Raritan Computer Home Security System manuel d'utilisation

Copyright © 2010 Raritan, Inc. CCA-0K-v4.3-E December 2009 255-80-5140-00 CommandCenter Secure Gateway Administrators Guide Release 4.3[...]

This document contains propri etary information that is protected by copyright. All right s reserved. No part of this document may be photocopied, rep rod uced, or translated into another language without express prior written con sent of Raritan, Inc. © Copyright 2009 Raritan, Inc., Comman dCe nter®, Dominion®, Paragon® and the Raritan company[...]

iii Contents What's New in the CC-SG Administrators Guide xvi Chapter 1 Introduction 1 Prerequisi tes .................................................................................................................................. 1 Terminology/ Acronyms ........................................................................................[...]

Contents iv How to Create Associations .............................................................................................. 22 Adding, Editing, and Deleti ng Categories and Elements ............................................................. 22 Add a Ca tegory .............................................................................[...]

Contents v Delete a Devi ce Group ...................................................................................................... 54 Adding Devices with CSV File Import .......................................................................................... 54 Devices CSV File Requirements ..................................................[...]

Contents vi About Inte rfaces................................................................................................................. 78 Viewing Nodes .................................................................................................................. ........... 78 Nodes Tab ..................................................[...]

Contents vii Chapter 9 Users and User Groups 129 The Users Tab .................................................................................................................. ......... 130 Default User Groups ............................................................................................................ ...... 131 CC Super-Use r Gr [...]

Contents viii Using Custom Views in the Admi n Client .................................................................................. 155 Custom Views for Nodes ................................................................................................. 155 Custom Views for Devices ...........................................................[...]

Contents ix Navigate Multiple Page Re ports ...................................................................................... 181 Print a Report................................................................................................................... 181 Save a Report to a File .........................................................[...]

Contents x Chapter 15 Advanced Administration 206 Configuring a Mess age of t he Day ............................................................................................ 206 Configuring Applications for Access ing Nodes .......................................................................... 207 About Applications fo r Accessi ng Nodes ..[...]

Contents xi Security Manager ............................................................................................................... ........ 234 Remote Aut hentication .................................................................................................... 234 AES Encryption......................................................[...]

Contents xii Edit Network Interfaces Confi guration (Network Interfaces ) ........................................... 275 Ping an IP Address .......................................................................................................... 276 Use Traceroute ...................................................................................[...]

Contents xiii CC-SG and Client for IPM I, iLO/RILOE, DRAC, RSA ..................................................... 318 CC-SG an d SNMP ........................................................................................................... 318 CC-SG Intern al Ports ...............................................................................[...]

Contents xiv Appendix C User Group Privileges 321 Appendix D SNMP Traps 330 Appendix E CSV File Imports 332 Common CSV File Requirem ent s .............................................................................................. 333 Audit Trail Entrie s for Importing .............................................................................[...]

Contents xv Node Info rmation ............................................................................................................... ........ 353 Location Info rmation ........................................................................................................... ....... 354 Contact Info rmation.................................[...]

xvi The following sections have cha nged or information has be en added to the CommandCenter Se cu re Gateway Administrators Guide b ased on enhancements and change s to the equip ment and/or documentation. • Discover and Add Devices (on pag e 15) • Add User Gr oups and Users (on pag e 19) • Add a KVM or Serial Device (on page 34) • Devic e[...]

What's New in the CC-SG Administrators Guide xvii • Configuring Power Control of Power IQ IT Devices (on page 306) • CC-SG Clustering (on page 315) See the Rel ease Notes for a more detail ed explanation of the changes applied to this version of the CommandCenter Secure Gateway.[...]

[...]

1 The CommandCenter Secure Gate way (CC-SG) Administrators Guide offers instructions fo r admi nistering and maintaining your CC-SG. This guide is intended for administrato rs who typically have all available privileges. Users who are not administr ators should see Raritan's Command Center Secure Gateway User Guide . In This Chapter Prerequisi[...]

Chapter 1: Introduction 2 Terminology/Acronyms Terms and acronyms found in this docu ment include: Access Client - HTML-ba se d client inten ded for u se by normal access users who need to acce ss a node managed by CC-SG. The Access Client does not allow the use of administration functions. Admin Client - Java-based client for CC-SG use able b y bo[...]

Chapter 1: Introduction 3 Ghosted Ports - when managing Pa ragon devices, a ghosted port can occur when a CIM or target serve r is removed from the system or powered off (manually or accidentally ). See Rari tan's Paragon II Use r Guide. Hostname - can be used if DNS serv e r support is enabled. See About Network Setup (on p age 211 ). The ho [...]

Chapter 1: Introduction 4 Node Groups - a defined group of node s that are acce ssi ble to a user. Node groups are use d wh en creating a policy to control acce ss to the nodes in the group. Ports - connection points b etween a Raritan device and a node. Ports exist only on Raritan devices, and they identify a pathway from that device to a node. SA[...]

5 You can access CC-SG in several w ays: • Browser: CC-SG supports numerous we b browsers (for a complete list of supported browsers, see the Compatibility Matrix on the Raritan Support website). • Thick Client: You can install a Java We b Start thick client on your client computer. The thick client functions exactly like the bro w ser- based c[...]

Chapter 2: Accessing CC-SG 6 JRE Incompatibility If you do not have the minimum required version of JRE install ed on your client computer, you w ill see a warning message before you can access the CC-SG Admin Client. The JRE Incompatibility Warning window opens when CC-SG cannot find the requ ire d JRE file on your cli ent computer. If you see the[...]

Chapter 2: Accessing CC-SG 7 5. To check the setting in CC-SG: Choo se Administration > Security. In the Encryption tab, look at the Br owser Connection Protocol option . If the HTTPS/SSL option is selected, then you must select the Secure Socket Layer SSL checkbox in the thick client's IP addres s specification window. If the HTTP option i[...]

Chapter 2: Accessing CC-SG 8 CC-SG Admin Client Upon valid login, the CC-SG Admin Client appea rs.[...]

Chapter 2: Accessing CC-SG 9 • Nodes tab: Click the Nod es tab to displa y all known target nodes in a tree view. Click a node to view the Nod e Profile. Interfaces are grouped under their paren t nodes. Click the + and - signs to expa n d or collapse the tree. Right-click an interface a nd select Connect to connect to that interface. You can sor[...]

10 Upon the first login to CC-SG, you s hould confirm the IP address, set the CC-SG server time, and check the firmware and appli cation versi ons installed. You may need to upgrade the firmware and application s. Once you have completed your initial configuration s, proce ed to G uided Setup. See Configuring CC-SG with Guided Setup (on page 13). I[...]

Chapter 3: Getting Started 11  Date - click the drop-down arrow to sele ct the Month, use the up and down arrows to select the Year, and then click the Day in the calendar area.  Time - use the up and down arrows to set the Hour, Minutes, and Seconds, and then click the Ti me zon e drop-down arrow to select the time zone in which you are oper[...]

Chapter 3: Getting Started 12 2. Select an Application name from the list . Note the nu mber in the Version field. Some applications do not automatically show a ve rsi on number. To upgrade an application: If the application version is not current, you mu st upgrade the application. You can downl oad the application upgrade file from the Raritan we[...]

13 Guided Setup offers a simple way to complete initial CC-SG configuration tasks once the netwo rk configuration is complete. The Guided Setup interface leads you through the proce ss of defining Associations, discovering and ad ding devices to CC-SG, creating device groups and node grou ps, creatin g user groups, assign ing poli cies and privileg[...]

Chapter 4: Configuring CC-SG with Guided Setup 14 Associations in Guided Setup Create Categories and E lements To create categories and elements in Guided Setu p: 1. In the Guided Setup window, click Associations, and then cli ck Create Categories in the left panel to open the Create Categorie s panel. 2. In the Category Name field, type the name o[...]

Chapter 4: Configuring CC-SG with Guided Setup 15 Discover and Add Devi ces The Discover Devices pan el open s when you click Continue at the end of the Associations task. You can al so cli ck Device Setup, and then click Discover Devices in the Guided Tasks tree view in the left panel to open the Discover Devices panel. To discover and add devices[...]

Chapter 4: Configuring CC-SG with Guided Setup 16 14. If you are manually adding a PowerS trip device, cli ck the Number of ports drop-down arro w and select the number of outlet s the PowerStrip contains. 15. If you are adding an IPMI Server, type an Interval, used to check for availability, and an Authentication Method, which needs to mat ch what[...]

Chapter 4: Configuring CC-SG with Guided Setup 17 3. There are two ways to add devices to a group, Select Devices an d Describe Dev ices. The Sele ct Devices tab allo ws y ou to select whi ch devices you want to assign to the group by selecting them from the list of available devices. The Describe Device s tab allows you to specify rules that descr[...]

Chapter 4: Configuring CC-SG with Guided Setup 18  Select Nodes a. Click the Select Nodes tab in the Nod e G roup: New panel. b. In the Available list, select the node you want to add to the group, and then click Add to move the n ode into the Selected list. Nodes in the Selected lis t will be added to the group. c. To remove a node from the gro[...]

Chapter 4: Configuring CC-SG with Guided Setup 19 Add User Groups and Users The Add User Group panel open s when you click Continue at the end of the Create Groups task. You can also cli ck User Management, and then click Add User Group in the Guided T asks tree vie w in the left panel to open the Add User Group panel. To add user groups and users [...]

Chapter 4: Configuring CC-SG with Guided Setup 20 13. Select the Login Enabled checkbox if you want the user to be able to log in to CC-SG. 14. Select the Remote Authentication checkbox only if you want the user to be authenticated by an outside server, such as TA CACS+, RADIUS, LDAP, or AD. If you are using remote authenticatio n, a password is no[...]

21 In This Chapter About Asso ciati ons .................................................................................. 21 Adding, Editing, and Deleti ng Categories and Elem ents ........................ 22 Adding Categories and Element s with CSV File Import .......................... 23 About Associations You can set up Associations to help or[...]

