Purpose

Cisco Control Center enables you do these tasks:

• Manage subscriber data, that is, find or create and edit information about your subscribers.

• View subscriber sessions.

• View system sessions.

• Populate custom reference data (CRD) tables.

URL and Port

HA: https://<lbvip01>:443

AIO: http://<ip>:8090

Protocol

HTTPS/HTTP

Accounts and Roles

There are two levels of administrative roles supported for Control Center: Full Privilege and View Only. The logins and passwords for these two roles are configurable in LDAP or in /etc/broadhop/authentication-password.xml.

• Full Privilege Admin Users: These users can view, edit, and delete information and can perform all tasks. Admin users have access to all screens in Control Center.

• View Only Admin Users: These users can view information in Control Center, but cannot edit or change information. View only administrators have access to a subset of screens in the interface.

Purpose

The Custom Reference Data (CRD) REST API enables the query of, creation, deletion, and update of CRD table data without the need to access the Control Center GUI. The CRD APIs are available using an HTTP REST interface. The specific APIs are outlined in a later section in this guide.

URL and Port

HA: https:// <lbvip01>:443/custrefdata

AIO: http://<ip>:8080/custrefdata

A validation URL is:

HA: https:// <lbvip01>:8443/custrefdata

AIO: http://<ip>:8080/custrefdata

Protocol

HTTPS/HTTP

Accounts and Roles

Security and account management is accomplished by using the haproxy mechanism on the platform Policy Director (LB) by defining user lists, user groups, and specific users.

On Cluster Manager: /etc/puppet/modules/qps/templates/etc/haproxy/haproxy.cfg

Configure HAProxy

HAProxy Configuration Example

userlist cps_user_list
        group qns-ro users readonly
        group qns users apiuser
      user readonly password 
$6$xRtThhVpS0w4lOoS$pyEM6VYpVaUAxO0Pjb61Z5eZrmeAUUdCMF7D75B

XKbs4dhNCbXjgChVE0ckfLDp4T2CsUzzNkoqLRdn7RbAAU1
      user apiuser password
$6$xRtThhVpS0w4lOoS$pyEM6VYpVaUAxO0Pjb61Z5eZrmeAUUdCMF7D75B

XKbs4dhNCbXjgChVE0ckfLDp4T2CsUzzNkoqLRdn7RbAAU1
frontend https-api
   description API
   bind lbvip01:8443 ssl crt /etc/ssl/certs/quantum.pem

   mode http
   acl crd_api path_beg -i /custrefdata/
   use_backend crd_api_servers if crd_api
   
   default_backend api_servers
   reqadd X-Forwarded-Proto:\ https if { ssl_fc }
   
frontend https_all_servers
description Unified API,CC,PB,Grafana,CRD-API,PB-AP
bind lbvip01:443 ssl crt /etc/ssl/certs/quantum.pem no-sslv3 no-tlsv10
ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!
aNULL:!eNULL:!LOW:!     3DES:!MD5:!EXP:!PSK:!SRP:!DSS
mode http
acl crd_api path_beg -i  /custrefdata/
use_backend crd_api_servers if crd_api
backend crd_api_servers
        mode http
        balance roundrobin
        option httpclose
        option abortonclose
        server qns01_A qns01:8080 check inter 30s
        server qns02_A qns02:8080 check inter 30s
        acl authoriseReadonlyUsers http_auth_group(cps_user_list) qns-ro
        acl authoriseAdminUsers http_auth_group(cps_user_list) qns
        http-request auth realm CiscoApiAuth if !authoriseReadonlyUsers !authoriseAdminUsers
        http-request deny if !METH_GET authoriseReadonlyUsers

Note	The haproxy.cfg file is generated by the puppet tool. Any manual changes to the file in lb01/lb02 would be reverted if the pupdate or vm-init scripts are run.

Purpose

Grafana is a metrics dashboard and graph editor used to display graphical representations of system, application KPIs, bulkstats of various CPS components.

URL and Port

HA: https://<lbvip01>:9443/grafana

AIO: http://<ip>:443/grafana

Protocol

HTTPS/HTTP

Accounts and Roles

In CPS 7.5 and higher, at least one Grafana user account must be created to access the Grafana web interface.

In CPS 8.1 and higher, an administrative user account must be used to add, modify, or delete Grafana dashboards or perform other administrative actions.

