness with application performance visibility and network control, Prime Infrastructure helps ensure uncompromised end-user quality of experience. Deep integration with the Cisco Identity Services Engine (ISE) further extends this visibility across security and policy-related problems, presenting a complete view of client access issues with a clear path to solving them.
- An overview of Prime Infrastructure features and benefits, see the latest Cisco Prime Infrastructure Data Sheets .
- Information about frequently used Prime Infrastructure features, see the Cisco Prime Infrastructure FIPS 3.2 User Guide .
- Information about features intended for administrators, see the Cisco Prime Infrastructure FIPS 3.2 Administrator Guide.
About Cisco Prime Infrastructure Licensing
Prime Infrastructure licenses control the features that you can use and the number of devices you can manage using those features. For more information about:
- Cisco Prime Infrastructure license types and how to order them, see the Cisco Prime Infrastructure 3.2 Ordering and Licensing Guide .
- How to apply purchased licenses, see the Cisco Prime Infrastructure FIPS 3.2 Administrator Guide.
Before You Install
Complete the tasks in the following sections before installing Prime Infrastructure.
Understanding System Requirements
Prime Infrastructure comes in two main forms:
- Virtual : The Prime Infrastructure virtual appliance is packaged as an Open Virtualization Archive (OVA) file, which must be installed on a user-supplied, qualified server running VMware ESXi. This form allows you to run on the server hardware of your choice. You can also install the virtual appliance in any of four configurations, each optimized for a different size of enterprise network. For hardware requirements and capacities for each of the virtual appliance’s size options, see Virtual Appliance Options .
- Hyper V : Cisco Prime Infrastructure for Microsoft Hyper-V extends Cisco networking benefits to Microsoft Windows Server Hyper-V deployments. For deploying Cisco Prime Infrastructure on Hyper-V Virtual appliance, see the Cisco Prime Infrastructure 3.2 Installation and Migration Guide for Microsoft Hyper-V .
- Physical : The physical appliance is packaged as a rack-mountable server, with Prime Infrastructure pre-installed and configured for you. For physical appliance hardware specifications and capacities, see Physical Appliance Options.
Virtual Appliance Options
During installation, you can choose one of four deployment configuration options. Table 1 summarizes the minimum server requirements for each option.
You can install any of the Prime Infrastructure options as an Open Virtual Appliance (OVA), running under VMWare ESXi, on your own hardware. If you choose this implementation, the server that you supply must meet or exceed the requirements shown in the table for the option that you select.
Physical Appliance Options
Prime Infrastructure is available on the Cisco Unified Computing System (UCS) Appliance. Prime Infrastructure 3.2 FIPS is not supported on the PRIME-NCS-APL-K9 (also known as “Gen 1”). Prime Infrastructure 3.2 FIPS is supported on Cisco Prime Infrastructure Appliance (Gen 2, UCS based). The physical appliance specifications are as follows:
Prime Infrastructure is also available pre-installed on Cisco-supplied hardware as a physical appliance. See the Cisco Prime Infrastructure 3.2 Appliance Hardware Installation Guide for more information.
For maximum management capacities for each installation option, see Scaling Prime Infrastructure.
Improving Performance on Appliances
For better performance on the Prime Infrastructure Appliance (Gen 2, UCS based), make sure you configure the virtual drive Write Policy to Write Back Good BBU. To configure the virtual drive Write Policy, follow these steps:
Step 1 Launch the CIMC web interface (see Setting Up the Appliance in the Cisco Prime Infrastructure Appliance Hardware Installation Guide ).
Step 2 Click the Storage tab, click on the SAS Modular Controller name, click the Virtual Drive tab, then click Edit Virtual Drive .
Step 3 Click OK on the dialog box that appears.
Step 4 In the Write Policy field, select Write Back Good BBU , then click Save Changes .
If you are running ESX on custom hardware that has a RAID controller, we recommend you configure the following RAID settings to optimize Prime Infrastructure performance and redundancy:
Web Client Requirements
Prime Infrastructure users access the product using a web browser client. Web client requirements are:
- Hardware—A Mac or Windows laptop or desktop compatible with one of the following tested and supported browsers:
– Microsoft Internet Explorer 11 (No plug-ins are required.)
FIPS Mode Installation
Prime Infrastructure 3.2 offers a direct installation in FIPS mode. This option is intended for customers who require the products they use to be compliant with FIPS-140-2 standards.
