Table Of Contents
Quick Start Guide for CiscoWorks Network Compliance Manager, 1.2.1
NCM and LMS Co-residency Requirements
NCM High Availability System Requirements
Before Installing on a Linux Server
Before Installing on a Solaris Server
Before Installing on a Windows Server
SQL Server 2005 Install: Insufficient Password Length Causes Install to Fail
Installer Leaves Database Passwords in Plain Text File After Installation
Using more than One Dollar Sign ($) Character in any Input Causes the Installer to Fail
Linux Install: NCM Shuts Down the Syslog Daemon and Renames syslog.conf
The Default NCM Return Email Address is Invalid
NCM can not Use Integrated TFTP Server or Syslog Server After Installation
Detect Network Devices Task Reports Errors After Driver Pack Install
NCM Might Set Incorrect IP Address when Installed on a Server with Multiple NICs
NCM Client-only Install does not set NCM Server IP Address
Installing the MySQL Service on a Drive other than C:\ Might Cause the MySQL Service not to Start
Licensing Your Product During Installation
Installing the NCM License File
Installing the NCM License with the NCM Software
Installing the NCM License After Installing the NCM Software
Licensing High Availability Distributed Systems
Adding a Device Using the New Device Wizard
Device Unresponsive/Bad IP Address
Taking a Snapshot of a Device's Current Configuration
Reviewing Device Configuration
Integrating NCM with CiscoWorks
Registering the CiscoWorks LMS Server with NCM
Registering the NCM Server with CiscoWorks LMS
Exporting LMS Devices Using the LMS GUI
Exporting LMS Devices Using a Script
Importing Devices to the NCM Server
Upgrading from NCM 1.2 to NCM 1.2.1
Critical Settings and Important Files that are not Restored after NCM Upgrade
Installing the Latest Driver Pack
NCM Upgrade Leaves Database Passwords in Plain Text File
Upgrade on Linux: NCM Shuts Down the Syslog Daemon and Renames syslog.conf
Upgrade on Windows: NCM Upgrade Program Requests an Unnecessary Server Reboot
Upgrade Could Take a Long Time, Depending on the Size of Your NCM Database
Installing the MySQL Service on a Drive other than C:\ Might Cause the MySQL Service not to Start
Administrative Settings - User Authentication Page Crypto Key Exception
Stopping the NCM Management Engine
Backing Up and Restoring the NCM Database
SQL Server Backup and Restore Instructions
MySQL Backup and Restore Instructions
Oracle Backup and Restore Instructions
Device Software Image and NCM Files Backup
Installing NCM 1.2.1 Using MySQL
Installing NCM 1.2.1 Using SQL Server 2000
Installing NCM 1.2.1 Using Oracle Enterprise 9.2.0.1
Obtaining Documentation, Obtaining Support, and Security Guidelines
Quick Start Guide
Quick Start Guide for CiscoWorks Network Compliance Manager, 1.2.1
Text Part Number: OL-10194-04
1 Getting Started
CiscoWorks Network Compliance Manager (NCM), Release 1.2.1 provides network configuration and change features, policy-based workflows, compliance reporting capabilities, and APIs. NCM includes integration with CiscoWorks—you can start NCM from the CiscoWorks HomePage window and it works with other CiscoWorks applications such as the LMS bundle through the CommonServices Device Credential Repository (DCR).
This guide provides information on:
•
Installing NCM on either a Windows, Linux, or Solaris server
•
•
•
•
•
•
•
For complete information on how to use NCM, see the User Guide for Network Compliance Manager, 1.2.1.
Note
In addition, the Docs tab visible from within Network Compliance Manager might not include links to the latest documents.
2 System Requirements
This section includes the following:
•
•
Protocols and Ports
NCM communicates with devices using a combination of the following protocols and ports as described in Table 1. If you use a given protocol, NCM requires access to the corresponding port. Specifically, if NCM communicates with devices protected by firewalls, these ports need to be opened.
