Cisco Prime Network Administrator Guide, 4.2

General

Contains general information such as VNE name, IP address, and scheme. By default, Prime Network uses the newest DP installed on the gateway or unit. If you are creating a single VNE, you can specify a different DP from the drop-down list.

Note If Prime Network is installed with Cisco Prime Central, be sure to use a device’s SYSNAME as its VNE name. This allows the device to be recognized across the common inventory.

General VNE Properties Reference

SNMP

Specifies SNMP information and credentials to support polling and device reachability. The fields displayed in the dialog box depend on the protocol you select.

SNMP VNE Properties Reference

Telnet/SSH

Enables Telnet and SSH for device reachability and investigation, including the Telnet sequence and SSH prompts. The fields displayed in the dialog box depend on the protocol you select.

Telnet/SSH VNE Properties Reference

XML

Enables XML for device reachability and investigation.

XML VNE Properties Reference

HTTP

Enables HTTP or HTTPS for device reachability and investigation.

HTTP VNE Properties Reference

TL1

Enables the TL1 management protocol for running scripts on the device (used by Change and Configuration Management only).

VNE TL1 Properties Reference

ICMP

Enables ICMP and the ICMP polling rate (in seconds) for device reachability testing.

ICMP VNE Properties Reference

Polling

Associates a VNE with a previously created polling group or allows you to configure different polling settings according to the type of VNE information you want (status, configuration, and so forth).

VNE Polling Properties Reference

Adaptive Polling

Controls how the VNE responds to high CPU situations.

VNE Properties: Adaptive Polling

Events

Specifies other IP addresses on which the VNE should listen for syslogs and traps.

VNE Properties: Events

Name

Name of the VNE, which will be used as a unique key in Prime Network. It is also used for commands that manipulate the VNE.

Note If Prime Network is installed with Cisco Prime Central, be sure to use a device’s SYSNAME as its VNE name. This allows the device to be recognized across the common inventory.

You cannot change a VNE name once you have created the VNE. To change the name you must delete and add a new VNE.

IP Address

Device management IP address of the network element. You can change the IP address of an existing VNE by changing it in this field. You must stop and restart the VNE to apply your change.

Type

Defines the protocol Prime Network will use to model the element, and the extent to which you want the element to be modeled. For information on how Prime Network responds when an NE is unreachable, see Changing VNE and Protocol Settings That Determine Device Reachability. In the drop-down list, choose the VNE device type:

• Auto Detect—Use this type if SNMP is enabled on the element. Prime Network will use SNMP to gather all available inventory information.
• Generic SNMP—Use this type if SNMP is enabled on the element, and either Prime Network does not support the element, or Prime Network does support the element but you only want basic information to be modeled. Prime Network will use SNMP to gather the most basic inventory information that is normally provided by all network elements. See Notes on Generic SNMP VNEs.
• Cloud—Use this type for an unmanaged network segment. Specific Cloud configuration is provided on a per-project basis. All other tabs will be disabled. See Creating Connections Between Unmanaged Network Segments (Cloud VNEs and Links).
• ICMP—Use this type if ICMP is enabled on the element, and either Prime Network does not support the element, or Prime Network does support the element but you only want basic information to be modeled. Prime Network will use ICMP to gather the most basic inventory information that is normally provided by all network elements, and will perform reachability testing only. ICMP VNEs can connect to other VNEs using static links. If you want to connect ICMP VNEs using physical links, you must configure the ICMP VNE’s MAC address, as described in Notes on ICMP VNEs.

Scheme

Defines the VNE modeling components investigated during the discovery process and then populated in the VNE model. This enables the administrator to define different behavior for some network elements; for example, some network elements poll only with SNMP, and other network elements poll with Telnet. Soft properties and activation scripts are also attached to a specific scheme. By default, the VNE inherits the VNE scheme from the default scheme. Where more than one scheme exists in the network, the VNE loads the selected scheme.

• Product— For devices that are not part of the network core, such as the Cisco 800 Series or 2900 Series.
• IpCore—For devices that are part of the network core, such as the Cisco 3600 Series or CRS (Carrier Routing System) Series.
• EMS—For devices where only system information and physical inventory should be polled (that is, the minimum amount of data). It is supported on all devices but does not support any technologies.
• Default—For cases where you are not sure which scheme to choose. Prime Network will use the Product scheme.