Federal Information Processing Standards (FIPS) are United States government computer security standards. The FIPS-140-2 series specify requirements for cryptography modules. For a more complete description, see http://www.nist.gov/itl/fips.cfm .
To verify whether the Prime Infrastructure system is operating in FIPS mode, use the system CLI command show security-status. For more information, see Check On Server Security Status in the Cisco Prime Infrastructure FIPS 3.2 Administrator Guide .
When deciding whether to install in FIPS Mode, be aware that:
- Installing Prime Infrastructure in FIPS Mode disables use of certain capabilities in order to comply with the cryptographic security requirements of FIPS-140-2. For more details, see the Best Practices: Server Security Hardening in the Cisco Prime Infrastructure FIPS 3.2 Administrator Guide .
- Both Wireless and Wired management solution functionality in Prime Infrastructure is certified for FIPS compliance.
- Refer section “ Features that are not supported by FIPS ” for unsupported functionalities in FIPS release.
- In FIPS mode, you cannot enable root shell, and access to the root shell CLI is restricted.
- You cannot restore Prime Infrastructure 3.2 FIPS backup to 3.2 or 3.3 release version. You can restore 3.2 FIPS backup only on Prime Infrastructure 3.2 FIPS server.
Scaling Prime Infrastructure
Prime Infrastructure comes with a variety of server installation options (see Understanding System Requirements ). Ensure that you select an option appropriate for the size and complexity of your network.
Table 2 lists the maximum number of devices, clients, events, NetFlow-related data flows, and other scale parameters for each option. For example, the Professional option can manage 200,000 wireless clients and 50,000 wired clients.
Table 2 Supported Scale for Prime Infrastructure Installation Options (includes Assurance)
Changing Clients (every 5 minutes)3
NetFlow Rate (flows per second)4
Groups: User-Defined + Out of the Box + Device Groups + Port Groups
Note The supported number of FIPS/IPSEC capable device count is 2500.
Scaling for Service Provider Wi-Fi
Table 3 lists the Service Provider Wi-Fi parameters.
Installation Options
Prime Infrastructure provides the following installation options:
- New installation on a virtual machine—See Before You Begin Installation on a Virtual Machine .
- New installation on a physical appliance. Prime Infrastructure comes preinstalled on physical appliances, or you can install an image on an existing appliance. See Setting Up Prime Infrastructure on a Virtual Machine or Physical Appliance .
- Upgrade a previous version of Prime Infrastructure—See .
Before You Begin Installation on a Virtual Machine
Before installing Prime Infrastructure on a virtual machine, you must:
- Ensure that VMware ESXi is installed and configured on the machine that you plan to use as the Prime Infrastructure server. See the VMware documentation for information on setting up and configuring a VMware host. If you are using VMware ESX 5.5, you must use vSphere Client or ESX5.5U2 (or later) Client to manage the virtual machine. Do not edit the virtual machine settings and do not extend or manually add additional disks to the configuration.
- Check that the installed VMware ESXi host is reachable. See the VMware documentation on how to install the VMware vSphere Client. After the virtual host is available on the network, you can browse to its IP address to display a web-based interface from which you can install the VMware vSphere Client.
- Ensure that the Prime Infrastructure OVA is saved to the same machine where your VMware vSphere Client is installed. Depending on your arrangement with Cisco, you may download the OVA file from Cisco.com or use your Cisco-supplied installation media.
Installing Prime Infrastructure on a Virtual Machine
The following steps explain how to install Prime Infrastructure on a virtual machine. Make sure that all of the system requirements are met before you deploy the OVA. Review the sections Understanding System Requirements and Before You Begin Installation on a Virtual Machine .
Step 1 Launch your VMware vSphere Client and connect to the ESXi host or vCenter server.
Step 2 Choose File > Deploy OVF Template .
Step 3 Click Browse to access the location where you have saved the OVA file on your local machine, then click Next .
Step 4 Verify the details on the OVF template details page, then click Next .
Step 5 In the End User License Agreement window, click Accept , then click Next .
Step 6 In the Name and Location window, specify:
Step 8 In the Deployment Configuration window, select the desired configuration (for example, Express, Standard, Professional, etc.) and view the resources required for the configuration you selected.
Note We recommend you reserve 100% of CPU and memory resources for optimal performance.
Step 10 In the Host/Cluster window, select the host or cluster on which you want to deploy the OVF template, then click Next . (If the vSphere Client is connected directly to an ESXi host, this option does not appear.)