Linux Server Requirements
The following tables provide the recommended requirements when installing NCM on a Linux platform. Keep in mind that the application server and the database server can be configured together or separately depending on the size of the network.
Note
Note
Summary Reports
Summary reports are generated in the Microsoft Excel XLS format. Excel does not run on Linux. You can either run the Summary reports from a Windows client computer connected to your NCM server or you can use one of the following products that run on Linux and can open Excel files:
•
•
•
Solaris Server Requirements
The following tables provide the recommended requirements when installing NCM on a Solaris platform. Keep in mind that the application server and the database server can be configured together or separately depending on the size of the network.
Note
Note
Summary Reports
Summary reports are generated in the Microsoft Excel XLS format. Excel does not run on Solaris. You can either run the Summary reports from a Windows client computer connected to your NCM server or you can use one of the following products that run on Linux and can open Excel files:
•
•
•
Windows Server Requirements
The following tables provide the recommended requirements when installing NCM on a Windows platform. Keep in mind that the application server and the database server can be configured together or separately depending on the size of the network.
Note
Note
NCM and LMS Co-residency Requirements
The following are the recommended requirements when you are enabling co-residency of NCM and CiscoWorks LAN Management Solution (LMS):
•
•
For detailed information on NCM and LMS co-residency, see the Getting Started Guide for Network Compliance Manager and LMS Co-residency.
NCM High Availability System Requirements
The NCM High Availability Distributed System is a multi master system where the data from each NCM Core is available to all other NCM Cores. This collection of NCM Cores is called an NCM mesh. This configuration helps provides a comprehensive view of your data and allows for redundant data and failover in the event of a problem with the NCM Core. Each NCM Core consists of an NCM Management Engine, its associated services (Syslog and TFTP), and a single database.
Note
NCM Gateway Requirements
The Network Compliance Manager Gateway enables a NCM Core to manage servers that are behind one or more NAT devices or firewalls. The NCM Gateway is supported on the following platforms:
•
•
•
•
•
3 Installing NCM
Make sure you have the requisite equipment and files before installing NCM:
•
•
•
•
Note
Note
http://www.cisco.com/cgi-bin/tablebuild.pl/cwncm-crypto
Before Installing on a Linux Server
If you are installing NCM on a Linux server, enter the following commands to mount a DVD drive. You must login as root.
Step 1
Step 2
Step 3
Step 4
The Introduction window appears.
Before Installing on a Solaris Server
If you are installing NCM on a Solaris server, do the following:
Step 1
Step 2
Step 3
Step 4
The Introduction window appears.
Before Installing on a Windows Server
If you are installing NCM on a Windows server, do the following:
Step 1
The InstallAnywhere Self Extractor opens and the Introduction window displays.
Installation Procedures
The following steps guide you through the installation process.
Step 1
The System Requirements window appears.
Step 2
The License Agreement window appears.
Step 3
The Choose Install Set window appears.
Step 4
•
•
•
•
•
Keep in mind that if you are using an existing database server, you will be prompted for the database server's hostname, port and the username and password to create a new database.
Note
Note
Step 5
Step 6
Step 7
The MySQL database must be 3.23.55-MAX, with InnoDB type. Click Next.
Note
If you want to install Oracle, click the Oracle option and click Next. If you already have an Oracle database installed, click the Use existing Oracle Database option and click Next.
Step 8
The Choose Install Folder window appears.
Step 9
If you are installing on a Linux or Solaris server, change to the directory where you want to install NCM, for example: /usr/local/rendition.
The Database Settings window appears.
Step 10
Note
The Configure Email window appears.
Step 11
The Configure ACL Parsing window appears.
Step 12
Note
The Choose Shortcut Folder window appears.
Step 13
The Pre-Installation Summary window appears.
Step 14
The Database Admin Login window appears.
Step 15
•
•
•
•
Note: This panel does not appear if you are installing MySQL or are doing a client-only install.