Chapter 5: Associations, Categories, and Elements 22 Policies also use categ ories and elemen t s to control u ser access to servers. For example, the category /element pair Location/America can be used to create a Policy to control user access to servers in Ameri ca. See Policies for Access Control. (see " Policies for Access Control" on[...]

Chapter 5: Associations, Categories, and Elements 23  Select String if the value is read as text.  Select Integer if the value is a number. 5. In the Applicable For field, select whethe r this catego ry applies to: Devices, Nodes, or Device and Nodes. 6. Click OK to create the new category. The new category name appears in the Category Name f[...]

Chapter 5: Associations, Categories, and Elements 24 Categories and Elements CSV File Requirements The categories and element s CSV file defines the cate gories, their associated elements, their type, and wh ether they ap ply to devices, nodes or both. • All CATEGORY and CATEGORYELE MENT records are related. A CATEGORY record must have one or mor[...]

Chapter 5: Associations, Categories, and Elements 25 Sample Categories and Elements CSV File ADD, CATEGORY, OS, String, Node ADD, CATEGORYELEMENT, OS, UNIX ADD, CATEGORYELEMENT, OS, WINDOWS ADD, CATEGORYELEMENT, OS, LINUX ADD, CATEGORY, Location, String, Device ADD, CATEGORYELEMENT, Location, Aisle 1 ADD, CATEGORYELEMENT, Location, Aisle 2 ADD, CAT[...]

Chapter 5: Associations, Categories, and Elements 26 Export Categories and Elements The export file contains co mments at th e top that descri be each item in the file. The comments can be used as i nstructions for creating a file for importing. To export categories and elements : 1. Choose Administration > Export > Export Catego rie s. 2. Cl[...]

27 To add Raritan PowerStrip Devices that are connected to other Raritan devices to CC-SG, see Managed PowerStrips (on page 69). Note: To conf igure iLO/RILOE devices, IPMI devices, Dell DRA C devices, IBM RSA devices, or other n on - Raritan devices, use the Add Node menu and add the se item s as an interface. See Nodes, Node Groups, and Interface[...]

Chapter 6: Devices, Device Groups, and Ports 28 Viewing Devices The Devices Tab Click the Devices tab to display all devices under CC-SG manage ment. Each device's configure d p orts are nested under the device s they belong to. Devices with configured ports appe ar in the list with a + symbol. Click the + or - to expand or collapse the list o[...]

Chapter 6: Devices, Device Groups, and Ports 29 Icon Meaning Serial port unavailable Ghosted port (See Raritan's Paragon II User Guide for details on Ghosting Mode.) Device paused Device unavailable Power strip Outlet port Blade chassis available Blade chassis unavailable Blade server available Blade server unavailable Port Sorting Options Con[...]

Chapter 6: Devices, Device Groups, and Ports 30 Note: For blade servers without an integ rated KVM switch, such as HP BladeSystem servers, their parent devi ce is the virtual blade chassi s that CC-SG creates, not the KX2 device. These servers will be sorted only within the virtual blade ch assis device so they will n ot appear in order with the ot[...]

Chapter 6: Devices, Device Groups, and Ports 31 The Device Profile includes tabs that contain informati on about the device. Associations tab The Associations tab conta ins all catego ries and elements assi gned to the node. You can change the associ ations by making different selections. See Associa tions, Categories, and Elements (on page 21). Lo[...]

Chapter 6: Devices, Device Groups, and Ports 32 2. Choose Devices > Device Mana ger > Topology View. The Topology View for the selected device appears.  Click + or - to expand or collapse the view. Right Click Options in the Devices Tab You can right-click a device or po rt in the Devices tab to display a menu of commands available for the[...]

Chapter 6: Devices, Device Groups, and Ports 33 Discovering Devices Discover Devices initiates a sear ch for a ll devices on your network. After discovering the devices, you may add them to CC-SG if they are not already managed. To discover devices: 1. Choose Devices > D iscover Devices. 2. Type the range of IP addresses wh ere you expect to fin[...]

Chapter 6: Devices, Device Groups, and Ports 34 Adding a Device Devices must be added to CC-SG befo re you can configure ports or ad d interfaces that provide access to the nodes connecte d to ports. Th e Add Device screen is used to add dev ices whose properties you know and can provide to CC-SG. To sear ch for de vices to add, use the Discover De[...]

Chapter 6: Devices, Device Groups, and Ports 35 6. Type the time (in seconds) that shoul d elapse before timeout between the new device and CC-SG in the Hea rtbeat timeout (sec) field. 7. When adding a Dominion SX or Dominion KX2 version 2.2 or later device, the Allow Direct De vice Acce ss checkbox enables access t o targets directly through the d[...]

Chapter 6: Devices, Device Groups, and Ports 36 14. If the firmware version of the devic e is not compatible with CC-SG, a message appears. Click Y es to add the device to CC-SG. You can upgrade the device firmware after ad din g it to CC-SG. See Upgrading a Device (on page 59). Add a PowerStrip Devi ce The process of adding a PowerStrip Device to [...]

Chapter 6: Devices, Device Groups, and Ports 37  If you do not see the Category or Element values you want to use, you can add others. See Associations, Categor ies, and Elements (on page 21). 8. When you are done configuring this dev ice, click Apply to add this device and open a new bl ank Ad d Device screen that allows you t o continue adding[...]

Chapter 6: Devices, Device Groups, and Ports 38 Adding Notes to a Device Profile You can use the Notes tab to add notes about a devi ce for other users to read. All notes display in the tab with the date, username, and IP address of the user who added the n ote. If you have the Device, Port, and Node Management privilege, you can clear all notes th[...]

Chapter 6: Devices, Device Groups, and Ports 39 Deleting a Device You can delete a device to remove it from CC-SG ma nagement. Important: Deleting a device will remove all ports configured fo r that device. All interfaces asso ciate d with those ports w ill be removed from the nodes. If no other interfac e exis ts for these nodes, the nodes will al[...]

Chapter 6: Devices, Device Groups, and Ports 40 6. Click the Access Applicati on drop-down menu an d select the application you want to use when you conne ct to this port from the list. To allow CC-SG to automatica lly select the correct application based on your browser, select Auto-Dete ct. 7. Click OK to add the port. Configure a KVM Port To con[...]

Chapter 6: Devices, Device Groups, and Ports 41 Editing a Port You can edit ports to change vario us parameters, such as po rt name, access application, and serial port settings. The cha nges you can make vary, based on port type and device type. Note: You can also edit Dominion KX2 port setting s b y using Launch Admin and using the KX2's web[...]

Chapter 6: Devices, Device Groups, and Ports 42 Deleting a Port Delete a port to remove the port ent ry from a Device. When a port is down, the information in the Port Pr ofile screen is read-only. You can delete a port that is down. Important: If you delete a port that is a ssociated with a node, the associated out-of-band KVM or Serial interface [...]

Chapter 6: Devices, Device Groups, and Ports 43 Blade Chassis w ithout an Integrated KVM Switch A blade chassis without an integrated KVM switch, such a s HP BladeSystem series, allows each bl ade server to connect to KX2 respectively via a CIM. As each blad e server in that chassis has a CIM for access, when a user accesses one bl ade server, othe[...]

Chapter 6: Devices, Device Groups, and Ports 44 3. CC-SG automatically creates a virtual b lade chassis and adds the blade chassis icon in one tab. Note that a virtual blade cha ssis never appears as a node in the Nodes tab.  In the Devices tab, the virt ual blade cha ssis device appears beneath the KX2 device, as a vi rtual container to the bla[...]

Chapter 6: Devices, Device Groups, and Ports 45 To configure slots using the Configure Blade s command: 1. In the Devices tab, click the + next to the KX2 device that is connected to the blade chassi s device. 2. Select the blade chassis de vice wh ose slots you want to configure. 3. Choose Nodes > Configure Blades.  To configure multiple slo[...]

Chapter 6: Devices, Device Groups, and Ports 46 Deleting Slots on a Blade Chassis Device You can delete unused bl ade servers or slots so they do not app ear in the Devices and Nodes tabs. To delete a slot from the Delete Ports screen: 1. In the Devices tab, click the + next to the KX2 device that is connected to the blade chassi s device. 2. Selec[...]

Chapter 6: Devices, Device Groups, and Ports 47 Delete a Blade Chassis Dev ice You can delete a blade cha ssi s device connected to a KX2 device from CC-SG. When you delete the blade chassi s device from the KX2 device, the blade chassis devi ce a nd all configured blade servers o r slot s disappear from the Device s tab as well as from the Nodes t[...]

Chapter 6: Devices, Device Groups, and Ports 48 2. Change the blade port gro up for the se blade servers to a non-bla de port group. a. In CC-SG, choose Devices > Device Manage r > L aunch Admin. The KX2 Admin Client opens. b. Click Port Group Managem ent. c. Click the blade port group whos e group property you want to change. d. Deselect the[...]

Chapter 6: Devices, Device Groups, and Ports 49 7. In the Location and Contacts t ab, select the chec kbox for the information you want to copy:  Select the Copy Location Info rmation checkbox to copy the location information displayed in the Location se ction.  Select the Copy Contact Information checkbox to copy the contact information disp[...]

Chapter 6: Devices, Device Groups, and Ports 50  If the group was formed based on co mm on attributes, the Describe Device s tab will appear, showing the rul es that govern selection of the devices for the group.  To search for a device in the dev ice group list, type a string in the Search field at the bottom of the list, and then click Sear[...]

Chapter 6: Devices, Device Groups, and Ports 51 3. Select the Create Full Access Polic y for Group checkbox to create a policy for this device group that allows access to all de vices in the group at all times with control permi ssion. 4. To add another device group, clic k Apply to save this gro up, then repeat these steps. Optional. 5. If you hav[...]