Step 11 In the Storage window, select the datastore that has the required space requirements described in Understanding System Requirements , then click Next .
Step 12 In the Disk Format window, select Thick Provision Lazy Zeroed to provision the virtual machine virtual disks, then click Next . Do not select Thin Provision because if there is no free disk space when the virtual machine needs it, Prime Infrastructure will fail.
Step 13 In the Network Mapping window, select a network for the virtual machine to use, then click Next .
Step 14 In the Ready to Complete window, review your settings, select Power on After Deployment , then click Finish.
Depending on your network speed and the IOPS of the server, the deployment can take a few minutes to complete.
Setting Up Prime Infrastructure on a Virtual Machine or Physical Appliance
Prime Infrastructure comes preinstalled on physical appliances, or you can install an image on an existing appliance. Complete the following steps to set up and start Prime Infrastructure on a virtual machine or physical appliance.
Step 1 If you are using a virtual machine and it is not already powered on, in the VMware vSphere Client, right-click the deployed virtual appliance and choose Power > Power On .
After the server boots up, you’ll see the localhost login prompt.
Step 3 At the localhost login prompt, enter setup .
Step 4 The console prompts you for the following parameters:
- Hostname—The host name of the virtual appliance.
- IP Address—The IP address of the virtual appliance.
- IP default netmask—The default subnet mask for the IP address.
- IP default gateway—The IP address of the default gateway.
- Default DNS domain—The default domain name.
- Primary nameserver—The IP address of the primary name server.
- Secondary name servers—The IP address if the secondary name server, if available. You can add up to three secondary name servers.
- Primary NTP server—The IP address or host name of the primary Network Time Protocol server you want to use. (time.nist.gov is the default).
- Secondary NTP servers—The IP addresses or host names of the secondary NTP servers to be used when the primary is not available.
- System Time Zone—The time zone code you want to use . See Time Zones Supported By Cisco Prime Infrastructure in the Cisco Prime Infrastructure FIPS 3.2 User Guide .
- Clock time—The clock time based on the server’s time zone.
- Username—The name of the first administrative user (known as “admin”). This is the administrator account used to log in to the server via the console or SSH. You can accept the default, which is admin.
- Password—Enter the admin user password and then confirm it.
Tip Keep your Prime Infrastructure password in a safe place. If you forget the password, see How to Recover Administrator Passwords on Virtual Appliances in the Cisco Prime Infrastructure FIPS 3.2 Administrator Guide.
Step 5 When you are done entering these values, the installer application tests the network configuration parameters that you entered. If the tests are successful, it begins installing Prime Infrastructure.
Step 6 When the application installation is complete, you will be prompted for the following post-installation parameters:
- High Availability Role Selection—Enter yes at the prompt if you want this installed server to serve as the secondary server in a high availability implementation. You will be prompted to provide an authentication key to be used for high availability registration. If you enter no at the prompt, the server will act as the primary server (standalone) and the installation will proceed with the following prompts:
- Web Interface Root Password—Enter and confirm the password used for the default root administrator. This is the account used to log in to the Prime Infrastructure web user interface for the first time and set up other user accounts.
Step 7 Select Yes to proceed with the installation, or select No to re-enter high availability and FIPS mode options.
Step 8 When the installation is complete, the appliance reboots and you are presented with a login prompt.
Step 9 Log in to the virtual machine using the “admin” username and password that you specified in Step 4.
Step 10 Run the ncs status command (see Check Prime Infrastructure Server Status in the Cisco Prime Infrastructure FIPS 3.2 Administrator Guide ) to verify that the processes have restarted. You should see the following process statuses:
Features that are not supported by FIPS
Cisco Prime Infrastructure 3.2 FIPS does not support the following features:
- Plug and Play deployment
- APIC-EM integration with Plug and Play
- APIC-EM integration with IWAN
- Operation Center
- Maps - Google Earth
- CMX integration with Prime Infrastructure
- Root Shell access (It is disabled by default and cannot be enabled.)