The Configure Database window appears.
Step 16
The New Database/Existing Database window appears.
Step 17
If you uncheck the Create NCM user with this username and password check box, you are prompted to enter a username and password for the NCM administrator. If the check box is checked (the default), the username and password you entered for the database is used for the NCM administrator's username and password.
Note
If you are using an existing database, the name provided is not the name of the database to create, but the name of the existing database.
The Confirm Database Settings window appears.
Step 18
The Configure Admin window appears.
Step 19
The Install Complete window appears.
Step 20
4 NCM Install Issues
You may encounter the following issues when installing NCM 1.2.1. Where possible, workarounds have been provided.
SQL Server 2005 Install: Insufficient Password Length Causes Install to Fail
When installing NCM using a SQL Server 2005 database, you are prompted for the username and password NCM uses to connect to the database. If you enter a password that is not complicated enough for the existing Windows security policy, SQL Server 2005 discards the password and the NCM installation fails. A sample error message is: The password does not meet Windows policy requirements because it is too short.
Workaround: Enter a complex password that includes both lowercase and uppercase letters, several digits, and perhaps a special character. For example: PvyJ319?&
SQL Server 2005 Install: Install Fails Unless a Local SQL Server Admin Account is Used to Connect to the Server
The NCM Installer requires local SQL Server authentication to connect to the database server. It cannot authenticate to an SQL Server 2005 using a Domain account with Local Administrator privileges. You must have a local administrator account on the machine running MS SQL 2005 or the connection to SQL Server will fail, as will the NCM install.
Installer Leaves Database Passwords in Plain Text File After Installation
The NCM installer leaves database passwords in a plain text file after installation.
Workaround: Open the $NCM_HOME/UninstallerData/installvariables.properties file and search for the string: PASSWORD. Set the plain text password to a blank string where present and then save the file. For example, for INPUT_PASSWORD=root, set to INPUT_PASSWORD=.
Using more than One Dollar Sign ($) Character in any Input Causes the Installer to Fail
When installing NCM, ensure that any entered values including password inputs do not contain more than one dollar sign ($) character. The NCM installer treats input text containing an even number of dollar sign ($) characters as an empty variable. As a result, entered values are parsed incorrectly. For example, if your NCM database password is $Net$work, the NCM installer parses `work' as the password and fails to connect to the database. Note: This issue is not limited to password fields or a specific database.
Workaround: Do not use more than one dollar sign ($) character in any input.
Linux Install: NCM Shuts Down the Syslog Daemon and Renames syslog.conf
When installing NCM on a Linux server, the NCM Installer renames the /etc/syslog.conf file to syslog.conf.rm and stops the Syslog daemon. This might interfere with general log management on the Linux server.
Workaround: After the NCM install is complete, rename the /etc/syslog.conf.rm file to syslog.conf and restart the Syslog daemon.
The Default NCM Return Email Address is Invalid
When NCM is installed, NCM sets the return email address to nobody@localhost. This is an invalid email address on many mail servers and might cause bounced messages to fill up the mail queues. Because NCM is configured by default to send email notifications once installed, it is recommended that you change the return NCM email address to a valid email address immediately after the NCM install is complete. To do this:
1.
2.
3.
4.
NCM can not Use Integrated TFTP Server or Syslog Server After Installation
If the /etc/hosts file on a Unix or Linux server is not configured properly prior to installing NCM, the IP address of the TFTP Server and/or Syslog Server used by NCM might not be set correctly.
Workaround: Either enter the NCM hostname and IP address into the /etc/hosts file before you install NCM, or after installing NCM:
1.
2.
Detect Network Devices Task Reports Errors After Driver Pack Install
When installing NCM on a Solaris or Linux platform, the nmap-os-fingerprints file is in DOS format. Consequently, there is an extra ^M (carriage return) character at the end of each line. As a result, Nmap and NCM report errors.
Workaround: For Solaris, manually run dos2unix on this file.