Chapter 6: Devices, Device Groups, and Ports 52  & - the AND operator. A node must sati sfy rules on both sides of this operator for the descript ion (o r that section of a de scriptio n) to be evaluated as true.  | - the OR operator. A device needs to satisfy only one rule on either side of this operator for the de scrip tion (or that se[...]

Chapter 6: Devices, Device Groups, and Ports 53 7. Click View Devices to see what nodes satisfy this expre ssion. A Devices in Device Group Results window opens, displaying the devices that will be grouped by the current expression. This can be used to check if the description was corre ctly written. If not, you can return to the rules table or the[...]

Chapter 6: Devices, Device Groups, and Ports 54 Delete a Device Group To delete a device group: 1. Choose Associations > Device Group s. The Device G roups Manager window opens. 2. Existing device groups appear in the left panel. Select the device group you want to delete. The Device Group Details p anel appears. 3. Choose Groups > Delete. 4.[...]

Chapter 6: Devices, Device Groups, and Ports 55 Devices CSV File Requirements The devices CSV file defines the devices, ports, and their details required to add them to CC-SG. • For devices that support power strips connected to a port (SX, KX, KX2, KSX2), configuring the port w ill configure the power strip. • If device ports are configured, C[...]

Chapter 6: Devices, Device Groups, and Ports 56 Column number Tag or value Details 9 TCP Port Default is configured in the Admin Client in Administration > Configuration > Device Settings tab. 10 Configure All Ports TRUE or FALSE Default is TRUE for Dominion PX devices. Default is FALSE for all other device types. When set to TRUE, all ports [...]

Chapter 6: Devices, Device Groups, and Ports 57 Column number Tag or value Details Use " OUTLET " for configuring outlets on a PX device. 5 Port or Outlet Number Required field. 6 Port or Outlet Name Optional. If left blank, a default name or the name already assigned at the device level will be used. 7 Node Name For KVM and Serial ports,[...]

Chapter 6: Devices, Device Groups, and Ports 58 Column number Tag or value Details 2 DEVICE- CATEGORYELEMENT Enter the tag as shown. Tags are not case sensitive. 3 Device Name Required field. 4 Category Name Required field. 5 Element Name Required field. Sample Devices CSV File ADD, DEVICE, DOMINION KX2, Lab-Test,192.168.50.123,ST Lab KVM, username[...]

Chapter 6: Devices, Device Groups, and Ports 59 5. Check the Actions area to see the import results. Items that imported successfully show in green text. Ite ms that failed import show in red text. Items that failed import because a duplicate item already exists or was already imported al so sho w in red text. 6. To view more import results detail [...]

Chapter 6: Devices, Device Groups, and Ports 60 5. A message appears. Click Yes to restart the device. A message appears when the device has been u pgraded. 6. To ensure that your browser lo ads all upgrade d files, close your browser window, and the n login to CC-SG in a new browser win do w. Backing Up a Device Configuration You can back up all u[...]

Chapter 6: Devices, Device Groups, and Ports 61 Restoring Device Configurations The following device types allow you to restore a full backup of the device configuration. • KX • KSX • KX101 • SX • IP-Reach KX2, KSX2, and KX2-101 devices allow you to choose which components of a backup y ou want to restore to the device. • Protected: The[...]

Chapter 6: Devices, Device Groups, and Ports 62 Restore All Configuration Data Except Ne t work Settings to a KX2, KSX2, or KX2-101 Devi ce The Protected restore option allows yo u to restore all config uration data in a backup file, except network setting s, to a KX2, KSX2, or KX2-101 device. You can use the Protected option to restore a backup of[...]

Chapter 6: Devices, Device Groups, and Ports 63 Restore All Configuration Data to a KX2, KSX2, or KX2-101 Dev ice The Full restore option allows you to restore all configuration data i n a backup file to a KX2, KSX2, or KX2-101 device. To restore all configuration data to a KX2, KSX2, or KX2-101 device: 1. Click the Devices tab and select t he devi[...]

Chapter 6: Devices, Device Groups, and Ports 64 3. Click Upload. Navigate to and select the device backup file. The file type is .rfp. Click Open. The device backup file uploads to CC-S G and appears in the page. Copying Device Configuration The following device types allow you to copy configurat ions from o ne device to one or more other devices. [...]

Chapter 6: Devices, Device Groups, and Ports 65 Restarting a Device Use the Restart Device fu nction to rest art a device. To restart a device 1. Click the Devices tab and select the devi ce you want to restart. 2. Choose Devices > Devic e Manager > Restart Device. 3. Click OK to restart the device. 4. Click Yes to confirm that al l users acc[...]

Chapter 6: Devices, Device Groups, and Ports 66 2. Choose Devices > Device Mana ger > Resume Manageme nt. The device icon in the Device Tree will i ndicate the device's active state. Device Power Manager Use the Device Power Manage r to vi ew the status of a PowerStrip device (including voltage, current, and temperature) and to mana ge a[...]

Chapter 6: Devices, Device Groups, and Ports 67 Disconnecting Users Administrators can termina t e any user's session on a device. Thi s includes users who are performing any kind of operati on on a device, such as connecting to po rts, backing up the configuration of a device, restoring a device's configu ration, or u pgrading the firmwa[...]

Chapter 6: Devices, Device Groups, and Ports 68 IP-Reach and UST-IP Administration You can perform administrative diagno stics on IP-Reach and UST-IP devices connected to your Paragon Sy stem setup dire ctly from the CC- SG interface. After adding the Paragon Sy stem devic e to CC-SG, it appears in the Devices tree. To access Remote User Station Ad[...]

69 There are three ways to configure power control using powe rstrips in CC-SG. 1. All supported Raritan-brand powe r strip s can be connected to another Raritan device and added t o CC-SG as a Powerstrip device. Rarita n- brand powerstrips inclu de Dominion PX and RPC po we rstrips. Check the Compatibility Matrix for supported versions. To configu[...]

Chapter 7: Managed Powerstrips 70 Configuring Powerstrips that are Ma naged by Another Device in CC-SG In CC-SG, managed powerstri ps can be connected to one of the following devices: • Dominion KX • Dominion KX2 • Dominion KX2-101 • Dominion SX 3.0 • Dominion SX 3.1 • Dominion KSX • Dominion KSX2 • Paragon II/Paragon II Syst em Con[...]

Chapter 7: Managed Powerstrips 71 Configuring PowerStrips Connected to KX, KX2, KX2-101, KSX2, and P2SC CC-SG automatically detects PowerS trips connected to KX, KX2, KX2- 101, KSX2, and P2SC devices. You can perform the following tasks in CC-SG to configure and manage Po werStrips connected to these devices. • Add a PowerStrip Device Connected t[...]

Chapter 7: Managed Powerstrips 72 Delete a PowerStrip Connec ted to a KX, KX2, KX2-101, KSX2, or P2SC Device You cannot delete a PowerStrip connected to a KX, KX2, KX2-101, KSX2, or P2SC device from CC-SG. You must physically disconnect the PowerStrip from the device to delete the PowerStrip from CC-SG. When you physically disconnect the PowerStri [...]

Chapter 7: Managed Powerstrips 73 10. For each Category listed, c lick the Element dro p-down menu and select the element you want to appl y to the device. Select the blank item in the Element field for each Category you do not want to use. See Associations, Categories, and Elements (on page 21). Optional. 11. When you are done configuring this Pow[...]

Chapter 7: Managed Powerstrips 74 Configuring Powerstrips Connected to SX 3.1 You can perform the following ta sks in CC-SG to co nfigure and manage Powerstrips conne cted to SX 3.1 devices. • Add a Powerstrip Connected to an SX 3.1 Devic e (on page 74) • M ove an SX 3.1's Powerstrip to a Different Port (on page 75) • Dele te a Powerstri[...]

Chapter 7: Managed Powerstrips 75 Move an SX 3.1's Powerstrip to a Different Port When you physically move a Powers trip from one SX 3.1 device or port to another SX 3.1 device or port, you mu st delete the Powerst rip from the old SX 3.1 port and add it to the new SX 3.1 port. See Delete a Powerstrip Connected to an SX 3.1 Device (on page 75)[...]

Chapter 7: Managed Powerstrips 76 3. Choose Devices > Port M anag er > Configure Ports.  To configure multiple outlets wi th the default names shown in the screen, select the checkbox for each outlet you want to configure, and then click OK to configure each outlet with the default name.  To configure each outlet indivi dually, click th[...]

77 This section covers how to view, configure, and edit no des a nd their associated interfaces, and how to cre ate node groups. Connectin g to nodes is covered briefly. See Ra ritan's CommandCenter Secure Gateway User Guide for details on connecting to n odes. In This Chapter Nodes and Interf aces Overview ....................................[...]

Chapter 8: Nodes, Node Groups, and Interfaces 78 Node Names Node names must be u niq ue. CC-SG wi ll prompt you with options if you attempt to manually add a node with an existing node name. When CC- SG automatically adds nodes, a num bering system en su res that node names are unique. See Naming Conventions (on pa ge 353) for detail s on CC-SG&apo[...]

Chapter 8: Nodes, Node Groups, and Interfaces 79 Node Profile Click a Node in the Nodes tab to open the Nod e Profil e page. The Node Profile page includes tabs that contain information ab out the node.[...]

Chapter 8: Nodes, Node Groups, and Interfaces 80 Interfaces tab The Interfaces tab contains all the node's interfa ce s. You ca n add, edit, and delete interfaces on this tab, and select the default interface. Node s that support virtual media include an ad ditional colum n that shows whether virtual media is enabled or di sabled. Associations[...]

Chapter 8: Nodes, Node Groups, and Interfaces 81 Control system serve r nodes, such as VM wa re's Virtual Center, include the Control System Data tab. The Control System Data tab contains information from the control system se rver that is ref r eshed when the tab opens. You can access a topology view of the virtual infrastructure, link to ass[...]