For more information, see Choosing a VNE Scheme (Check Technologies and Device Types).

State

Sets the initial disposition of the VNE. Normally you should set it to Stop, especially if you want to verify the VNE configuration, or if you know the VNE is very complex and might need extra processing to complete the loading procedure.

Note If you use auto-add, the VNE will automatically be started.

• Stop—The VNE is not loaded. This is the default state.
• Start—The VNE is loaded and starts collecting data.

To move an existing VNE to the maintenance state, see Stopping, Starting, and Moving VNEs to Maintenance Mode.

Unit

IP address of the unit that hosts the AVM for the VNE.

AVM

AVM ID associated with this VNE.

Version

(Existing VNEs only) Version of the VNE device driver being used.

Device Package Name

For existing VNEs, this is the Device Package that is installed on the gateway server. You can use this and the driver file name information to verify whether a newer driver is available, which might supply additional functionality. See Finding Out if New Device Support is Available.

For new VNEs, this is a drop-down list that displays all available Device Packages. By default, the VNE uses the latest DP that is installed on the gateway or unit. After creating the VNE, you can update it to use new driver files as described in Changing the Device Package a VNE Is Using.

Driver File Name

(Existing VNEs only) Name of the VNE device driver being used (this driver corresponds to the DP that is listed).

Enable SNMP

If checked, enables the SNMP communication protocol so that the user can work with it. A VNE can have SNMP enabled or disabled at any time; however, when the Auto Detect check box is checked (in the General tab), it cannot be disabled.

SNMP V1 and V2 fields are available only when SNMP is enabled.

Read

SNMP read community status, public (default) or private, as defined by the user.

Write

(Optional) SNMP write community status, public or private (default), as defined by the user.

SNMP V3 fields are available only when SNMP V3 is chosen. Make sure you have performed the required SNMPv3 device configuration tasks listed in SNMP Traps and Informs—Required Device Settings.

Authentication

Type of authentication to be used:

• No—Authentication is not required (default).
• md5—Uses Message Digest 5 (MD5) for the authentication mechanism.
• sha—Uses Secure Hash Algorithm (SHA) for the authentication mechanism.

User

Authentication username.

Password

Authentication password. This field is enabled if you choose md5 or sha.

Encryption

Type of encryption method to be used. These choices are disabled if you choose No authentication.

• No—Encryption is not required (default).
• des—Uses Data Encryption Standard (DES) for encryption.
• aes128—Uses 128-bit Advanced Encryption Standard (AES) for authentication.
• aes192—Uses 192-bit AES for authentication.
• aes256—Uses 256-bit AES for authentication.

Password

Encryption password. This field is enabled if you choose des, aes128, aes192, or aes256 encryption.

Enable

Enables the communication protocol so Prime Network will investigate the network element. Checking this check box activates the other fields in this tab.

Protocol

Type of protocol to be used: Telnet (default), SSHv1, or SSHv2. If you want to change the port a device is using for Change and Configuration Management, select SSHv1 or SSHv2 and enter the correct port number.

Note By default, when a VNE opens a Telnet session with a network element in order to model and monitor the element, the Telnet session remains open for 5 minutes, even if the VNE is idle (did not query the device during the session). After 5 minutes, the VNE closes the session and reopens it when it needs to query the device. If you would like to change this configuration, contact your Cisco account representative.

Port

Port the protocol will use. This field is prepopulated depending on your protocol choice. If you are not using the default port, enter the appropriate port number.

• 23—Default port for Telnet.
• 22—Default port for SSHv1 or SSHv2.

Prompt and Run

The network element’s expected prompt, and the string Prime Network should send to the network element (when the expected prompt is detected). The table shows the current settings; you can change the settings using the controls below the table. Entering a string in the Prompt field activates the Run field. After making your entries in the Prompt and Run fields, check Mask if you do not want the password entered as clear text. Finally, click Add to add them to the login sequence. Click Remove to remove any lines. Use the up and down controls to the right of the table to change the order.

