Cisco Prime Optical User Guide, 10.7

Southbound Interfaces with NEs

The Prime Optical server communicates with NEs through the data communications network (DCN) by using several protocols (CORBA, HTTP, SNMP, TL1, and so on).

ONS 15216

The ONS 15216 product family consists of the following classes of products:

• DWDM filters or multiplexer/demultiplexer units
• Optical add/drop multiplexers (OADMs)
• Optical amplifiers (OAs), which are also referred to as erbium-doped fiber amplifiers (EDFAs)
• Dispersion compensation, including the Optical Supervisory Channel (OSC) and Dispersion Compensation Unit (DCU)

The ONS 15216 NEs are referred to as active or passive. Active NEs support a management interface; passive NEs do not. There is no communication between passive NEs and Prime Optical; rather, all of the information is user-defined. You can use the Domain Explorer to manually add inventory information for passive NEs. You can use the NE Explorer to manually add specific information such as serial number. For passive ONS 15216 NEs with multiple slots (such as the DCU), you can use the NE Explorer to specify the content of each slot. All of the information that you define is maintained in the Prime Optical database and propagated to an external OSS through Prime Optical GateWay/CORBA.

Table 2-1 summarizes the management protocol support available for the ONS 15216 product family. It also identifies each NE type as active or passive.

ONS 15305

Prime Optical uses SNMP as the primary management interface for the ONS 15305. Prime Optical supports the use of Cisco Edge Craft to configure the ONS 1530x. Cisco Edge Craft is the local craft application used to manage ONS 15305 NEs.

ONS 15310 CL, ONS 15310 MA SONET, ONS 15310 MA SDH, ONS 15327, ONS 15454 SONET, ONS 15454 SDH, ONS 15600 SONET, and ONS 15600 SDH

The ONS 15310 CL, ONS 15310 MA SONET, ONS 15310 MA SDH, ONS 15327, ONS 15454 SONET, ONS 15454 SDH, ONS 15600 SONET, and ONS 15600 SDH support TL1 and SNMP interfaces, as well as a CORBA interface for Cisco Transport Controller (CTC) and Prime Optical management. The CORBA interface is a proprietary Cisco interface and is not published for use by customers or third parties.

Note TL1 support is not available for ONS 15305 CTC, ONS 15454 SDH releases earlier than R5.0, or ONS 15600 SDH releases earlier than R8.0.

The ONS 15310 CL, ONS 15310 MA SONET, ONS 15310 MA SDH, ONS 15327, ONS 15454 SONET, ONS 15454 SDH, ONS 15600 SONET, and ONS 15600 SDH also support a Cisco proprietary HTTP interface for bulk collection of performance management (PM) data. This interface is not published for customer or third-party use.

Note The ONS 15305 R3.0 does not support the Cisco proprietary HTTP interface for bulk collection of PM data. Instead, the ONS 1530x PM Service collects PM data by using the SNMP protocol.

Note In general, any updates from CTC for ONS 15600-specific screens can take up to several minutes. This delay affects Prime Optical screens that are specific to the ONS 15600 SONET and ONS 15600 SDH.

Northbound Interfaces with OSSs

Prime Optical supports three gateway modules that provide northbound EMS-to-NMS interface mediation. Not all NE types are supported by each module. Table 2-2 shows the NE types supported by each gateway module.

See Managing Southbound and Northbound Interfaces for detailed information about Prime Optical GateWay/SNMP. See also Cisco Prime Optical GateWay/CORBA User Guide and Programmer Manual for detailed information about Prime Optical GateWay/CORBA.

Proxy Server/Firewall Configurations

The ONS 15310 CL, ONS 15310 MA SONET, ONS 15310 MA SDH, ONS 15327, ONS 15454 SONET, ONS 15454 SDH, ONS 15600 SONET, and ONS 15600 SDH support a proxy server configuration that allows networking ONS NEs in environments where visibility and accessibility between NEs must be restricted. In a proxy server environment, NEs are designated as gateway NEs (GNEs) or end NEs (ENEs). The GNE is LAN-connected to the DCN, while the ENEs are accessed through the proxy server feature on the GNE over the section data communications channel (SDCC). The ENEs are not directly accessible by IP address; in fact, the ENE IP addresses can be in a separate, private IP address space because they are not visible on the larger DCN. The GNE must have an IP address that is valid for the DCN LAN.