- TFTP and FTP
- LMS Migration
- Collection of telemetry data
- vCenter integration
- Config Archive (Vlan.dat fetch)
- UCS device
- Packet Capture
- MSE High Availability
- Single Sign-On Authentication (SSO)
- Mobility Service Engine (MSE)
IPSec Tested Devices
Table 5 lists IPSec devices that are tested for Prime Infrastructure 3.2 FIPS Release:
Before You Migrate Your Data
You should check the validity of your Prime Infrastructure backup data by setting up an additional Prime Infrastructure server (either a spare Prime Infrastructure appliance or a new Prime Infrastructure virtual machine) and perform the restore operation as explained in Restore an Application Backup in the Cisco Prime Infrastructure FIPS 3.2 Administrator Guide . If you do not have an additional Prime Infrastructure system to validate the backup, take at least two backups to reduce the risk of losing data.
Note You cannot restore Prime Infrastructure 3.2 FIPS backup to 3.2 or 3.3 release version. You can restore 3.2 FIPS backup only on Prime Infrastructure 3.2 FIPS server.
If the restore operation does not work, or there are problems with the backed up image, try taking another backup from a production system, or try restoring from an earlier Prime Infrastructure backup.
If you cannot create a verified backup before installing this version of Prime Infrastructure, open a support case with Cisco TAC.
Migrating Data From Previous Releases of Prime Infrastructure
You can migrate from the Prime Infrastructure 2.2.0.0.158 version to Prime Infrastructure 3.2 FIPS:
See Before You Migrate Your Data before you start the following steps to restore your data from Prime Infrastructure 2.2.0.0.158 to your newly installed Prime Infrastructure 3.2 FIPS server:
Step 1 Configure the new Prime Infrastructure host to use the same remote backup repository as the old host. For details, see Use a Remote Backup Repository in the Cisco Prime Infrastructure FIPS 3.2 Administrator Guide .
Step 2 Restore the application backup on the remote repository to the new host, as explained in Restore an Application Backup in the Cisco Prime Infrastructure FIPS 3.2 Administrator Guide .
Step 3 When the process is complete:
- Instruct users to clear the browser cache on all client machines that accessed an older version of Prime Infrastructure before they try to connect to the upgraded/restored Prime Infrastructure server.
- If you are using Prime Infrastructure to manage Cisco Wireless LAN Controllers, see Resynchronizing WLC Configurations after Migration .
- Synchronize your devices as explained in Synchronize Devices in the Cisco Prime Infrastructure FIPS 3.2 User Guide .
Step 4 After the new Prime Infrastructure 3.2 FIPS server is operational, decommission your previous server.
Assurance Data after Migration
After restoring Prime Infrastructure 2.2.0.0.158 FIPS support server on a new Prime Infrastructure 3.2 FIPS supported virtual machine or hardware appliance, your Assurance license is automatically applied to the new server.
When you move your data to Prime Infrastructure 3.2 FIPS, the following Assurance data is not migrated:
- Raw NetFlow information
- Custom NetFlow reports
- Packet capture files
- Processed non-aggregated data, such as PFR data and URLs
5-minute, 1-hour, and 1-day aggregated data is migrated from Prime Infrastructure 2.2.0.0.158 FIPS support server.
Resynchronizing WLC Configurations after Migration
After you restore the backup of the previous version on the 2.2.0.0.158 version of Prime Infrastructure, your server’s records of Cisco Wireless LAN Controller configurations might be out of sync with the configurations stored on those devices. Resynchronize them using the following steps before continuing.
Step 1 Log in to Prime Infrastructure.
Step 2 Choose Inventory > Network Devices > Wireless Controller . Prime Infrastructure displays a list of all the controllers it is managing, including all Cisco WLCs.
Step 3 Select a device, then click Sync .
Step 4 Repeat steps 2 and 3 for all your other WLCs.
Post-Installation Tasks
Follow the instructions in this section once you have finished installing Prime Infrastructure.
Logging in to the Prime Infrastructure User Interface
We strongly recommend you use signed certificates to ensure secure connections between clients and the Prime Infrastructure server. For information about creating a signed certificate, see I mport Subject Alternate Names (SAN) CA-Signed Certificates in the Cisco Prime Infrastructure FIPS 3.2 Administrator Guide .
Follow these steps to log in to the Prime Infrastructure user interface through a web browser:
Step 1 Launch one of the Supported Browsers (see Understanding System Requirements ) on a different computer from the one on which you installed and started Prime Infrastructure.
Step 2 In the browser’s address line, enter https: //ipaddress , where ipaddress is the IP address of the server on which you installed Prime Infrastructure. The Prime Infrastructure user interface displays the Login window.