Note After an SSH session is established between the VNE and the device, the VNE starts the login sequence. This sequence is usually shorter than the corresponding Telnet login sequence, as the username or password might have been sent as a step in establishing the SSH session (see the example in Telnet and SSH Login Sequences: Notes and Examples).

If you selected Telnet:

Telnet prompt information. The sequence (the order of the commands) must end with a line that includes only the prompt field. Prime Network VNEs can handle partial device prompts as well. For examples, see Telnet and SSH Login Sequences: Notes and Examples.

The Prompt field should contain the prompt expected from the device; the Run field should contain the response to the expected prompt. When entering the Run information, you must confirm the entry in the Confirm field. The values in Run and Confirm are displayed as clear text if you have not checked the Hide the Run value while typing check box.

If you selected SSH V1 or V2:

SSH prompt information. This sequence is usually shorter than the corresponding Telnet login sequence, because the username or password may already be sent during the process of establishing the SSH session. We recommend that you first use any SSH client application (such as UNIX SSH or OpenSSH) to determine the device SSH login sequence, and then enter that information.

Mask

Masks the password so it is not displayed as clear text in the Run and Confirm fields.

Add and Remove

Used to manipulate the order of the prompt and run strings.

User Name

Device name.

Password

Device password.

Cipher

Encryption algorithm to be used. By default, all methods are used.

• DES—Use the Data Encryption Standard algorithms.
• 3DES—Use the Triple Data Encryption Standard algorithm.
• Blowfish—Use the blowfish algorithms.

Authentication

Authentication method; currently password is the only supported method.

User Name

SSHv2 username.

Client Authentication

Client-driven authentication method to be used.

password

Use a password to authenticate the client. Enter the password in the Password field.

public-key

Optionally, use public key authentication, which uses a key pair system in which the client application is configured with the secret private key, and the device is configured with the public (non-secret) key (of this pair). To create a pair of keys:

1. In the Private Key field, click ... to import the private key from a file. You cannot manually enter they key, but you can edit a key that you import from file. If you change it to the wrong key, you will see an error message.

2. In the Public Key area, generate the public key in any of the following ways:

– Click ... to import the public key from a file.

– Manually enter a public key.

– Click Generate to autogenerate a public key.

Server Authentication

Server authentication method to be used.

none

No server authentication. (This method does not do any authentication and is not recommended, because it poses a security risk for “man-in-the-middle” attacks.)

save-first-
auth

Uses the public key that was used for the first connection attempt with the server. This method assumes the first connection was legitimate. (A security risk exists if the connection was compromised.) After the first connection, the server authentication method is changed to preconfigured, and the public key data is inserted as the preconfigured data.

preconfigured

Uses the server public key or fingerprint that was configured in the application event before the first connection was attempted. This is the default and is the recommended method. Selecting this method activates the Finger Print or Public Key field.

Select one of the following (and be sure to read the description, provided later in this table, of the Host Key Algorithm field):

• Finger Print—Uses a short checksum of the server public key (this serves the same purpose, but is much shorter).
• Public Key—Uses the public key in one of the permitted formats (see Notes on SSHv2 Public Key and Private Key File Formats). Click ... to import the public key from a file.

By default, the SSHv2 Key, MAC, ciphers, and host key algorithms1 are allowed (enabled):

• Key exchange: DH-group1-sha1, DH-group1-exchange-sha1
• MAC algorithm: SHA1, MD5, SHA1-96, MD5-96
• Ciphers: 3DES, AES-128, AES-192, AES-256, Blowfish, Arcfour
• Host Key Algorithm: DSA, RSA

For information on how to change these settings, see Securing Device Connections: SSH and SNMPv3.

Enable

Enables the XML communication protocol so Prime Network will investigate the network element. Checking this check box activates the other fields in this tab.

Protocol

Type of protocol to be used: Telnet (default) or SSL.

Note By default, when a VNE opens a Telnet session with a network element in order to model and monitor the element, the Telnet session remains open for 5 minutes, even if the VNE is idle (did not query the device during the session). After 5 minutes, the VNE closes the session and reopens it when it needs to query the device. If you would like to change this configuration, contact your Cisco account representative.