When installing NCM on Solaris or Linux platform, the version of Nmap distributed with NCM 1.2 (Nmap 3.81) is required for Nmap scanning when running the Detect Network Devices task. (Refer to Chapter 1 in the User Guide Network Compliance Manager 1.2.1 for Nmap installation instructions.)
NCM Might Set Incorrect IP Address when Installed on a Server with Multiple NICs
NCM attempts to determine the IP address of the NCM server to instruct devices to connect back to NCM. On systems with more that one installed NIC, NCM might not be able to determine the correct IP Address.
NCM Client-only Install does not set NCM Server IP Address
NCM Client-only installs do not set the NCM server IP address correctly. As a result, modules such as Connectors, AAALog Reader, and remote API clients might not be able to connect to the NCM Server.
Workaround: Edit the following file:
<NCM Install Directory>/rendition/jre/commandlineclient.rcx and change localhost to the correct NCM server hostname.
Installing the MySQL Service on a Drive other than C:\ Might Cause the MySQL Service not to Start
When installing NCM on a Windows platform using a MySQL database, if you assign a drive other than C:\, the MySQL service does not start. The path remains C:\mysql, even if you use a different path, such as E:\.
Workaround: When installing NCM, after you enter the Database Admin Login password, validate that the following Registry keys have the appropriate path:
Key: My Computer\HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MySql\ImagePath
ImagePath should be set to the path to the MySQL executable. For example, ImagePath = E:\mysql\bin\mysqld-max-nt.exe
Key: MyComputer\HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\MySql\ImagePath
ImagePath should be set to the path to the MySQL executable. For example, ImagePath = E:\mysql\bin\mysqld-max-nt.exe
If these keys are not set correctly, edit the ImagePath value to the correct path to the MySQL executable. Once this is complete, continue with the NCM installation.
5 Licensing
Network Compliance Manager features software-based product registration and license key activation technologies. The following table provides information about terminology used in the registration process.
Understanding Licensing Terms
Table 11 describes NCM licensing terms.
Licensing Your Product During Installation
After you install the Network Compliance Manager 1.2.1 product, you should register the product and obtain a license file.
To license your product, you must:
Step 1
Step 2
The PAK is printed on the software claim certificate. Get your license file from:
http://www.cisco.com/go/license
Note
Logging in allows your Cisco user profile information to automatically populate many of the product registration fields. Login is case sensitive.
You might want to request a license without installing NCM. The NCM flexlmhostid is same as the Windows and Linux MAC address or the Solaris system hostid. Run the following commands to get the MAC or host id depending on the platform.
•
•
•
6 Installing the NCM License File
Licenses are issued for specific NCM products including NCM Core, High Availability Distributed Systems, and the Cisco Satellite (or Gateway). This section contains the following:
•
•
•
•
Installing the NCM License with the NCM Software
To install an NCM license file with the NCM software, do the following:
Step 1
Note
Step 2
Step 3
Installing the NCM License After Installing the NCM Software
To install an NCM license file after installing the NCM software, do the following:
Step 1
Step 2
Step 3
•
•
Step 4
Step 5
Step 6
Step 7
Step 8
Step 9
Step 10
Step 11
Note
Note
Licensing High Availability Distributed Systems
When installing a High Availability Distributed System, both a High Availability Distrusted System and NCM Core license are required with a license count equal to or greater than your total device inventory. Inactive devices do not count toward this number. Keep in mind that for non- High Availability Distributed Systems, an NCM Core license is required for each NCM Core server in the system.
Each NCM Core server must be able to manage the entire device inventory in the event that one or more NCM Core servers go off-line and devices need to be assigned to different managed NCM Cores. As a result, any on-line NCM Core server will have license capacity to manage the devices inventory.