Fault Management

Fault management (FM) detects, isolates, and reports faults for the network and service. Fault management tracks the correlation of related services; for example, reliability, availability, survivability, quality assurance, alarm surveillance, alarm management, fault localization, fault correction, testing, and trouble administration. Fault management also maximizes the availability of the network for service delivery.

The Alarm Browser, Alarm Log, and Dashboard provide information on fault management. Fault management tools are described in Table 2-3 .

The FM function is responsible for the discovery and localization of malfunctions on managed NEs. Prime Optical supports consolidated FM by way of the following functions:

• Alarm collection

– Alarm and event acquisition and storage

– EMS alarms for loss of communication, software download failure, memory backup failure, login security violation, server monitor thresholds, and free remaining disk space

– Fault synchronization after connection loss

– Maintenance mode state for suppression of alarms, events, and PM collection

• Alarm display

– Quick-view Dashboard window for display of alarm count and unacknowledged alarm count, and launch of EMS alarm view

– Alarm indication and propagation

– Color and shape coding of severity for critical, major, minor, and warning alarms

• Alarm acknowledgement

– Flexible alarm acknowledgment—single, multiple, all, automatic

– Editable notes per alarm record

• Historic alarm retrieval
• Alarm sorting and filtering
• Visible and audible notification of alarm reporting
• Reports and exporting facilities

Configuration Management

With configuration management, you set and control NEs, identify resources, collect information about a resource, and manage connections between NEs. Configuration management deals not only with the state of NEs, but also with the provisioning of resources and services. Generally, configuration management involves network planning, installation, service planning and negotiation, service provisioning, equipment provisioning, status and control, and network topology. Configuration management allows you to prepare the network to deliver services.

Examples of configuration management include:

• Discovering the inventory of what is installed in the network
• Configuring chassis slots for cards based on desired services
• Managing intra-chassis connections between NEs
• Configuring cards in protected or unprotected relationships
• Configuring physical (PTP) or logical (CTP) ports to support service profiles
• Creating, modifying, viewing, and deleting network topologies and connections
• Downloading and activating NE software
• Backing up and restoring the NE configuration

Prime Optical provides different graphical views to support configuration management. All views can be classified into three main groups: explorers, network maps, and wizards.

Explorers

Explorer windows are divided into two sections: a tree and a pane. The tree organizes the resources (domain, groups, nodes, network partitions, subnetworks, and modules), which are displayed in a hierarchical format. You can access information about each resource by browsing the tree section. The pane provides specific information about the selected object. There are three types of explorers:

• Domain Explorer
• Subnetwork Explorer
• NE Explorer

Network Maps

Network Map windows display how the network is partitioned graphically. The Network Map is organized into a multilevel hierarchy that corresponds with the structure of Domain Explorer and Subnetwork Explorer trees. Users with the appropriate privileges can organize their own map display.

For more information, see Network Map.

Wizards

Wizards are used to simplify involved configuration management tasks such as:

• A-to-Z circuit provisioning
• NE user access administration
• Layer 2 service provisioning
• VLAN and SVLAN provisioning
• Software download
• Native equipment/facility provisioning
• Topology/link management
• Automatic NE memory backup, on-demand restoration
• General operation on multiple NEs

Inventory Management

Inventory information is another component of configuration management. Prime Optical provides two levels of inventory reports:

• Domain NE table—A complete list of all the NEs that belong to a specific group or to the entire domain
• Equipment Inventory table—A detailed list of cards and modules installed on a specific NE

Note For detailed information about inventory reports, see Managing Inventory

Adding New NEs to the Prime Optical Domain

The Add New NE wizard allows you to add a new NE, or to add several new NEs at once. The wizard allows you to enter multiple NE IP addresses one at a time, or enter a beginning and ending IP address and automatically add a range of NEs. See Adding NEs.

