Repository Management

Table Of Contents

Repository Management

Backup from the Command Line

Description

Syntax

Recovery from the Command Line

Description

Syntax

Restore from the Command Line

Description

Syntax

Backup from Third Party Backup Program

Description

Syntax

Access Permission to Repository Management Tools

Description

How to Define the Access Permission File

Syntax of the Access Permission File

Example of Access Permission File

Repository Import Tool

Description

Prerequisites

Syntax

Repository Export Tool

Description

Prerequisites

Syntax

Repository Management

---

Repository management tools are handled through any Web browser, as shown in "VPN Console: File Menu." Additionally, you can do the following:

•Run dbBackup from the command line to back up your repository, as shown in the "Backup from the Command Line" section.

•Run recovertool from the command line to recover events recorded in a journal file to re-create a Repository, as shown in the "Recovery from the Command Line" section.

•Run dbRestore from the command line to restore your repository, as shown in the "Restore from the Command Line" section

•Back up a repository using a third party backup program, as shown in the "Backup from Third Party Backup Program" section.

•Grant access permission to the Repository Management tools, as shown in the "Access Permission to Repository Management Tools" section.

•Populate the VpnInventory Repository by reading information from a file, as shown in the "Repository Import Tool" section.

•Export the entire Repository into a flat file, as shown in the "Repository Export Tool" section.

Backup from the Command Line

This section provides the description and syntax for the dbBackup command that can be run from the command line to back up a repository.

Description

The dbBackup command backs up a repository from the command line. You can run dbBackup from $ECSP_HOME/bin/solaris.

Syntax

dbBackup -db <dbpath> [-dest <destDir>] [-tar|-compress] [-v] [-p <progname>] [-help]

where:

-db <dbpath> is the path to the repository you wish to back up.

-dest <destDir> is the existing destination directory into which to place the backed up repository. If this parameter is not specified, the default destination directory is /tmp.

-tar indicates to tar the backed up repository into the existing destination directory.

-compress indicates to tar and compress the backed up repository into the existing destination directory.

-v indicates to supply verbose log output.

-p <progname> indicates to use <progname> to do the database backup.

-help indicates to print this message.

Recovery from the Command Line

This section provides the description and syntax for the recovertool command that can be run from the command line to recover a repository.

Description

The recovertool command can be run from the command line to play back events recorded in a journal file to re-create a repository. You can run recovertool from $ECSP_HOME/bin/solaris.

Syntax

execjava.sh netsys.repository.journal.recovertool.Main <journal_dir> <rep_dir>

where:

<journal_dir> is the path to the directory containing the journal files dir.jnl and vi.jnl.

<rep_dir> is the destination directory (complete path) that contains the Repository on which the journal files are to be played back.

Restore from the Command Line

This section provides the description and syntax for the dbRestore command that can be run from the command line to restore a repository.

Description

The dbRestore command restores a repository from the command line. You can run dbRestore from $ECSP_HOME/bin/solaris.

Syntax

dbRestore <backupfile> -dest <destDir> [-c] [-v] [-help]

where:

<backupfile> is the path to the backup file or directory you wish to restore from.

-dest <destDir> is the destination directory (complete path) into which to place the restored repository.

-c indicates to create the destination directory, as specified, if it does not exist.

-v indicates to supply verbose log output.

-help indicates to print this message.

Backup from Third Party Backup Program

This section provides the description and syntax for the dbBackup command that can back up a repository using a third party backup program that is running with the same user ID as the VPN software.

Description

The dbBackup command backs up a repository using a third party backup program. You can run dbBackup from $ECSP_HOME/bin/solaris.

When you execute the dbBackup command, it automatically does the following:

1. Locks the repository

2. Executes your backup program

3. Unlocks the repository.

Syntax

dbBackup -db <dbpath> -p "<progname -parameters>"

where:

-db <dbpath> is the path to the repository you wish to back up.