Chapter 8: Nodes, Node Groups, and Interfaces 82 Service Accounts Service Accounts Overv iew Service accounts are spe c ial login cr ed entials that you can assign to multiple interfaces. You can save time by assig ning a service account to a set of interfaces that often require a password cha nge. You can update the login credentials in the servic[...]

Chapter 8: Nodes, Node Groups, and Interfaces 83 Add, Edit, and Delete Service Accounts To add a service account: 1. Choose Nodes > Servi ce A ccounts. The Service Accounts pa ge opens. 2. Click the Add Row icon to add a row to the table. 3. Enter a name for this service a c count in the Service Account Name field. 4. Enter the username in the U[...]

Chapter 8: Nodes, Node Groups, and Interfaces 84 2. Find the service account whose password you want to change. 3. Enter the new password in the Passwo rd field. 4. Re-type the password in the Retype Password field. 5. Click OK. Note: CC-SG updates all interfaces that use the service account to use the new login credentials when you change the user[...]

Chapter 8: Nodes, Node Groups, and Interfaces 85 Adding, Editing, and Deleting Nodes Add a Node To add a node to CC-SG: 1. Click the Nodes tab. 2. Choose Nodes > Add Nod e. 3. Type a name for the node in the Node Name field. All node names i n CC-SG must be unique. See Naming Conventions (on page 353) for detail s on CC-SG's rule s for name[...]

Chapter 8: Nodes, Node Groups, and Interfaces 86 Nodes Created by Configuring Ports When you configure the ports of a device, a node is create d automatically for each port. An interface is also created for ea ch no de. When a node is automatically cre ated, it is given the same name as the port to which it is associated. If this node name already [...]

Chapter 8: Nodes, Node Groups, and Interfaces 87 Adding Location and Contacts to a Node Profile Enter details about the location of the node, and contact inform ation for the people who administer or use the node. To add location and contacts to a node profile: 1. Select a node in the Nodes tab. The Node Profile page open s. 2. Click the Location &[...]

Chapter 8: Nodes, Node Groups, and Interfaces 88 Configuring the Virtual Infrastructure in CC-SG Terminology for Virtual Infrastructur e CC-SG uses the following terminol ogy for virtual infrastructure components. Term Definition Example Control System The Control System is the managing server. The Control System manages one or mo re Virtual Hosts.[...]

Chapter 8: Nodes, Node Groups, and Interfaces 89 Virtual Nodes Overvie w You can configure your virtual infra stru cture for access in CC-SG. The Virtualization page offers two wi za rd tools, Add Control System wizard and Add Virtual Host wizard, that hel p you add contro l system s, virtual hosts, and their virtual machines p roperly. Once you co[...]

Chapter 8: Nodes, Node Groups, and Interfaces 90  Enter a Username and Password for a uthentication. Maximum 64 characters eac h. 8. To allow users who access this control system to auto matically log into the VI Client interface, select the Enable Single Sign On For VI Client checkbox. Optional. 9. Click Next. CC-SG discovers the contro l syste[...]

Chapter 8: Nodes, Node Groups, and Interfaces 91 Leave these fields blank if you p refer to add names and login credentials to each interface indivi dually. The interface will take the name of the node if the field is left blank. a. Enter names for interfac es. Maximum 32 characters.  Virtual Host VI Client Interfaces  VMware Viewer Interface[...]

Chapter 8: Nodes, Node Groups, and Interfaces 92 4. Click Add Virtual Host. 5. Hostname/IP Address: Enter the IP Addre ss o r hostname of the virtual host. Maximum 64 characters. 6. Connection Protocol: Specify HTTP or HTTPS commu nicatio ns between the virtual host and CC-SG. 7. TCP Port: Enter the TCP po rt. The default port is 443. 8. Check Inte[...]

Chapter 8: Nodes, Node Groups, and Interfaces 93  Use Ctrl+click or Shift+click to select multiple virtual machines that you want to add.  In the Check/ Un check Select ed Rows sect ion, s elect the Virtual Machine checkbox.  To add a VNC, RDP, or SSH interface to the virtual host nodes and virtual machine nodes t hat wil l be created, sel[...]

Chapter 8: Nodes, Node Groups, and Interfaces 94  One node for each virtual host. Each virtual ho st node has a VI Client interface. Virtual host nodes are named with their IP addresses or host names. Edit Control Systems, Virtual Hosts, a nd Virtual Machines You can edit the control systems, vi rtual hosts, an d virtual machines configured in C[...]

Chapter 8: Nodes, Node Groups, and Interfaces 95 10. For each interface type, enter a name and login credentials. The name and login credentials will be shared by all the interfaces added to each virtual machine node and virtu al host node configured. Optional. You can leave these fields blank if you prefer to add names and login credentials to eac[...]

Chapter 8: Nodes, Node Groups, and Interfaces 96 Delete a Virtual Machine Node There are two ways to delete virtual machine nodes: • Use the Delete Node feature. See Delete a Node (on page 86). • De select the Configure checkbox for th e virtual machine. See Edit Control Systems, Virtual Hosts, and Virtual Machines (on page 94). Delete a Virtua[...]

Chapter 8: Nodes, Node Groups, and Interfaces 97 2. In the list of nodes, select the nodes you want to synchronize. Use Ctrl+click to select multiple items. 3. Click Synchronize. If the virtual infrastructure had ch an ged since the last synchronization, the information in CC-SG u pdates.  The Configured in Secure Gateway column sh ows th e numb[...]

Chapter 8: Nodes, Node Groups, and Interfaces 98 3. Click Reboot or Force Reboot. Accessing the Virtual Topology View The Topology View is a tree stru ctur e that shows the relationships of the control system, virtual hosts, and virt ual machines associated with the selected nod e. You must have the Device, Port, and Node Managem ent privileg e to [...]

Chapter 8: Nodes, Node Groups, and Interfaces 99 Pinging a Node You can ping a node from CC-SG to make sure that the conne ctio n is active. To ping a node: 1. Click the Nodes tab, and then se lect the node you want to ping. 2. Choose Nodes > Ping Nod e. The ping results appear in the screen . Adding, Editing, and Deleting Interfaces Add an Inte[...]

Chapter 8: Nodes, Node Groups, and Interfaces 100  In-Band - VNC: Select this item to create a KVM connection to a node through VNC server software. See Interfaces for In-Band Connectio ns (on page 101). Out-of-Band Conn ections:  Out-of-Band - KVM: Select this item to create a KVM connection to a node through a Raritan KVM device (KX, KX101,[...]

Chapter 8: Nodes, Node Groups, and Interfaces 101 See Web Browser Interface (on page 106). 3. A default name appears in the Name field dep endi ng on the type of interface you select. You can ch ang e the name. Thi s name appears next to the interface in the Nodes list. See Naming Conventions (on page 353) for details on CC-SG 's rule s for na[...]

Chapter 8: Nodes, Node Groups, and Interfaces 102 Microsoft RDP Connection Details • If using a Windows XP client, you must have Terminal Server Clien t 6.0 or higher to connect a Micr osoft RDP interface from CC-SG. Update the Terminal Server Cli ent to 6.0 using this link: http://support.microso ft.com/kb/925876. • Internet Explorer only. •[...]

Chapter 8: Nodes, Node Groups, and Interfaces 103 Interfaces for DRAC Power Control Connections To add an interface for DRAC po wer control conn ections: 1. Type the IP Address or Hostname for this interfa ce in the IP Address/Host name field. 2. Type a TCP Port for this connection in the TCP Port field. DRAC 5 only. TCP Port is not required for DR[...]

Chapter 8: Nodes, Node Groups, and Interfaces 104 RSA Interface Details When you create an In-Band RSA KVM or Power interfa ce, CC-S G discards the username and password a ssoci ated wit h the interface, and creates two user accounts on the RSA server. This all ows you to have simultaneous KVM and power acce ss to the RSA server. New usernames: •[...]

Chapter 8: Nodes, Node Groups, and Interfaces 105 6. Click OK to save your changes. Note: A Managed Power Strip interfa ce can be added to a blade chassi s node, but not to a blade server node. Interfaces for IPMI Power Control Connections To add an interface for IPMI power control connections: 1. Type the IP Address or Hostname for this interfa ce[...]

Chapter 8: Nodes, Node Groups, and Interfaces 106  If the IT device has not been added to Power IQ yet, accept the default value for the external key or change it, but make sure to use the same value when addin g the IT device to Po wer IQ. You can quickly make a file of all node and in terface inform ation by exporting. See Export Nodes (on pag[...]

Chapter 8: Nodes, Node Groups, and Interfaces 107  http(s)://www.example.com/cgi/login  http(s)://example.com/home.html 4. Enter authentication information: Option al.  To use a service account for authentication, select the Use Service Account Credentials ch eckb ox. Select the service account to use in the Service Account Name menu. or ?[...]

Chapter 8: Nodes, Node Groups, and Interfaces 108 Example: Adding a Web Browser In terfac e to a PX Node A Dominion PX-managed powerstrip can be added to CC-SG as a node. Then you can add a Web Browser Interfa ce that enables users to access the Dominion PX's Web-based a dmini stration application to the node. Use the following values to add a[...]

Chapter 8: Nodes, Node Groups, and Interfaces 109 Delete an Interface You can delete any interface fr om a nod e except for t hese:  A VMW Viewer interface or a VMW Power interface on a virtual machine node.  A Web Browser interface on a blade cha ssis which has an integrated KVM switch and has a URL or IP address assi gne d to it on the KX2 [...]

Chapter 8: Nodes, Node Groups, and Interfaces 110 4. A default name for the bookmark appe ars in the Bookm ark Name field. You can change the name, which will appea r in your Favorites list in Internet Explorer. 5. Click OK. The Add Favorite window ope ns. 6. Click OK to add the bookmark to your Favorite s list. To access a bookmarked interfa ce: 1[...]