License Error Messages
If an NCM server has multiple licenses installed, the device count allowed is the sum of all valid licenses. If the device count exceeds the number of valid licenses, you will not be able to log in to NCM. The login screen displays a License Error message. Keep in mind that NCM records when the license server starts and how many license files are found. If you encounter license errors, the NCM log file /<NCM_ROOT>/server/log/jboss_wrapper.log might provide helpful troubleshooting information.
For information on NCM license configuration settings and License Monitor messages, see Chapter 2 in the User Guide for Network Compliance Manager 1.2.1.
7 Logging In
NCM has a web-based user interface. To run NCM, start a browser (Internet Explorer or Mozilla Firefox) and enter the URL for the NCM server. If you run your browser from the same computer on which you installed the server, use this URL:
https://localhost/
Otherwise, you must know the server's hostname or IP address, for example:
https://192.168.123.210
The NCM login window appears. Enter the Administrator account username and password that you entered in Step 17 of the installation and click Login.
8 Adding a Device Using the New Device Wizard
When running NCM for the first time, you must add devices using the New Device Wizard, which automatically opens.
Enter the host name or IP address of the device you want NCM to manage, along with any comments about the device, and click Next. Enter the device's access username, password, and the read-only and read/write SNMP community strings. Click Finish.
If the device was successfully added to NCM, the New Device Wizard Congratulations window displays. If NCM does not recognize a new device, there are several possible causes. See the following sections.
Device Unresponsive/Bad IP Address
The device could be unresponsive or you could have entered an incorrect IP address. It is also possible that the device is not supported in the current release. See the Device Driver Reference for Network Compliance Manager 1.2.1 for a list of supported devices. This is recognized by the following message:
You have successfully added device x.x.x.x to the system. However, there was a problem discovering the driver for the device.Click here for details.Click click here to see the task results, which report the following:
Can't open SSH connection to <ip address>or
Can't open Telnet connection to <ip address>To correct this, verify that NCM is connected to the device. Use ping, traceroute, or another standard network diagnostic. Then, you can enter the IP address again, if necessary. See the "Editing the Device You Added" section.
Bad Password
You might have entered the wrong password for the device. If so, you see a variation of the error message for a bad IP address. The task results look like this:
Root-CLI — login and password not acceptedTo correct this, you must first find the correct password for the device. After you have the correct password, you can change the device password by following the Edit Device instructions below.
Detect Network Devices Task
The Detect Network Devices task enables you to locate devices on your network that you want to place under NCM management. After you provide a range of IP addresses, NCM scans your network looking for devices. Newly discovered devices are automatically added, along with the appropriate device drivers. In addition, NCM automatically assigns the correct IP address to a device if the device has multiple IP addresses and interfaces. Consequently, a device is only entered into the system once. See Chapter 7 of the User Guide for Network Compliance Manager 1.2.1 for detailed information on running the Detect Network Devices task.
Keep in mind that when running the Detect Network Devices task, the results show:
•
•
•
•
All active devices are added to the system (Inventory) and to their own group. If you select Driver Discovery on the task window, a group snapshot will be performed on that group of active devices.
For unsupported hosts, a group is also created and added to the system (Inventory). To make sure that unsupported devices are not added as active (and therefore count towards the device's license) and to prevent any operation performed against Inventory that would include these devices, all devices from unsupported hosts are set to inactive by default. If you want to perform tasks against these devices, you must first activate them. You can activate devices from either the:
•
•
9 Editing the Device You Added
To edit a device's information, on the menu bar under Devices, click Inventory. The Device List displays. Click the Edit option in the Actions column for the device you are editing. The Edit Device window displays. You can now change the device information, such as the IP address or password.
10 Taking a Snapshot of a Device's Current Configuration
NCM is configured by default to take periodic device snapshots. In other words, to periodically poll all active devices in the NCM database and store all current configurations that have changed since the last snapshot. You can also request an immediate snapshot.
To take a snapshot, on the menu bar under Tasks, select New Task and click Take Snapshot. In the New Task - Take Snapshot window, enter the device name or IP address, any Task or Scheduling options you want, and click Save Task. The Task Information window displays, where you can view task status.