-p "<progname -parameters>" is the backup program name and all its parameters.

Access Permission to Repository Management Tools

This section includes the following categories:

•Description

•How to Define the Access Permission File

•Syntax of the Access Permission File

•Example of Access Permission File

Description

This feature allows you to specify which machines have access permission to the Repository Management tools. Without an access permission file, every machine has permission to use the Repository Management tools.

How to Define the Access Permission File

In $ECSP_HOME/etc, create a file called SecureAccess.id. For example:

$ECSP_HOME/etc/SecureAccess.id

Within this file, define the machines to which you want to permit and deny access permission, as specified in the section "Syntax of the Access Permission File." Then restart the httpd server by issuing the following command: wdclient restart httpd.

Syntax of the Access Permission File

{permit | deny} {<IPaddress> | <MachineName> | <SubnetAddress>}

where:

You must choose one of the following two arguments:

permit gives access permission to the Repository Management tools.

deny denies access permission to the Repository Management tools.

You must choose one of the following three arguments:

<IPaddress> is the IP address of the machine.

<MachineName> is the name of the machine.

<SubnetAddress> is the address of the subnet of multiple machines.

Example of Access Permission File

The following example of an access permission file, SecureAccess.id, gives permission to the machine with the IP address 171.71.227.170 and the machine with the name machine1.company1.com to use the Repository Management tools. This example also denies permission to the machine with the name machine2.company1.com and the machines in the subnet 171.71.227.0/24 to use the Repository Management tools.

# start of the id file
#
#
#
# end of the comment block

permit 171.71.227.170
permit machine1.company1.com
deny machine2.company1.com
deny 171.71.227.0/24

# end of the id file

#

Repository Import Tool

This section provides the description, prerequisites, and syntax for the Repository import tool, the VpnInvImport command. This tool can be run either on the server that runs VPNSC or on a remote machine.

---

Warning You must install the Repository Import/Repository Export license before using this tool. To get this license, send an e-mail to the following address, requesting this license: csg-license@cisco.com.

Then refer to the "License Administration" section to add this license.

---

Description

The VpnInvImport command enables you to populate the VpnInventory Repository by reading information from a file.

The file /tmp/VpnInvImport.log contains information about each element that was created. In addition, this tool writes output information to stdout for the Inventory Elements that are created as well as the elements that already exist. If an error occurs while populating the Repository, the program exits and a message is printed to stderr.

---

Note This tool cannot be used to modify an existing Repository. It can only be used to populate an empty Repository or add elements to an existing Repository. This tool populates the Repository currently being used by MPLS VPN Solution.

---

---

Note The Port Reservation Group (PRG) can not be imported.

---

Prerequisites

Be sure that the following steps are taken before implementing either of the commands listed in the "Syntax" section:

---

Step 1 Be sure the MPLS VPN Solution watchdog has been started.

Step 2 In the $ECSP_HOME directory, source as follows.

For csh users, enter:

source vpnenv.csh

For sh and ksh users, enter:

. ./vpnenv.sh

---

Note Perform Step 3 and Step 4 when running MPLS VPN Solution as a user other than the VPNSC owner.

---

Step 3 If you choose to run the tool on a remote machine rather than on the same server that runs VPNSC, be sure the Naming Server (NS) and the VpnInvServer running on the VPNSC server have their permissions set correctly. For example: to allow a user (<username>) to run this tool on a remote machine, enter the following commands on the VPNSC server:

chmodit NS i+<username>

chmodit VpnInvServer i+<username>

---

Note The lowercase letter "i" indicates to invoke.

---

Step 4 If the environment variable IT_DAEMON_PORT is not already set, enter the following command:

setenv IT_DAEMON_PORT 1570

---

Syntax

Be sure you have implemented the prerequisites, as specified in the "Prerequisites" section, before implementing either of the following commands:

VpnInvImport -xml <filename> [-u <username>] [-p <password>] [-f <password_file>] [<hostname>]

where:

-xml indicates to read from an XML formatted file.