Chapter 8: Nodes, Node Groups, and Interfaces 111 6. In the Associations tab, select the Copy Node Asso ciations checkb ox to copy all categories and element s of the node.  You may change, add or delete any data in this tab. The modified data will be copied to multiple nod es in the Selected Nodes list as well as the current node displayed in t[...]

Chapter 8: Nodes, Node Groups, and Interfaces 112 Adding Nodes with CSV File Import You can add nodes and interfa ces to CC -SG by importing a CSV file that contains the values. You must have the Device, Port, and Node Managem ent and CC S etup and Control privileges to import and export nodes. You must be assigned a policy that gi ves you access t[...]

Chapter 8: Nodes, Node Groups, and Interfaces 113 Nodes CSV File Requirements The nodes CSV file defines the nodes, interfa ce s, an d their detail s required to add them to CC-SG. • Node names must be uniq ue. If you enter du plicate node names, CC-SG adds a number in pare ntheses to the name to make it unique, and adds the node. If you are also[...]

Chapter 8: Nodes, Node Groups, and Interfaces 114 Column number Tag or value Details 3 Node Name Enter the same value as entered for Raritan Port Name. 4 Raritan Device Name Required field. The device must already be added to CC-SG. 5 Port Number Required field. 6 Blade Slot If the node is associated with a blade, enter the slot number. 7 Raritan P[...]

Chapter 8: Nodes, Node Groups, and Interfaces 115 Column number Tag or value Details 9 Parity Valid for SX ports only. 10 Flow Control Valid for SX ports only. 11 Description Optional. To add an RDP interface to the CSV file: Column number in CSV file Tag or value Details 1 ADD The first column for all tags is the command ADD. 2 NODE-RDP-INTERFACE [...]

Chapter 8: Nodes, Node Groups, and Interfaces 116 To add an SSH or TELNET interface to the CSV file: Column number Tag or value Details 1 ADD The first column for all tags is the command ADD . 2 NODE-SSH-INTERFACE for SSH interfaces NODE-TELNET- INTERFACE for TELNET interfaces Enter the tag as shown. Tags are not case sensitive. 3 Node Name Require[...]

Chapter 8: Nodes, Node Groups, and Interfaces 117 Column number Tag or value Details 8 Password Optional. Leave blank if specifying service accou nt. 9 Description Optional. To add a DRAC KVM, DRAC Po wer, ILO KVM, ILO Pow er, Integrity ILO2 Power, or RSA Power interface to the CSV file: When importing DRAC, ILO and RSA interfaces, you must spe cif[...]

Chapter 8: Nodes, Node Groups, and Interfaces 118 Column number Tag or value Details account or a username and password. Leave blank if specifying service account. 8 Password You must enter either a service account or a username and password. Leave blank if specifying service account. 9 Description Optional. 10* TCP Port *For NODE-DRAC-POWER- INTER[...]

Chapter 8: Nodes, Node Groups, and Interfaces 119 To add an IPMI power control interface to the CSV file: Column number Tag or value Details 1 ADD The first column for all tags is the command ADD . 2 NODE-IPMI-INTERFACE Enter the tag as shown. Tags are not case sensitive. 3 Node Name Required field. 4 Interface Name Required field. 5 IP Address or [...]

Chapter 8: Nodes, Node Groups, and Interfaces 120 Column number Tag or value Details power strip is connected to. Required field for all powe r strip s except Dominion PX. 8 Managing Port The name of the port on the device that the power strip is connected to. Required field for all powe r strip s except Dominion PX. 9 Description Optional. To add [...]

Chapter 8: Nodes, Node Groups, and Interfaces 121 To add a Power IQ Proxy power control interface tothe CSV file: See Power Control of Power IQ IT Devices (on page 305) for details about configu ring this interface type. Column number Tag or value Details 1 ADD The first column for all tags is the command ADD. 2 NODE-POWER-PIQ- INTERFACE Enter the [...]

Chapter 8: Nodes, Node Groups, and Interfaces 122 To assign categories and elements to a node to the CSV file: Categories and elem ents must already be created in CC-SG. You can assign multiple element s of the same category to a node in the CSV file. Column number Tag or value Details 1 ADD The first column for all tags is the command ADD . 2 NODE[...]

Chapter 8: Nodes, Node Groups, and Interfaces 123  If the file is not valid, an error message appears. Click OK and look at the Problems area of t he page for a descriptio n of the problems with the file. Click Save to File to save the problems list. Correct your CSV file and then try to validate it again. See Troubleshoot CSV File Problems (on [...]

Chapter 8: Nodes, Node Groups, and Interfaces 124 Adding, Editing, and Deleting Node Groups Node Groups Overvi e w Node groups are used to organize nodes into a set. The node group will become the basis for a policy either allo wing or denying access to this particular set of nodes. See Adding a Policy (on pa ge 150). Nodes can be group ed manually[...]

Chapter 8: Nodes, Node Groups, and Interfaces 125 2. Choose Groups > New. A template for a node g roup appears. 3. In the Group Name field, type a name for a node gro up you want to create. See Naming Conventions (on page 353) for details on CC- SG's rule s for name lengths. 4. There are two ways to add nodes to a group, Select Node s and D[...]

Chapter 8: Nodes, Node Groups, and Interfaces 126 4. If you want to create a policy that allows access to the nodes in this group at any time, select the Create Full Access Policy for Group checkbox. 5. When you are done adding nodes to the group, cli ck OK to create the node group. The group will be added to the list of Node G roups on the left. D[...]

Chapter 8: Nodes, Node Groups, and Interfaces 127 4. If you want to add another rule, click the Add Ne w Ro w icon again, and make the necessary configu rations. Configuring multiple rules will allow more precise descriptions by providing multiple criteria for evaluating nodes.  To remove a rule, highlight the rule in the table, and then cli ck [...]

Chapter 8: Nodes, Node Groups, and Interfaces 128 6. Click Validate when a description has be en written in the Short Expression field. If the description is formed incorrectly, a warnin g appears. If the description is formed correctly, a normalized form of the expression appears in the No rmali zed Expression field. 7. Click View Nodes to see wha[...]

129 User accounts are created so that users can be assig ned a username and password to access CC-SG. A User Group defines a set of priv ileges for its membe rs. You cannot assign privileges to users them selves, only to user groups. All users must belong to at least one user gro up. CC-SG maintains a central ized user list and user group list for [...]

Chapter 9: Users and User Grou ps 130 The Users Tab Click the Users tab to display all user group s and users in CC-SG. Users are nested underneath the use r groups to which they belong. User groups with users assigne d to them appear in the list with a + symbol next to them. Click the + to expand or collapse the list. Active users - those currentl[...]

Chapter 9: Users and User Grou ps 131 Default User Groups CC-SG is c onfigured with th ree default user groups: CC- Super User, System Administrators, and CC Users. CC Super-User Group The CC Super-User group has full administrative and access privileges. Only one user can be a member of this group. The def ault username is admin . You can change t[...]

Chapter 9: Users and User Grou ps 132 Adding, Editing, and Deleting User Groups Add a User Group Creating user groups first will help you organize users when the users are added. When a user group is create d, a set of pri vileges is assigned to the user group. Users assigned to the gro up will inherit those privileges. For example, if you cr eate [...]

Chapter 9: Users and User Grou ps 133 The All Policies table lists all the polici es available on CC-SG. Each policy represents a rule allowing or denying access t o a group of nodes. See Policies for Access Control (on pag e 149) for details on poli cies and how they are created. 9. In the All Policies list, select a policy that you want to assign[...]

Chapter 9: Users and User Grou ps 134 7. Select the checkbox that corres ponds to each privilege you want to assign to the user group. Deselect a privilege to remove it from the group. 8. In the Node Access area, click the dro p-d own menu for each kind of interface you want this group to have access th rou gh and select Control. 9. Click the drop-[...]

Chapter 9: Users and User Grou ps 135 Limit the Number of KVM Sessions per User You can limit the number of KVM sessi ons allowed per user for se ssions with Dominion KXII, KSXII and KX ( KX1) devices. This prevents any single user from using all available cha nnels at once. When a user attempts a connection to a node that wo uld exce ed the limit,[...]

Chapter 9: Users and User Grou ps 136 2. Select the Require Users to Enter Access Information Whe n Connectin g to a Node chec kbox. 3. In the Message to Users field, enter a message that users will see when attempting to access a node. A def ault message is provided. 256 character maximum. 4. Move the user groups to enable access auditing for the [...]

Chapter 9: Users and User Grou ps 137 Note: See Naming Conventions (on page 353) for details on CC- SG's rules for name lengths. If strong passwords are enabled, the pa sswo rd entered must conform to the established rules. The information ba r at the top of the screen will display m essag es to assist with the password requirements. See Adv a[...]

Chapter 9: Users and User Grou ps 138 3. Select the Remote Authentication on ly checkbox if you want the user to be authenticated by an external server such as TA CACS+, RADIUS, LDAP, or AD. If you are using remote authenticatio n, a password is not required and the Ne w Password and Retype New Password fields will be disabled. 4. In the New Passwo[...]

Chapter 9: Users and User Grou ps 139 Assigning a User to a Group Use this command to assign an existin g use r to anot her group. Users assigned in this way will be added to the new group while still existing in any group they were previously assig ned to. To move a user, use this command in conjunction with Delete User From Grou p. To assign a us[...]

Chapter 9: Users and User Grou ps 140 Adding Users with CSV File Import You can add user information to CC -SG by importing a CSV file that contains the values. If you have multiple CC-SG units in a neighborhood, e x porting users from one CC-SG then importing the us ers into another CC-SG is a quick way to ensure all locally authent icated users a[...]

Chapter 9: Users and User Grou ps 141 Column number Tag or value Details 6 Maximum number of KVM sessions allo wed per user Enter just the number, from 1-8 . Default is 2 . To assign permissions to a user group in the CSV file: Enter the value TRUE to assign a permissi on to the u ser group. Enter the value FALSE to deny the permission to the user [...]