NE Connectivity and Operational States

The operational state of an NE can have the following values:

• Preprovisioned—The NE has been added to the database for provisioning but is not yet in service. Prime Optical does not manage preprovisioned NEs.
• Under Maintenance—The NE is temporarily under maintenance but requires monitoring. This state is the same as In Service except that Prime Optical does not report alarms or events for under-maintenance NEs.
• In Service—The NE is currently deployed and requires monitoring. Prime Optical collects polling, FM, configuration management, and PM data from in-service NEs and stores the data in the database.
• Out of Service—The NE has been marked Out of Service by a network administrator and does not require monitoring. The Prime Optical database records the last known state of the NE when it was in service.
• In Service–Initializing—The NE is marked as In Service–Initializing when Prime Optical connects to the NE (Communication State is marked as Available) and the discovery process starts. The initialization process is completed when fault and inventory have been synchronized. The operational state changes from In Service–Initializing to In Service–Synch Configuration.
• In Service–Synch Configuration—The NE is marked as In Service–Synch Configuration when Prime Optical uploads a configuration for that NE. You can change the operational state of an NE from In Service–Synch Configuration to Out of Service.

The communication state of an NE can have the following values:

• Not Applicable—The NE is Preprovisioned or Out of Service. The connection to the NE has not been established or has been dropped.
• Available—The NE is In Service or Under Maintenance and Prime Optical is connected to the NE. The NE is declared Available when it is reachable and supported by Prime Optical (as defined in Administration > Supported NE Table).
• Unavailable—The NE is In Service or Under Maintenance but Prime Optical cannot establish a connection to the NE. When Prime Optical loses the connection to the NE, an EMS alarm with a probable cause of Connection loss is generated.
• Initialization Failed—The NE software version is not listed in the Supported NE table.

Provisioning

Prime Optical supports provisioning through:

• NE Explorer—Shows service-provisioning information about the selected NE.
• Craft interface—Depending on the NE model, Prime Optical provides access to NE craft interfaces such as CTC, Cisco Edge Craft, web browsers, and the CLI.

Table 2-4 lists the available craft interfaces by NE model.

Link Management

A link is a connection between two termination points (TPs). Prime Optical represents the physical connectivity between NEs in the domain by defining the physical links between NEs. Prime Optical allows you to view, create, modify, and delete links. Prime Optical also supports a Link Utilization table, which displays utilization information and overall consumption of bandwidth for the selected links.

Note For all NEs that support links, you can add manually provisioned links. For example, you can define manual and patchcord links for the ONS 15454. For detailed information, see How Do I Build Links?.

Circuit Management

A circuit represents an end-to-end connection between two or more connection termination points (CTPs). A circuit consists of an alternating series of cross-connections and link connections. In its simplest form, a circuit consists of a single cross-connection (if the circuit is defined between two CTPs on the same NE). A circuit can be bidirectional or unidirectional, point-to-point or point-to-multipoint, and protected or unprotected.

Prime Optical supports the following circuit management operations:

• Find circuits
• View circuits and circuit spans
• Create circuits
• Modify circuits
• Delete circuits
• Trace circuits
• Display associated VLANs
• Upgrade circuits
• Repair circuits
• Update circuits
• Roll circuits
• Merge circuits
• Reconfigure circuits

Note See Provisioning Services and Connections for detailed information about circuit provisioning.

NE Release Management

An NE added to the Prime Optical domain is discovered and managed by Prime Optical only if the NE software version is defined in the Supported NE table.

Note See Cisco Prime Optical 10.7 Release Notes for the NE software versions that are supported in Prime Optical 10.7.

Caution Before updating the software image on an NE, check the Prime Optical release notes to verify whether the NE software version is supported in this Prime Optical release.

---

The following NE administration features are available for ONS 15216 EDFA, ONS 15305, ONS 15310 CL, ONS 15310 MA SONET, ONS 15310 MA SDH, ONS 15327, ONS 15454 SONET, ONS 15454 SDH, ONS 15600 SONET, and ONS 15600 SDH NEs:

• Software download (not available for the ONS 15305 R3.0)
• Memory backup and restore (not available for the ONS 15305)
• Job monitoring
• NE Software table (used to commit or revert software images)

Software Download Wizard

Use the Software Download wizard to download software to NEs. After the download is complete you can use the NE Software table to activate the software. The downloaded software becomes the active version, and the active version becomes the standby version. Prime Optical stores two software versions: active and standby.

Memory Backup Dialog Box

Use the Memory Backup dialog box to back up configuration and provisioning information that resides in the flash memory of an NE. By default, the local Prime Optical server automatically backs up the memory of NEs once a day for seven days and stores the backup files on the Prime Optical server. After seven days, the oldest backup file is replaced by the current backup.