11 Reviewing Task Results
NCM can perform many tasks, such as discovering a device's identity (brand and model) and taking a device snapshot (retrieving the current configuration). To view task results, on the menu bar under Tasks, click Recent Tasks. On the Recent Tasks window, successful tasks have the status Succeeded. If a task has failed, click the Detail option for information.
12 Reviewing Device Configuration
From the Recent Tasks window, you can view a device's current configuration. Click the device's hostname or IP address whose configuration you want to see, in this case the device you just added. The Device Details window displays. From the View drop-down menu, click Current Configuration. The device configuration information is displayed.
13 Integrating NCM with CiscoWorks
You can configure NCM so that you can start the application from either the CiscoWorks Home Page or from the NCM Device Tool menu. You can also configure CiscoWorks so that you can start NCM from the CiscoWorks LMS sever.
To set up the cross-starting of NCM and CiscoWorks LMS, you must do the following:
•
•
For information on these procedures, see the following sections. For detailed information on NCM and LMS co-residency on the Windows platform, see the Getting Started Guide for Network Compliance Manager and LMS Co-residency.
Registering the CiscoWorks LMS Server with NCM
To register the CiscoWorks LMS server with NCM, do the following:
Step 1
Step 2
Step 3
To start the CiscoWorks Home Page from NCM, choose Devices->Device Tools->CiscoWorks Home.
To start CiscoView for a device from NCM, do the following:
Step 1
Step 2
Step 3
To start CiscoWorks Device Center for a device from NCM, do the following:
Step 1
Step 2
Step 3
Registering the NCM Server with CiscoWorks LMS
To register the NCM server with the CiscoWorks LMS server, do the following:
Step 1
Step 2
Step 3
Step 4
Step 5
Wait for the installer to complete.
Step 6
This will automatically register the NCM server's links on the CiscoWorks Home Page. Wait for the installer to complete.
Step 7
To start NCM from the CiscoWorks homepage, log into the CiscoWorks desktop and start NCM.
14 Exporting CiscoWorks Devices
After NCM is integrated to work with CiscoWorks, you can export CiscoWorks and LMS devices into a CSV formatted file to transfer information on these devices to NCM. You can using either the LMS GUI or you can run a script on the Solaris or Windows platforms. See the following sections.
Exporting LMS Devices Using the LMS GUI
To export devices and credentials from CiscoWorks LMS to CSV, you can use the LMS GUI. To export DCR devices from LMS server, do the following:
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Step 7
Exporting LMS Devices Using a Script
You can export devices and credentials from CiscoWorks LMS to CSV using a script. All of the necessary import/export scripts are located in the directory specified during the installation of the Client and Connector. Execute all commands from the CiscoWorks LMS system.
To export devices and credentials from CiscoWorks LMS, use one of the following scripts. The script must be executed on the CiscoWorks LMS server.
The path for the scripts is:
<CWNCM_HOME>/client/
where <CWNCM_HOME> is the name of the folder where you installed NCM Client and Connector. When running the exporting script, you will be prompted for a password. Enter the password of the admin_user.
From a Solaris platform, enter the following:
dcr_export.sh <path_to_dcr_csv_file> <admin_user>
From a Windows platform, enter:
dcr_export.bat <path_to_dcr_csv_file> <admin_user>
Where:
<path_to_dcr_csv_file> is the path/file to store the created export file.
<admin user> is the CiscoWorks login name
Importing Devices to the NCM Server
The next step in integrating NCM with CiscoWorks is to import CiscoWorks and LMS devices to the NCM server. To do this, you can run a script on the Solaris or Windows platforms. The path for the scripts is:
<CWNCM_HOME>/client/
where <CWNCM_HOME> is the name of the folder where you installed NCM. When running the script, you will be prompted for a password. Enter the password of the admin_user.
Before you can import devices and aut
Guest