Chapter 9: Users and User Grou ps 142 Column number Tag or value Details Tags are not case sensitive. 3 User Group Name Required field. User Group names are case sensitive. 4 Policy Name Required field. To associate an AD module to a user group in the CSV file: Column number Tag or value Details 1 ADD The first column for all tags is the command AD[...]

Chapter 9: Users and User Grou ps 143 Column number Tag or value Details Email address is used with system notifications. 8 Telephone Number Optional. 9 Login Enabled TRUE or FALSE Default is TRUE Enable login to allow the user to log in to CC-SG. 10 Remote Authentication TRUE or FALSE 11 Force Password Change Periodically TRUE or FALSE 12 Expirati[...]

Chapter 9: Users and User Grou ps 144 Sample Users CSV File ADD, USERGROUP, Windows Ad ministrators, MS IT Team ADD, USERGROUP-PERMISSIONS, Windows Administrators, FALSE, TRUE, TRUE, TRUE, TRUE, TRUE, TRUE, TRUE ADD, USERGROUP-POL ICY, Windows Administrators, Full Acce ss Policy ADD, USERGROUP-AD MOD ULE, Wi ndows Administrators, AD-USA- 57-120 ADD[...]

Chapter 9: Users and User Grou ps 145 Export Users The export file contains all use r s that ha ve a use r account created in CC- SG. This excludes AD-authori zed u sers, unless they also have a us er account created on CC-SG. The export file includes user and t he details from the user profile, use r groups, user group pe rmi ssions and policie s,[...]

Chapter 9: Users and User Grou ps 146 Change your name You cannot change your user name. You can cha nge the first and last name associated with you r user name. To change your name: 1. Choose Secure Gateway > My Profile. 2. Type your first and last name in the Full Name field. See Naming Conventions (on page 353) for detail s on CC-SG's ru[...]

Chapter 9: Users and User Grou ps 147 Change the CC-SG Super User's Use rname You must be logged into CC-SG using the CC Super User a ccount to change the CC Super User 's u sername. The default CC Super User username is admin . 1. Choose Secure Gateway > My Profile. 2. Type a new name in the Username field. 3. Click OK to save your ch[...]

Chapter 9: Users and User Grou ps 148 Bulk Copying Users You can use Bulk Copy for users to copy one user's use r group affiliations to another user or list of users. If the users receiving the affiliations have existing group affiliati ons, the existing affiliations will be removed. To perform a Bulk Copy for users: 1. In the Users tab, click[...]

149 Policies are rules that define which nod es and devices users can acce ss, when they can access them , and wh et her virtual-media permissions are enabled, where applicable. The easiest way to create policies is to categorize your node s and devices into node groups and device groups, and then create policies that allow and d eny access to the [...]

Chapter 10: Policies for Access Control 150 Adding a Policy If you create a policy that denies access (Deny) to a node group o r device group, you also must create a policy that allows acce ss (Co ntrol) for the selected node grou p or device group. Users will not automatically receive Control rights when the Deny p olicy is not in effect. Note 1: [...]

Chapter 10: Policies for Access Control 151 13. In the Device/Node Access Permissi on field, select Co ntrol to define this policy to allow access to the sele cted node or device grou p for the designated times and days. Select Deny to define this poli cy to deny access to the selected node or dev ice group for the designate d times and days. 14. I[...]

Chapter 10: Policies for Access Control 152 7. Click the Days drop-down arrow, and then sel ect which days of the week this policy covers: All (everyday ), Wee kday (Monday through Friday only) and Weekend (Saturday an d Sunday only), or Custom (select specific days). 8. Select Custom to select your own set of days. The in dividual day checkboxes w[...]

Chapter 10: Policies for Access Control 153 Support for Virtual Media CC-SG provides remote virtual medi a support for nodes connected to virtual media-enabled KX2, KSX2, and KX2-101 devices. For detailed instructions on accessing virtual medi a with your device, see: • Dominion KX II User Guide • Dominion KSX II User Guide • Dominion KXII-10[...]

154 Custom Views enable you to specify different ways to display the n odes and devices in the left panel, using Categories, Node Groups, and Device Groups. In This Chapter Types of Cust om Views ......................................................................... 154 Using Custom Views in the Admin Client .....................................[...]

Chapter 11: Custom Views for Devices and Nodes 155 Using Custom Views in the Admin Client Custom Views for Nodes Add a Custom View for Nodes To add a custom view for nodes: 1. Click the Nodes tab. 2. Choose Nodes > Change V iew > Create Custom View. The Custom View screen appears. 3. In the Custom View panel, click Add. The Add Custo m View w[...]

Chapter 11: Custom Views for Devices and Nodes 156 2. Click the Name drop-down arrow and select a custo m view from the list. 3. Click Apply View. or • Choose Nodes > Change V iew. All defined custom views are options in the pop-up menu. Choose the custom view you wa nt to apply. Change a Custom View for Nodes 1. Click the Nodes tab. 2. Choose[...]

Chapter 11: Custom Views for Devices and Nodes 157 2. Choose Nodes > Change V iew > Create Custom View. The Custom View screen appears. 3. Click the Name drop-down arrow, and sele ct a custom view from the list. Details of the items included and thei r order appear in the Custom View Details panel 4. In the Custom View panel, click Delete. Th[...]

Chapter 11: Custom Views for Devices and Nodes 158 3. In the Custom View panel, click Add. The Add Custo m View window appears. 4. Type a name for the new custom view in the Custom View Name field. 5. In the Custom View Type section:  Select Filter by Device Group to create a custo m view that displays only the device group s you sp ecify.  S[...]

Chapter 11: Custom Views for Devices and Nodes 159 2. Choose Devices > Chan g e View > Create Custom View. The Custom View screen appears. 3. Click the Name drop-down arrow, and sele ct a custom view from the list. Details of the items included and thei r order appear in the Custom View Details panel. To change a custom view's name: 1. I[...]

Chapter 11: Custom Views for Devices and Nodes 160 Assign a Default Cu sto m View for Devices To assign a default custom v iew for devices: 1. Click the Devices tab. 2. Choose Devices > Chan g e View > Create Custom View. The Custom View screen appears. 3. Click the Name drop-down arrow, and sele ct a custom view from the list. 4. In the Cust[...]

161 In This Chapter Authentication and Authoriz ation (AA) Overview .................................. 161 Distinguished Name s for LD AP and AD ................................................ 162 Specifying Modules for Authent ication and Au thori zation ..................... 163 Establishing Order of External AA Serv ers ........................[...]

Chapter 12: Remote Authentication 162 3. Username and password are eith er accepted or rejected and sent back. If authentication is rejected, this results in a failed login attempt. 4. If authentication is successful, authorization is perform ed. CC-SG checks if the username ent ered matches a group that has been created in CC-SG or imported from A[...]

Chapter 12: Remote Authentication 163 Specify a Username for AD When authenticating CC-SG user s on a n AD server by specifying cn=administrator,cn=users,dc=xyz,d c=com in userna me, if a CC-S G user is associated with an imported AD group, the user will be granted access with these credentials. Note that you can specify more than one common name, [...]

Chapter 12: Remote Authentication 164 2. Click the Authentication tab. A ll configured external Authori zation and Authentication Servers appear in a table. 3. Select a server from the list, and then click the u p and down arrows to prioritize the order of engage ment. 4. Click Update to save your changes. AD and CC-SG Overview CC-SG supports authe[...]

Chapter 12: Remote Authentication 165 AD General Settings In the General tab, you must add the information that allows CC-SG to query the AD server. Do not add duplicate AD modules. If your u sers see a message that says "You are not a member of any group" when attempting to login, you may have configured duplicate AD modul es. Check the [...]

Chapter 12: Remote Authentication 166 5. Type the password for the user ac count you want to use to query the AD server in the Password and C onfirm Password fields. Maximum length is 32 characters. 6. Click Test Connection to test t he conne ction to the AD server using the given parameters. You should recei ve a confirmation of a successful conne[...]

Chapter 12: Remote Authentication 167  Select the Use Bind checkbox if the user logging in from the applet has permissions to perfo rm search queries in the AD server. If a username pattern is spe cified in Bind use rname pattern, the pattern will be merged with the username supplied in the applet and the merged usernam e will be used to connect[...]

Chapter 12: Remote Authentication 168 4. Click Next to proceed. The Trusts tab opens. AD Trust Settings In the Trusts tab, you can set up tr ust relationships between this new AD domain and any existing domains. A trust relation shi p allows resources to be accessible by authenticat ed users acros s domains. T rust relationships can be incoming, ou[...]

Chapter 12: Remote Authentication 169 3. Select the AD module you want edit, and then click E dit. 4. Click each tab in the Edit Module wind ow to view th e configured settings. Make changes as neede d. See AD General Settings (on page 165), AD Ad vanc ed Settings (on page 166), AD Group Settings (on page 167), and AD Trus t Setting s (on page 168)[...]

Chapter 12: Remote Authentication 170  To search for user groups, type a search string in the Search for User Group field, and then click Go.  Click a column header to sort the list of user groups by the information in that column.  Click Select all to select all user groups for import.  Click Deselect all to deselec t all selected user[...]

Chapter 12: Remote Authentication 171 Synchronize All User Groups with AD You should synchronize all user groups if you have made a change to a user group, such as moving a user group from one AD mod ule to another. You can also cha nge the AD associ ation of a user group manually, in the User Group Profile's Active Directory Associ ation s ta[...]

Chapter 12: Remote Authentication 172 Synchronize All AD Mod ules You should synchroni ze all AD Modules whenever you change o r delete a user in AD, change user permi ssion s in AD, or make changes to a domain controller. When you synchronize all AD modul es, CC-SG retrieves the user groups for all configured AD modules, co mpares their names with[...]