Refer to the Graphite and Grafana chapter in this guide for details on adding or deleting these user accounts.

Purpose

Haproxy is a frontend IP traffic proxy process in lb01/lb02 that routes the IP traffic for other applications in CPS. The details of individual port that haproxy forwards is already described in other individual sections.

More information about HAProxy is provided in the HAProxy.

Documentation for HAProxy is available at: http:/​/​www.haproxy.org/​#docs

URL and Port

To view HAProxy statistics, open a browser and navigate to the following URL:

http://<lbvip01>:5540/haproxy?stats

Accounts and Roles

Not applicable.

Purpose

Java Management Extension (JMX) interface can be used for managing and monitoring applications and system objects.

Resources to be managed / monitored are represented by objects called managed beans (mbeans). MBean represents a resource running in JVM and external applications can interact with mbeans through the use of JMX connectors and protocol adapters for collecting statistics (pull); for getting/setting application configurations (push/pull); and notifying events like faults or state changes (push).

CLI Access

External applications can be configured to monitor application over JMX. In addition to this, there are scripts provided by application that connects to application over JMX and provide required statistics/information.

Port

pcrfclient01/pcrfclient02:

• Control Center: 9045

• Policy Builder: 9046

lb01/lb02:

• iomanager: 9045

• Diameter Endpoints: 9046, 9047, 9048...

qns01/qns02/qns... : 9045

Ports should be blocked using firewall to prevent access from outside the CPS system.

Accounts and Roles

Not applicable.

Purpose

Logstash is a process that consolidates the log events from CPS nodes into pcrfclient01/pcrfclient02 for logging and alarms. The logs are forwarded to CPS application to raise necessary alarms.

CLI Access

There is no specific CLI interface for logstash.

Protocol

TCP and UDP

Ports

TCP: 5544, 5545, 7546, 6514

UDP: 6514

Accounts and Roles

Account and role management is not applicable.

Purpose

MongoDB is used to manage session storage efficiently and address key requirements: Low latency reads/writes, high availability, multi key access etc.

CPS support different models of mongo database based on CPS deployment like AIO, HA or Geo-redundancy. Not all of the databases listed below may be used in your CPS deployment.

To rotate the mongoDB logs on the Session Manager VM, open the mongoDB file by executing the following command:

cat /etc/logrotate.d/mongodb

You will have output as similar to the following:

{
daily
rotate 5
copytruncate
create 640 root root
sharedscripts
postrotate
endscript
}

In the above script the mongoDB logs are rotated daily and it ensures that it keeps the latest 5 backups of these log files.

The standard definition for supported replica-set defined in configuration file. This configuration file is self-explanatory which contain replica set set-name, hostname, port number, data file path and so on.

Location: /etc/broadhop/mongoConfig.cfg

Note	The port number configuration is based on what is configured in each of the respective Policy Builder plug-ins. Refer to the Plug-in Configuration chapter of the CPS Mobile Configuration Guide for correct port number and ports defined in mongo configuration file.

The All-in-One deployment mongo database runs on ports 27017 and 27729.

CLI Access

Use the following commands to access the MongoDB CLI:

HA:

Login to pcrfclient01 or pcrfclient02 and run: diagnostics.sh --get_replica_status

This command will output information about the databases configured in the CPS cluster.

AIO:

Protocol

Not applicable.

Port

Not applicable.

Accounts and Roles

Restrict MongoDB Access for Readonly Users: If firewall is enabled on system, then on all VMs for all readonly users, IP table rule will be created for outgoing connections to reject outgoing traffic to mongoDB replica sets.

For example, rule similar to the following will be created.

REJECT tcp -- anywhere sessionmgr01 tcp dpt:27718 owner GID match qns-ro reject-with icmp-port-unreachable

With this qns-ro user will have restricted mongoDB access on sessionmgr01 on port 27718. Such rules will be added for all readonly users who are part of qns-ro group for all replia sets.

Purpose

CPS is based on Open Service Gateway initiative (OSGi) and OSGi console is a command-line shell which can be used for analyzing problems at OSGi layer of the application.

CLI Access

Use the following command to access the OSGi console:

telnet <ip> <port>

The following commands can be executed on the OSGi console:

ss : List installed bundle status.

start <bundle-id> : Start the bundle.

stop <bundle-id> : Stop the bundle.

diag <bundle-id> : Diagnose the bundle.