Memory Restore Dialog Box

Use the Memory Restore dialog box to restore provisioning and configuration information stored in the flash memory of an NE.

Job Monitor Table

The Job Monitor table provides information about scheduled administrative tasks such as task type, task owner, task status, task start and end time, and so on.

NE Software Table

The NE Software table displays the active and standby software versions for the NE. From this table, you can activate new software or revert software on NEs.

Performance Management

Performance management (PM) involves gathering and reporting information on the behavior of NEs, networks, and services, including quality assurance, monitoring, management control, and analysis. It also involves the system’s ability to collect and store massive amounts of statistical data for network activity.

Performance management ensures that the network delivers services with the promised quality. PM data is useful for fine-tuning the performance of the device and proactively monitoring for catastrophic failures before they occur. The NEs accumulate PM statistics in 15-minute and 1-day intervals.

Note See Managing Performance for more information.

Examples of performance management include:

• Collecting, storing, and forwarding data to characterize the integrity of transmission
• Determining when connections fail to meet committed integrity thresholds

Selectable Collection of PM Data Parameters

There are two steps to setting PM collection:

1. Enable PM collection for a given NE model (in the Control Panel > PM Service pane)

2. Enable PM collection for specific NEs (in the Domain Explorer or Subnetwork Explorer > NE Properties pane > Status tab > PM Collection area)

PM data cannot be collected unless the PM Service process is running. If PM data collection is enabled on an NE but the PM Service is not running, Prime Optical displays a warning message.

For certain NEs, you can also enable robust PM data collection at the NE level. With robust collection, Prime Optical attempts to recover from any data collection gaps that might occur due to an outage or an extended communication failure. If Prime Optical detects a data gap, it attempts to retrieve the missing PM data from the historical registers available on the NE.

Note See Enabling or Disabling PM Data Collection on an Individual NE and Enabling or Disabling PM Data Collection by PM Category for CTC-Based NEs for information on enabling and disabling PM data collection.

PM Query and Graphs

Prime Optical offers two PM query wizards to view PM reports:

• Query by NE Model—Allows you to filter PM data by non-CTC-based NE models
• Query by PM Category—Allows you to filter PM data by PM category, which can span multiple NE models

The PM Query by NE Model wizard allows you to specify:

• Non-CTC-based NE model (ONS 15530, ONS 15305, and so on)
• PM type (SONET Section, SONET Line, and so on)
• 15-minute, 1-day, or real-time collection
• Near-end or far-end collection
• Time period
• Module type (valid only for real-time PM data collection)
• Physical location, where applicable

The PM Query by Category wizard allows you to specify:

• PM category (SONET, SDH, DWDM, and so on)
• PM type (SONET Section, SONET Line, and so on)
• 15-minute, 1-day, or real-time collection
• Near-end or far-end collection
• Time period
• Module type (valid only for real-time PM data collection)
• Physical location, where applicable

Note Performance management is not supported for the ONS 15216.

All PM tables contain a Plot tab that you can use to plot the data in a graphical view that is stored in the Prime Optical database. Prime Optical plots up to three parameters in one graph for comparison. The Y axis represents the selected parameter(s); the X axis shows the time.

Real-Time PM Reporting

Prime Optical supports the ability to launch a real-time PM report from the PM Query wizard or from a single row in a PM table. This feature allows you to examine the current value of a PM parameter in granularities finer than the standard 15-minute or 1-day interval. You can view and modify the polling interval for the real-time PM reporting session. You can end a real-time PM session at any time and export the data. For more information, see Managing Real-Time PM Data.

Note Real-time PM reporting applies only to CTC-based NEs.

Security Management

Security management prevents and detects any improper use of network resources and services. Aspects of security management include prevention, detection, containment, and recovery.