Chapter 12: Remote Authentication 173 To disable daily synchronization of all AD modules: 1. Choose Administration > Security. 2. Click the Authentication tab. All configured Authori zati on and Authentication Servers appear in a tabl e. 3. Deselect the Daily synchroniz ation of All Modules checkbox. 4. Click Update to save your changes. Change [...]

Chapter 12: Remote Authentication 174 LDAP General Settings 1. Click the General tab. 2. Type the IP address or hostname of the LDAP server in the IP Address/Hostname field. See Terminol ogy/Acronyms (on page 2) for ho stname rules. 3. Type the port value in the Port field. The default port is 389. 4. Select "LDAP over SSL" if using a sec[...]

Chapter 12: Remote Authentication 175 2. Select Base 64 if you want the password to be sent to the LDAP server with encryption. Select Plain Text if you want the password to be sent to the LDAP server as plain text. 3. Default Digest: select the def ault encryption of use r passwords. 4. Type the user attribute and gro up membership attrib ute para[...]

Chapter 12: Remote Authentication 176 OpenLDAP (eDirectory ) Configuration Settings If using an OpenLDAP server for remote authenti cation, use this example: Parameter Name Open LDAP Parameters IP Address/Hostname <Directory Server IP Address> User Name CN=<Valid user id>, O=<Organization > Password <Password> User Base O=ac[...]

Chapter 12: Remote Authentication 177 About TACACS+ and CC-SG CC-SG users who are remotely aut henti cated by a TACACS+ server must be created on the TACACS + serv er and on CC-SG. The user name on the TACACS+ server a nd on CC-SG must be the same, although the passwords may be different. See Users and User Groups (o n pag e 129). Add a TACACS+ Mod[...]

Chapter 12: Remote Authentication 178 About RADIUS and CC-SG CC-SG users who are remotely authent icated by a RADIUS se rver must be created on the RADIUS server an d on CC-SG. The user name on the RADIUS server and on CC-SG must be the sam e, although the passwords may be different. See Users and User Groups (o n pag e 129). Add a RADIUS Module To[...]

Chapter 12: Remote Authentication 179 Two-Factor Authenticati on Using RADIUS By using an RSA RADIUS Server that supports two-f acto r authentication in conjunction with an RSA Authentication Mana ger, CC-SG can make use of two-factor authentication sche me s with dynamic tokens. In such an environment, users logs into CC-SG by first typing their u[...]

180 In This Chapter Using R eports ........................................................................................ 180 Audit Tra il Report ................................................................................... 182 Error Log Report .................................................................................... 183 Access R[...]

Chapter 13: Reports 181 View Report Details • Double-click a row to view details of the rep ort. • When a row is highlighted, press the Enter key to view details. All details of the selected report display in a dialog that appears, not just the details you can view in the repo rt screen. For example, the Access Report screen for nodes does not [...]

Chapter 13: Reports 182 Purge a Report's Da ta Fr om CC-SG You can purge the data that appears in t he Audit Trail and Error Log reports. Purging these repo rts del etes all data that satisfy the search criteria used. For example, if you search for all Audit Trail entri es fro m March 26, 2008 through March 27, 20 08 , only those records will [...]

Chapter 13: Reports 183 3. You can limit the data that t he report will contain by entering additional parameters in the Message T y pe, Messag e, Username, and User IP address fields. Wildcards are accepted in these field s except for the Message Type field.  To limit the report to a type of message, select a type in the Message Type field. [...]

Chapter 13: Reports 184  Click Purge to delete the Error Log. See Purge a Report's Da ta from CC-SG (on page 182). Access Report Generate the Access report to view information ab out acce ssed devices and nodes, when they were accessed, and the u ser who accessed them. To generate the Access Repo rt: 1. Choose Reports > Ac ce ss Report. [...]

Chapter 13: Reports 185 3. Click Apply. Active Users Report The Active Users report displays cu rren t users and user sessions. You can select active use rs from the report and disconne ct them from CC- SG. To generate the Active Users re port: • Choose Repo rts > Users > Active User s. To disconnect a user from an activ e session in CC-SG:[...]

Chapter 13: Reports 186  The Password Expiration field displays the number of days that the user can use the same password be fore being forced to change it. See Add a User (on page 136).  The Groups field displays the user grou ps to whi ch the user belongs.  The Privileges field displays the CC-SG privileges a ssigned to the user. See Us[...]

Chapter 13: Reports 187 Device Group Data Report The Device Group Data report displays device group informatio n. To generate the Devi ce Group Data re port: 1. Choose Reports > Devices > Device G roup Data. 2. Double-click a row to displ ay the list of devices in the group. Query Port Report The Query Port Report displays a ll ports accordin[...]

Chapter 13: Reports 188 State Type Port State Definition been configured. 3. Select Ghosted Ports to include po rts that are ghosted. A ghosted port can occur when a CIM or target server is remove d from a Paragon system or powe red off (manually or accidentally). See Raritan's Paragon II User Guide. Optional. 4. Select Paused Ports or Locked [...]

Chapter 13: Reports 189 3. The URL column contains direct links to each nod e. You can use this information to create a web page with links to ea ch node, instead of bookmarking each nod e in dividually. See Bookmarking an Interface (on page 109). Active Nodes Report The Active Nodes report includes the n a me and type of each active interface, the[...]

Chapter 13: Reports 190 Node Group Data Report The Node Group Data report displays t he list of nod es that belong to each group, the user groups that have access to each node gro up , and, if applicable, the rules that define t he node group. The list of node s is in the report details, which you can vie w by double -clicking a row in the report p[...]

Chapter 13: Reports 191 Scheduled Reports Scheduled Reports di spla ys reports that were scheduled in the Ta sk Manager. You can find the Upgrad e Device Firmware reports a nd Restart Device reports in the Schedule d Reports screen. Schedule d reports can be viewed in HTML format o nly. See Task M anager (o n page 246). To access scheduled reports [...]

Chapter 13: Reports 192 Upgrade Device Firmware Report The Upgrade Device Firmware report is l ocate d in the Sche duled Reports list. This report is gene rated when an Upgrade Device Firmwa re task is running. View the report to get real-time statu s information a bout the task. Once the task has completed, the report information is static. See Sc[...]

193 In This Chapter Maintenanc e Mode ................................................................................ 193 Entering Maint enance M ode.................................................................. 193 Exiting Maint enance M ode .................................................................... 194 Backing Up CC-SG ............[...]

Chapter 14: System Maintenance 194 2. Password: Type your password. Only users with the CC Setup and Control privilege can ente r mainten ance mode. 3. Broadcast message: Ty pe the message that will display to users who will be logged out of CC-SG. 4. Enter maintenance mode after (min ): Enter the num ber of minutes (from 0-720) that should el apse[...]

Chapter 14: System Maintenance 195 b. Type the IP address or hostnam e of the server in the IP Address/Host name field. c. If you are not using the default port for the selected p rotocol (FTP: 21, SFTP: 22), type the communications port u sed in the Port Number field. d. Type a username for the remote server in the Username field. e. Type a passwo[...]

Chapter 14: System Maintenance 196 What is the difference bet ween Full backup and Standard backup? Standard backup: A standard backup includes all data in al l fields of all CCS G pages, except for data in the following pages: • Administration > Configu ra tion Manager > Network ta b • Administration > Cluster Configu ration CCSG back[...]

Chapter 14: System Maintenance 197 3. Click OK to delete the backup from the CC-SG system. Restoring CC-SG You can restore CC-SG using a b a ckup file that you created. Important: The Neighborhood con figuration is included in the CC- SG backup file so make sure you remember or note do wn its setting at the backup time. This is helpful for dete rmi[...]

Chapter 14: System Maintenance 198  Restore Data - CC-SG configuration, De vice and Node configuration, and User Data. Selecting Data resto res the Standard backup portion of a Full backup file. See What is the difference between Full backup a nd Standa rd backup? (on page 196)  Restore Logs - Error log s a nd event reports stored on CC-SG ?[...]

Chapter 14: System Maintenance 199 Option Description part of the CC-SG database. The SNMP configuration and traps are reset. The SNMP agent is not reset. IP-ACL settings are reset with a Full Database reset whether you select the IP ACL Tables option or not. The Neighborhood configuration is removed with the reset so CC- SG no longer "remembe[...]

Chapter 14: System Maintenance 200 Option Description  SNMP Tr ap Destinations Default Firmware This option resets all de vice firmware files to factory defaults. This option does not chan ge the CC-SG database. Upload Firmware to Database After Reset This option loads the firmware files for the cu rre nt CC-SG version into the CC-SG database. D[...]

Chapter 14: System Maintenance 201 3. Broadcast message: Ty pe the message that will display to users who will be logged off CC-SG. 4. Restart after (min): Enter the num ber of minutes (from 0-720) that should elapse before CC-SG restarts. If specifying over 10 minutes, the broadcast me ssage displays to users immediately, and then repeat s at 1 0 [...]

Chapter 14: System Maintenance 202 4. Once CC-SG is in maintenance mode, choose System Maintena nce > Upgrade. 5. Click Browse. Navigate to and sele ct the CC-SG firm ware file (.zip) then click Open. 6. Click OK to upload the firmware file to CC-SG. After the firmware file is upl oaded to CC-SG, a succe ss m essage appears, indicating that CC-S[...]

Chapter 14: System Maintenance 203 Clear the Browser's Cache These instructions may vary slight ly for different browser versions. To clear the browser cache in Internet Explorer 6. 0 or later : 1. Choose Tools > Internet Options. 2. On the General tab, click Delete Files then click OK to confi rm. In FireFox 2.0 and 3.0: 1. Choose Tools &g[...]

Chapter 14: System Maintenance 204 If specifying over 10 minutes, the broadcast me ssage displays to users immediately, and then repeat s at 1 0 and 5 minutes before the event occurs. 5. Click OK to shut down CC-SG. Restarting CC-SG after Shutdown After shutting down CC-SG, use on e of these two methods to restart the unit: • Use the Diagnostic C[...]