Port

Port the protocol will use. This field is prepopulated depending on your protocol choice. If you are not using the default port, enter the appropriate port number.

• 38751—Default port for Telnet.
• 38752—Default port for SSL.

Prompt and Run

The network element’s expected Telnet or SSL prompt, and the string Prime Network should send to the network element (when the expected prompt is detected). The table shows the current settings; you can change the settings using the controls below the table. Entering a string in the Prompt field activates the Run field. After making your entries in the Prompt and Run fields, check Mask if you do not want the password entered as clear text. Finally, click Add to add them to the login sequence. Click Remove to remove any lines. Use the up and down controls to the right of the table to change the order.

Note After an SSH session is established between the VNE and the device, the VNE starts the login sequence. This sequence is usually shorter than the corresponding Telnet login sequence, as the username or password might have been sent as a step in establishing the SSH session (see the example in Telnet and SSH Login Sequences: Notes and Examples).

The sequence (the order of the commands) must end with a line that includes only the prompt field. The Prompt field should contain the prompt expected from the device; the Run field should contain the response to the expected prompt. When entering the Run information, you must confirm the entry in the Confirm field. The values in Run and Confirm are displayed as clear text if you have not checked the Hide the Run value while typing check box.

Mask

Masks the password so it is not displayed as clear text in the Run and Confirm fields.

Add and Remove

Used to manipulate the order of the prompt and run strings.

Enable

Enables the HTTP communication protocol so Prime Network can investigate the network element. Checking this check box activates the other fields in this tab.

Enable HTTPS

Enables the secure HTTP communication protocol.

Port

Port the protocol will use. By default, HTTP uses port 80, and HTTPS uses 443.

Use Authentication

Enables requiring credentials for HTTP to log into the device.

Enable

Instructs Prime Network to use the ICMP communication protocol to verify that the network element is reachable. You can enable or disable ICMP polling at any time by checking or unchecking the check box (except for ICMP type VNEs, which require this setting to be enabled).

Polling Rate

Polling rate in seconds. If ICMP is enabled, this is a required field.

Enable

Enables the TL1 management protocol for CPT devices. Checking this box activates the other fields in this tab.

Port

Port the protocol will use.

User

TL1 user name

Password

Password for TL1 user.

Polling approach for model updates

Specifies whether to use normal or reduced polling. The reduced polling mechanism polls a device only when a configuration change syslog is received (which results in less polling overall). You can verify whether a device supports reduced polling by clicking the Supported on selected devices only link.

By default, reduced polling is enabled. For more information see Configuring Reduced (Event-Based) Polling.

Always use reduced polling

Prime Network will define the settings based on the recommended offset of model fidelity vs. interference. If the device type does not support event-based polling, Prime Network generates a Device Unsupported event.

Use this when you want to be notified if the device type does not support reduced polling.

Used reduced polling if possible

Prime Network will define the settings based on the recommended offset of model fidelity vs. interference. If the device type does not support event-based polling, Prime Network uses regular polling.

Note This is the default method for all VNEs.

Use this when you do not want to be notified if the device type does not support reduced polling.

Use regular polling

Instructs Prime Network to proactively poll configuration data using a configuration interval (usually every 15 minutes). This means that even in extreme circumstances where events are lost, the VNE would be synchronized after a maximum of 15 minutes (not 24 hours).

Use this when you want the device to use regular polling regardless of whether its device type supports reduced polling.

Group

Use polling rates from one of the polling groups listed in the drop-down list. This allows you to apply polling rates more globally, to devices of similar type. By default, Prime Network uses Group (not Instance), and the polling group named default (which is provided out-of-the-box).

Note You can create new polling groups that will appear in the drop-down list by using the procedure in Configuring Basic Polling Settings for Status, Configuration, System, Layer 1 and Layer 2 Data.

Instance

Uses a user-specified polling rate created by changing the polling rates of any one of the built-in polling intervals displayed in the dialog box. When you select Instance, the Polling Intervals and Topology areas are activated. These settings are applied to only this VNE.

Note A polling rate that is not changed inherits its settings from the group specified in the drop-down list.