Security management protects the revenue-generating assets in the network. Examples of security management include:

• Controlling access to network management functions
• Controlling access to network logical resources

Security for the Prime Optical system can be divided into the following areas:

• Prime Optical security domain: To log in to the Prime Optical client, a username and password are required. A user profile defines the access privileges. Prime Optical passwords are stored using SHA384 one-way encryption. DES 64-bit encrypted passwords are stored in SHA384 on the Prime Optical server. A password entered on the Prime Optical client is converted to DES-64 before being sent to the Prime Optical server. If the password matches the password on the server that the SuperUser or SysAdmin configured for the user, or if the user changed his or her password when prompted, that password is stored on the server. Passwords are not stored on the user’s local workstation.
• OSS security domain: OSS-to-Prime Optical sessions are configured by the Prime Optical GateWay EMS-to-NMS interface architectural component.
• NE security domain: At the NE level, a username and password are configured to enable the user to connect directly through the console port (EIA/TIA-232), through the management port (10BASE-T), or remotely through a Telnet session. NE passwords are stored using base-64 two-way encryption.
• Prime Optical server login: You must have root user privileges to log in to the Prime Optical server workstation for debugging or changing the Prime Optical server program. A username and password are required.
• Oracle database access: Access to the Oracle database requires Oracle root user authentication, as well as Prime Optical database access authentication. The Oracle username and password are encrypted in the server configuration file.

Prime Optical supports the following security features:

• Login advisory message
• User management and profiles
• NE access control
• Audit Log

Login Advisory Message

The following is the default advisory message after logging into the Prime Optical client:

Note The login advisory message is not shown if you login to Prime Optical through Prime Central.

You can customize the default advisory message, or disable it altogether. See Managing Security

Network Partitioning

You can configure for network partitioning by dividing the network into logical areas. You can then access only the areas that are specified under your security profile. The nodes and elements must fall under the area or areas that fit your security profile for each Prime Optical application.

You can:

• Define the network partitions from the associated list of nodes.
• Define, modify, and view the areas within your network.
• Manage only the areas under your security profile.
• Manage connections that originate and terminate within the assigned area(s). The domain can include multiple areas.

User Management and Profiles

Prime Optical user management includes the ability to:

• Manage predefined default user profiles with different access privileges. User profiles have assigned roles: Transport or Security (or both). Roles grant different access privileges. See Table 2-5 for the default user types.

• Change user profile state (enabled or disabled). If a user profile is disabled, users with that profile cannot be created or used. Only SysAdmin users can change the state of user profiles.
• Create, delete, modify, and duplicate custom user profiles with certain privileges.

Custom user profiles can be created with the following restrictions:

– A SysAdmin can create profiles with any role (Transport, Security, or both).

– A SuperUser can create profiles with the Transport role only.

– A SecurityAdmin can create profiles with the Security role only.

Operations are grouped into categories. Only operations in the category Encryption Cards are enabled for profiles with the Security role.

• Create, delete, or modify Prime Optical users; view logged-in users; and end active user sessions, with the following restrictions:

– A SysAdmin can create or view users with any role (Transport, Security, or both).

– A SuperUser can create or view users with the Transport role only.

– A SecurityAdmin can create or view users with the Security role only.

• Regulate user logins, including password aging, login disable period, and logout time.
• Specify a CTC username and password.

Note Prime Optical can connect to a CTC-based NE only if that NE is configured with a CTC user who has SuperUser or RootUser privileges.

• Configure the username and password used by the Prime Optical server to access NEs.
• View, add, modify, and delete NE user accounts on one or more NEs.

Note For detailed information about user management, see Managing Security

NE Access Control

NE access control includes the ability to:

• Configure the username and password used by the Prime Optical server to access NEs and retrieve alarms, configuration, and inventory information.

Note Each username and password specified must exist on the selected NE in order for Prime Optical to manage it. A new or modified password takes effect at the next reconnection.

• Configure the username and password on multiple NEs by using the bulk NE authentication feature. With a single operation, you can specify the same username and password for NEs that belong to the same group or are assigned to the same user.
• Manage NE user accounts by using the NE User Access Administration table. This feature supports the ability to view, add, modify, and delete NE user accounts on one or more NEs.
• Monitor active NE users and log out selected users.
• Add predefined users on a selected NE.

Audit Log

The Audit Log contains information about significant events (user-initiated changes and activities) that occurred on the Prime Optical server during a specific time period for the purposes of establishing accountability. It also helps in identifying remedial actions to correct an improper activity. The Audit Log is implemented in the Prime Optical database, where each record has a time stamp, record type, and message string.

Note See Managing Security for a list of runtime-affecting operations that the Audit Log records for monitoring purposes.