---

Note If the format of the input file, the Document Type Definition, is not known, run the VpnInvExport tool explained in the "Repository Export Tool" section. All values are case sensitive. Therefore, be sure the Boolean variables are all specified in lowercase. Also be sure that the character & is replaced by &amp; before using XML import format. This is required because the character & has a special meaning in XML.

---

<filename> is the name of the file from which to read data.

-u <username> is the name of the valid user on VPNSC. If this optional parameter is not specified, the default for the valid user name is admin.

-p <password> is the password for the valid user specified by the -u option above or the password for the default user admin. If this optional parameter is not specified, the default for the password is admin.

-f <password_file> is the file during VPNSC installation against which the <username> and <password>, specified above, will be validated. If this optional parameter is not specified, the default for the password_file is the password_file created during VPNSC installation.

<hostname> is the name of the host where the Naming Server is running, for example: abc.efgh.com, where abc is the machine name. When this optional parameter is not specified, the default is localhost.

or

VpnInvImport -h|help

where:

-h and help (case insensitive) request help text about the VpnInvImport command.

Repository Export Tool

This section provides the description, prerequisites, and syntax for the Repository export tool, the VpnInvExport command. This tool can be run either on the server that runs VPNSC or on a remote machine.

---

Warning You must install the Repository Import/Repository Export license before using this tool. To get this license, send an e-mail to the following address, requesting this license: csg-license@cisco.com.

Then refer to the "License Administration" section to add this license.

---

Description

The VpnInvExport command allows the entire VPNSC Repository to be exported into a flat file. With this Repository Export tool, you can get output of the VpnInventory Repository in text format.

---

Note The Port Reservation Group (PRG) can not be exported.

---

Prerequisites

Be sure that the following steps are taken before implementing either of the commands listed in the "Syntax" section:

---

Step 1 Be sure the MPLS VPN Solution watchdog has been started.

Step 2 In the $ECSP_HOME directory, source as follows.

For csh users, enter:

source vpnenv.csh

For sh and ksh users, enter:

. ./vpnenv.sh

---

Note Perform Step 3 and Step 4 when running MPLS VPN Solution as a user other than the VPNSC owner.

---

Step 3 If you choose to run the tool on a remote machine rather than on the same server that runs VPNSC, be sure the Naming Server (NS) and the VpnInvServer running on the VPNSC server have their permissions set correctly. For example: to allow a user (<username>) to invoke this tool on a remote machine, enter the following commands on the VPNSC server:

chmodit NS i+<username>

chmodit VpnInvServer i+<username>

---

Note The lowercase letter "i" indicates to invoke.

---

Step 4 If the environment variable IT_DAEMON_PORT is not already set, enter the following command:

setenv IT_DAEMON_PORT 1570

---

Syntax

Be sure you have implemented the prerequisites, as specified in the "Prerequisites" section, before implementing either of the following commands:

VpnInvExport -xml <filename> [-u <username>] [-p <password>] [-f <password_file>] [<hostname>]

where:

-xml indicates to dump the VPNSC Repository into a flat file in XML format. The Document Type Definition (DTD) is part of the output in the XML document.

<filename> is the name of the file to which to dump the Repository.

-u <username> is the name of the valid user on VPNSC. If this optional parameter is not specified, the default for the valid user name is admin.

-p <password> is the password for the valid user specified by the -u option above or the password for the default user admin. If this optional parameter is not specified, the default for the password is admin.

-f <password_file> is the file during VPNSC installation against which the <username> and <password>, specified above, will be validated. If this optional parameter is not specified, the default for the password_file is the password_file created during VPNSC installation.

<hostname> is the name of the host where the Naming Server is running, for example: abc.efgh.com, where abc is the machine name. When this optional parameter is not specified, the default is localhost.

or

VpnInvExport -h|help

where:

-h and -help requests help text about the VpnInvExport command.