Note We recommend that you use the default settings for these polling intervals. Setting the fields below the default values can result in an overload of the Prime Network unit or polled device.

Status

Polling rate for status-related information, such as network element status (up or down), port status, administrative status, and so on. This is typically the most frequently polled information, reflecting the current operational and administrative state of the element and its components. The default setting is 180 seconds.

Configuration

Polling rate for configuration-related information, such as VC tables, scrambling, and so on. These reflect more dynamic element configuration such as forwarding, routing, and switching tables. The default setting is 900 seconds.

System

Polling rate for system-related information, such as network element name, network element location, and so on. These reflect element configurations that are less dynamic in nature. The default setting is 86400 seconds.

Layer 1

Polling rate of the topology process as an interval for the Layer 1 counter. This is an ongoing process. The default setting is 90 seconds.

Layer 2

Polling rate of the topology process as an interval for the Layer 2 counter. This process is available on demand. The default setting is 30 seconds.

Group

Use a customized adaptive polling group. If any adaptive polling groups have been created and enabled, they are displayed in the drop-down list. (Prime Network comes with one predefined adaptive polling group named PN Settings Group ; it uses whichever settings are recommended by Prime Network.)

Device Type Settings

Use the settings specified for this device type (as delivered with Prime Network). If the device does not support adaptive polling (no device type settings exist), the Prime Network Settings are used.

Local Settings

Specify your own settings, overriding the defaults. The settings are applied to this VNE only.

• To enter your own adaptive polling settings, click Local Settings and enter the thresholds. The changes are not applied until you check the Enable check box.
• To turn off adaptive polling for the VNE, click Local Settings and uncheck the Enable check box. Prime Network will not use any of the safeguards provided by the adaptive polling mechanism.

You have to restart the VNE only if you enable or disable adaptive polling.

Thresholds

Upper Threshold

Upper CPU usage threshold. When CPU usage exceeds this value for a specified number of (tolerance) polls, the adaptive polling mechanism is triggered and the VNE moves to slow polling or CPU-only polling.

Lower Threshold

Lower CPU usage threshold. When CPU usage drops below this value for a specified number of polls (2 by default), the VNE reverts from slow polling to normal polling and related alarms are cleared.

Upper Tolerance

Number of high-CPU polls required to move the VNE to slow polling. When the Upper Threshold is crossed this number of consecutive CPU polls, the VNE moves from normal polling to slow polling. (To be more conservative, enter a lower number.)

For example, using the default settings, a Cisco IOS-XR VNE would move from normal polling to slow polling after 5 minutes — that is, 5 Upper Tolerance polls with a 60-second interval (see Table 12-4).

Lower Tolerance

Number of low-CPU polls required to revert the VNE to normal polling. When CPU utilization falls below the Lower Threshold for this number of consecutive polls, the VNE reverts from slow polling or CPU-only polling to normal polling. (To be more conservative, enter a higher number.)

Maintenance Tolerance

Total number of high-CPU polls required to move the VNE to CPU-only polling. This number includes the Upper Tolerance polls.

For example, an Upper Tolerance of 5 and a Maintenance Tolerance of 10 means:

• The VNE would move from normal polling to slow polling after 5 high-CPU polls (Upper Tolerance).
• The VNE would move from slow polling to CPU-only polling after 5 more high-CPU polls, for a total of 10 (Maintenance Tolerance) high-CPU polls.

Using the default settings, this means that Cisco IOS-XR VNEs, which have a 60-second polling interval, would move from normal polling to CPU-only polling in 10 minutes:

• The VNE would move from normal polling to slow polling after 5 minutes.
• The VNE would move from slow polling to CPU-only polling after 5 more minutes.

See Table 12-4 for the default interval settings.

SNMP Delay

Delay (in milliseconds) between SNMP packets that are sent from the VNE to the device.

Telnet Delay

Delay (in milliseconds) between Telnet commands that are sent from the VNE to the device.

Enter IP Address

Field in which to enter new IP address, where you want the VNE to listen for syslogs and traps.

Event-Generating IP Addresses

Existing IP addresses the VNE is already listening to, for syslogs and traps.