Ports

pcrfclientXX:

• Control Center: 9091

• Policy Builder: 9092

lbXX:

• iomanager: 9091

• Diameter Endpoints: 9092, 9093, 9094 ...

qnsXX: 9091

Ports should be blocked using a firewall to prevent access from outside the CPS cluster.

Accounts and Roles

Not applicable.

Purpose

Policy Builder is the web-based client interface for the configuration of policies in Cisco Policy Suite.

URL and Port

HA: https://<lbvip01>:7443/pb

AIO: http://<ip>:7070/pb

Protocol

HTTPS/HTTP

Accounts and Roles

Initial accounts are created during the software installation. Refer to the CPS Operations Guide for commands to add users and change passwords.

Purpose

To allow initial investigation into a Proof of Concept API for managing a CPS System and Custom Reference Data related through an HTTPS accessible JSON API.

CLI Access

This is an HTTPS/Web interface and has no Command Line Interface.

URL and Port

API: http://<Cluster Manager IP>:8458

Documentation: http://<Cluster Manager IP>:7070/doc/index.html

Accounts and Roles

Initial accounts are created during the software installation. Refer to the CPS Operations Guide for commands to add users and change passwords.

Purpose

Enhanced log processing is provided using Rsyslog.

Rsyslog logs Operating System (OS) data locally (/var/log/messages etc.) using the /etc/rsyslog.conf and /etc/rsyslog.d/*conf configuration files.

rsyslog outputs all WARN level logs on CPS VMs to /var/log/warn.log file.

On all nodes, Rsyslog forwards the OS system log data to lbvip02 via UDP over the port defined in the logback_syslog_daemon_port variable as set in the CPS deployment template (Excel spreadsheet). To download the most current CPS Deployment Template (/var/qps/install/current/scripts/deployer/templates/QPS_deployment_config_template.xlsm), refer to the CPS Installation Guide for VMware or CPS Release Notes for this release.

Additional information is available in the Logging chapter of the CPS Troubleshooting Guide. Refer also to http:/​/​www.rsyslog.com/​doc/​ for the Rsyslog documentation.

CLI Access

Not applicable.

Protocol

UDP

Port

6514

Accounts and Roles

Account and role management is not applicable.

Apache™ Subversion (SVN) is the versioning and revision control system used within CPS. It maintains all the CPS policy configurations and has repositories in which files can be created, updated and deleted. SVN maintains the file difference each time any change is made to a file on the server and for each change it generates a revision number.

In general, most interactions with SVN are performed via Policy Builder.

CLI Access

Use the following commands to access SVN:

Get all files from the server:

svn checkout --username <username> --password <password> <SVN Repository URL> <Local Path>

Example:

svn checkout --username broadhop --password broadhop http://pcrfclient01/repos/configuration/root/configuration

If <Local Path> is not provided, files are checked out to the current directory.

Store/check-in the changed files to the server:

svn commit --username <username> --password <password> <Local Path> -m “modified config”

Example:

svn commit --username broadhop --password broadhop /root/configuration -m “modified config”

Update local copy to latest from SVN:

svn update <Local Path>

Example:

svn update /root/configuration/

Check current revision of files:

svn info <Local Path>

Example:

svn info /root/configuration/

Note	Use svn --help for a list of other commands.

Protocol

HTTP

Port

80

Accounts and Roles

Purpose

CPS 7.0 and above has been designed to leverage the Terminal Access Controller Access Control System Plus (TACACS+) to facilitate centralized management of users. Leveraging TACACS+, the system is able to provide system-wide authentication, authorization, and accounting (AAA) for the CPS system.

Further the system allows users to gain different entitlements based on user role. These can be centrally managed based on the attribute-value pairs (AVP) returned on TACACS+ authorization queries.

CLI Access

No CLI is provided.

Port

CPS communicates to the AAA backend using IP address/port combinations configured by the operator.

Account Management

Configuration is managed by the Cluster Management VM which deploys the '/etc/tacplus.conf' and various PAM configuration files to the application VMs.

To provide sufficient information for the Linux-based operating system running on the VM nodes, there are several attribute-value pairs (AVP) that must be associated with the user on the ACS server used by the deployment. User records on Unix-like systems need to have a valid “passwd” record for the system to operate correctly. Several of these fields can be inferred during the time of user authentication, but the remaining fields must be provided by the ACS server.