When you access Prime Infrastructure for the first time, some browsers will display a warning that the site is untrusted. When this happens, follow the prompts to add a security exception and download the self-signed certificate from the Prime Infrastructure server. After you complete this procedure, the browser will accept the Prime Infrastructure server as a trusted site in all future login attempts.
Step 3 Check the Login Disclaimer Acknowledgment check box.
Step 4 Enter the root administrator username and password, as specified when Setting Up Prime Infrastructure on a Virtual Machine or Physical Appliance .
Step 5 Click Login to log in to Prime Infrastructure. The login button will be grayed out if you do not check the Login Disclaimer Acknowledgment check box. A toast notification indicating the client IP address, last successful login time, and number of login attempts failed for the last 24 hours is displayed.
The user interface is now active and available for use. The home page appears. If any licensing problems occur, a message appears in an alert box. If you have an evaluation license, the number of days until the license expires is shown. You are also alerted to any expired licenses. You have the option to go directly to the Administration > Licenses page to address these problems.
Step 6 To ensure system security, choose Administration > Users, Roles & AAA > Change Password to change the password for the root administrator.
To exit the user interface, close the browser page or click Logout in the top-right corner of the page. Exiting a Prime Infrastructure user interface session does not shut down Prime Infrastructure on the server.
If a system administrator stops the Prime Infrastructure server during your Prime Infrastructure user interface session, your session ends, and the browser displays this message: “The page cannot be displayed.” Your session does not re-associate to Prime Infrastructure when the server restarts. You must start a new Prime Infrastructure session.
Getting Started Using Prime Infrastructure
After you install Prime Infrastructure, you must perform additional tasks to begin managing your network. If you are an administrator, see the following sections in the Set Up the Prime Infrastructure Server in the Cisco Prime Infrastructure FIPS 3.2 Administrator Guide:
- Configure Data Sources for Cisco Prime Infrastructure With Assurance , including enable NetFlow and Performance Agent.
- How to Manage Disk Space Issues on Prime Infrastructure servers.
- Renew AAA Settings After Installing a New Prime Infrastructure Version
- Prime Infrastructure Software Updates
For information about installing the Cisco Plug and Play Application, see the Cisco Plug and Play Application Solutions Guide .
Users should complete the tasks listed in the G et Started with Prime Infrastructure chapter of the Cisco Prime Infrastructure FIPS 3.2 User Guide . After you complete these tasks, you are ready to start monitoring and configuring your network.
Reference Information
The following sections provide reference information about Prime Infrastructure and its support options.
- Ports Used by Prime Infrastructure and Assurance
- Removing the Prime Infrastructure Virtual Appliance
- Navigation and Documentation Reference
- Related Documentation
- Obtaining Documentation and Submitting a Service Request
Ports Used by Prime Infrastructure and Assurance
Table 6 lists the ports used by Prime Infrastructure and Assurance. These ports must be open in firewalls if you are using these services.
Removing the Prime Infrastructure Virtual Appliance
Removing Prime Infrastructure using the following method will permanently delete all data on the server, including server settings and local backups. You will be unable to restore your data unless you have a remote backup. For other methods of removal, see How to Remove Prime Infrastructure in Cisco Prime Infrastructure FIPS 3.2 Admin Guide .
Step 1 In the VMware vSphere client, right-click the Prime Infrastructure virtual appliance.
Step 2 Power off the virtual appliance.
Step 3 Click Delete from Disk to remove the Prime Infrastructure virtual appliance.
Navigation and Documentation Reference
This section provides information about navigational paths to access Prime Infrastructure features, and the details of the sections where the features are covered in the Cisco Prime Infrastructure FIPS 3.2 User Guide .
Related Documentation
The Cisco Prime Infrastructure 3.2 Documentation Overview lists all documentation available for Prime Infrastructure:
Note We sometimes update the documentation after original publication. Therefore, you should also review the documentation on Cisco.com for any updates.
Obtaining Documentation and Submitting a Service Request
For information on obtaining documentation, submitting a service request, and gathering additional information, see the monthly What’s New in Cisco Product Documentation , which also lists all new and revised Cisco technical documentation, at:
http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html
Subscribe to the What’s New in Cisco Product Documentation as an RSS feed and set content to be delivered directly to your desktop using a reader application. The RSS feeds are a free service. Cisco currently supports RSS Version 2.0.
Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at www.cisco.com/go/trademarks . Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)
Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.
Feedback