A standard “passwd” entry on a Unix-like system takes the following form:

<username>:<password>:<uid>:<gid>:<gecos>:<home>:<shell>

When authenticating the user via TACACS+, the software can assume values for the 'username', password' and 'gecos' fields, but the others must be provided by the ACS server. To facilitate this need, the system depends on the ACS server provided these AVP when responding to a TACACS+ Authorization query for a given 'username':

uid

A unique integer value greater than or equal to 501 that serves as the numeric user identifier for the TACACS+ authenticated user on the VM nodes. It is outside the scope of the CPS software to ensure uniqueness of these values.

gid

The group identifier of the TACACS+ authenticated user on the VM nodes. This value should reflect the role assigned to a given user, based on the following values:

• gid=501 (qns-su)

  This group identifier should be used for users that are entitled to attain super-user (or 'root') access on the CPS VM nodes.

• gid=504 (qns-admin)

  This group identifier should be used for users that are entitled to perform administrative maintenance on the CPS VM nodes.

  Note	For stopping/starting Policy Server (QNS) process on node, qns-admin user should use monit: sudo monit stop qns-1 sudo monit start qns-1

• gid=505 (qns-ro)

  This group identifier should be used for users that are entitled to read-only access to the CPS VM nodes.

home

The user's home directory on the CPS VM nodes. To enable simpler management of these systems, the users should be configured with a pre-deployed shared home directory based on the role they are assigned with the gid.

• home=/home/qns-su should be used for users in the 'qns-su' group (gid=501)

• home=/home/qns-admin should be used for users in the 'qnsadmin' group (gid=504)

• home=/home/qns-su should be used for users in the 'qns-ro' group (gid=505)

shell

The system-level login shell of the user. This can be any of the installed shells on the CPS VM nodes, which can be determined by reviewing the contents of /etc/shells on one of the CPS VM nodes.

Typically, this set of shells is available in a CPS deployment:

• /bin/sh

• /bin/bash

• /sbin/nologin

• /bin/dash

• /usr/bin/sudosh

The /usr/bin/sudosh shell can be used to audit user's activity on the system.

Role Management

gid

The group identifier of the TACACS+ authenticated user on the VM nodes. This value should reflect the role assigned to a given user, based on the following values:

• gid=501 (qns-su)

  This group identifier should be used for users that are entitled to attain super-user (or 'root') access on the CPS VM nodes.

• gid=504 (qns-admin)

  This group identifier should be used for users that are entitled to perform administrative maintenance on the CPS VM nodes.

  Note	To execute administrative scripts from qns-admin, prefix the command with sudo. For example sudo stopall.sh

• gid=505 (qns-ro)

  This group identifier should be used for users that are entitled to read-only access to the CPS VM nodes.

home

The user's home directory on the CPS VM nodes. To enable simpler management of these systems, the users should be configured with a pre-deployed shared home directory based on the role they are assigned with the gid.

• home=/home/qns-su should be used for users in the 'qns-su' group (gid=501)

• home=/home/qns-admin should be used for users in the 'qnsadmin' group (gid=504)

• home=/home/qns-su should be used for users in the 'qns-ro' group (gid=505)

For more information about TACACS+, refer to the following links:

• TACAC+ Protocol Draft: http:/​/​tools.ietf.org/​html/​draft-grant-tacacs-02

• Portions of the solution reuse software from the open source pam_tacplus project hosted at: https:/​/​github.com/​jeroennijhof/​pam_​tacplus

Purpose

Unified APIs are used to reference customer data table values.

URL and Port

HA: https://<lbvip01>:8443/ua/soap

AIO: http://<ip>:8080/ua/soap

Protocol

HTTPS/HTTP

Accounts and Roles

Currently there is no authorization for this API

The user can revert the configuration if changes since the last publish/save to client repository are not wanted.

This can also be necessary in the case of a ‘syn conflict’ error where both pcrfclient01 and pcrfclient02 are in use at the same time by different users and publish/save to client repository changes to the same file. The effect of reverting changes is that all changes since the publish/save to client repository will be undone.

This section describes updating Control Center mapping of read-write/read-only to user groups (Default: qns and qns-ro respectively).

HAProxy is used to secure and balance calls to the CPS Unified API.