Chapter 14: System Maintenance 205 Ending CC-SG Session There are two ways to end a CC-SG Session. • Log out to end your session while keepi ng the clie nt window open. See Log Out of CC-SG (on page 205). • Exit to end yo ur session and close the client window. See Exit CC- SG (on page 205). Log Out of CC-SG 1. Choose Secure Gateway > Logout[...]

206 In This Chapter Configuring a Mess age of t he Day ........................................................ 206 Configuring Applications for Ac cessing Nodes ..................................... 207 Configuring Defaul t Applications ........................................................... 209 Managing Device Firmware .......................[...]

Chapter 15: Advanced Administration 207 c. Click the Font Size drop-down menu and sele ct a font size for the message text.  If you select Message of the Day File: a. Click Browse to browse for the message file. b. Select the file in the dialog window that opens then cli ck Open. c. Click Preview to review the contents of the file. 4. Click OK t[...]

Chapter 15: Advanced Administration 208 2. Click the Application name dro p-down arrow and select the application that must be upgraded from the list. If you do not see the application, you must add it first. See Add an Application (on page 208). 3. Click Browse, locate and select the ap plication upgrade file from the dialog that appears then cli [...]

Chapter 15: Advanced Administration 209 5. Click OK. An Open dialog appears. 6. Navigate to and select the application file (u sually a .jar or .cab file), and then click Open. 7. The selected application loads onto CC-SG. Delete an Application To delete an application: 1. Choose Administration > Applications. 2. Select an application from the A[...]

Chapter 15: Advanced Administration 210 View the Default Application Assignments To view the default application assignments: 1. Choose Administration > Applications. 2. Click the Default Applications t ab to view and edit the current default applications for various Interface s and Port Types. Application s listed here will become the default c[...]

Chapter 15: Advanced Administration 211 2. Click Add to add a new firmware file. A sear ch wi ndow opens. 3. Navigate to and select the firmware file you want to u pload to CC- SG, and then click Open. When the upload compl ete s, the new firmware appears in the Firmware Name field. Delete Firmware To delete firmware: 1. Choose Administration > [...]

Chapter 15: Advanced Administration 212 Model Primary LAN Name Primary LAN Location Secondary LAN Name Secondary LAN Location V1-0 or V1-1 LAN1 Left LAN port LAN2 Right LAN port E1 LAN Ports: Model Primary LAN Name Primary LAN Location Secondary LAN Name Seconda ry LAN Location E1-0 Not labeled Top LAN port in set of 2 ports in center of unit back [...]

Chapter 15: Advanced Administration 213 If the Primary LAN is connected and receiving a Link Integrity signal, CC- SG uses this LAN port for all communi cations. If the Primary LA N loses Link Integrity, and Secondary LAN is connected, CC-SG will failover its assigned IP address to the Secondary LAN. The Seconda ry LAN will be used until the Primar[...]

Chapter 15: Advanced Administration 214 6. Click the Adapter Speed drop- down arro w and select a line speed from the list. Make sure your sele ction agrees with your switch's adapter port setting. If your switch uses 1 Gig line speed, sele ct Auto. 7. If you selected Auto in the A dapter Speed field, the Adapter Mode field is disabled, with F[...]

Chapter 15: Advanced Administration 215 What is IP Isolation mode? IP Isolation mode allows you to isol ate clients from devices by placi n g them on separate sub-networks and fo rcing clie nt s t o access the dev i ce s through CC-SG. In this mode, CC-SG manages traffic betwee n the two separate IP domains. IP Isolation mode does not offer failove[...]

Chapter 15: Advanced Administration 216 • Specify at most one Default Gateway in the Network Setup pan el in CC-SG. Use Diagnostic Console to add more static routes if nee d ed. See Edit Static Routes (on page 278). To configure IP Isolation mode in CC-SG: 1. Choose Administration > Configuration. 2. Click the Network Setup tab. 3. Select IP I[...]

Chapter 15: Advanced Administration 217 Recommended DHCP Configurations for CC-S G Review the following recommended DHCP c onfigurations. Make sure that your DHCP server is set up properly before you config ure CC-SG to use DHCP. • Configure the DHCP to statically allocate CC -SG's IP address. • Configure the DHCP and DNS servers to automa[...]

Chapter 15: Advanced Administration 218 2. Click the Logs tab. 3. Click Purge. 4. Click Yes. Configuring the CC-SG Server Time and Date CC-SG's time and date must be accurat ely maintained to provide credibility for its device-management capabilities. Important: The Time/Date configurati on is used when scheduling tasks in Task Manager. See Ta[...]

Chapter 15: Advanced Administration 219 Connection Modes: Direct and Proxy About Connection Mod es CC-SG offers three connection modes for in-band a nd out-of-b and connections: Direct, Proxy, and Both. • Direct mode allows you to connect to a node or port directly, witho ut passing data through CC-S G. Dire ct mode generally provides faster conn[...]

Chapter 15: Advanced Administration 220 Configure Proxy Mode for All Client Connections To configure proxy mode for all client connections: 1. Choose Administration > Configuration. 2. Click the Connection Mode tab. 3. Select Proxy mode. 4. Click Update Configuration. Configure a Combination of Direct Mo de and Proxy Mode When you configure CC-S[...]

Chapter 15: Advanced Administration 221 3. Type a new timeout duration in the Heart beat (se c) field. The valid range is 30 seconds to 50,000 second s. 4. Click Update Configuration to save your changes. To enable or disable a warning message for all po wer operations: Select the Display Warning Message For All Powe r Ope rations checkbox to enabl[...]

Chapter 15: Advanced Administration 222 Enable AKC Download Server Certifi cate Validation Overview If you are using the AKC client, you can cho ose to use the Enable AKC Download Server Certificate Validati on feature or opt not to use thi s feature. Option 1: Do Not Enable AKC Download Server Certificate Validation (default setting) If you do not[...]

Chapter 15: Advanced Administration 223 Configuring Custom JRE Settings CC-SG will display a warning message t o users who attempt to access CC-SG without the minimum JRE vers ion that you specify. Check the Compatibility Matrix for the minimu m supported JRE version. Choose Administration > Compatibility Matrix. If a user attempting to log into[...]

Chapter 15: Advanced Administration 224 To clear the default message and minimum JRE version: 1. Choose Administration > Configuration. Click the Custom JRE tab. 2. Click Clear. Configuring SNMP Simple Network Management Protocol allows CC-SG to push S NMP traps (event notifications) to an ex isting SNMP manager on the network. You should be tra[...]

Chapter 15: Advanced Administration 225 9. Select the checkboxes before the traps you want CC-SG to push to your SNMP hosts: Under Trap Source s, a list of SNMP traps grouped into two different categories: System Log trap s, whi ch include notifications for the status of the CC unit itself, such as a hard disk failure, and Applicat ion Log traps fo[...]

Chapter 15: Advanced Administration 226 Requirements for CC-SG Clusters • The Primary and Secondary nodes in a clu ster must be running the same firmware version on the sa me hardware version (V1 or E1 ). • Your CC-SG network must be in IP Failover mode to be used for clustering. Clustering will n ot work with an IP Isolation mode configuration[...]

Chapter 15: Advanced Administration 227 5. Type a valid user name and password for the Backup node in the Username for Backup Secure Gateway and Password for Backup Secure Gateway fields. 6. Select the Redirect by Hostname chec kbox to specify t hat secondary to primary redirection access should b e via DNS. Optional. See Access a CC-SG Cluster (on[...]

Chapter 15: Advanced Administration 228 Switch the Primary and Secondary Node Status You can exchange the roles of Primary and Secondary nodes when the Secondary, or Backup, node is in the "Joined" state. When the Secondary node is in the "Waiting" state, switchi ng is disabled. After the roles are switched, the former Primary n[...]

Chapter 15: Advanced Administration 229 Note: If the clustered CC-SG units do not share the sa m e time zone, when the Primary nod e failure o ccurs, and the Secondary node becomes the new Primary node, the tim e specified for Automatic Rebuild still follows the time zone of the old Primary n ode. Delete a Cluster Deleting a cluster completely dele[...]

Chapter 15: Advanced Administration 230 Create a Neighborhoo d You can log into a CC-SG unit where yo u want to cre ate a Neighborhood and which is not a member of any Neighborhood yet. After a Neighborhood is create d, all members in the Neighborh ood share the same Neighborhood info rmation. If any membe r is the Primary Node of clustered CC-SG u[...]

Chapter 15: Advanced Administration 231  To deactivate any CC-SG unit, des elect the Activate chec kbox next to that unit. Deactivated CC-SG units operate as standal one units and do not show up as on e of the Neighborhood membe r s to Access Client users.  Click the column header to sort the table by that attribute in ascending order. Clic k[...]

Chapter 15: Advanced Administration 232 4. If new CC-SG units meet the Ne ighborhood crite ria and are found, they display in the Neighborhood Confi guration table . Otherwise, a message appears and retu rn you to the Add Memb er dialog. Then make changes in the dialog as neede d. 5. Select the Active checkbox next to each new CC-SG unit. 6. To cha[...]

Chapter 15: Advanced Administration 233 Delete a Neighborhood Member When a CC-SG unit in a Neighborhood become s inappropriate, you may either remove or deactivate it in the Neighborho od con figuration. Otherwise, Access Client users may find these u nits inaccessible when trying to switch to them. For example, a Neighbo rh ood member becomes ina[...]

Chapter 15: Advanced Administration 234 2. Choose Administration > Neighborhoo d. 3. Click Delete Neighborhoo d. 4. Click Yes to confirm the deletion. Security Manager The Security Manager is used to manage how CC-S G provides access to users. Within Security Manag er you can configu re authentication methods, SSL access, AES Encryption, strong [...]

Chapter 15: Advanced Administration 235 Check Your Browser fo r A ES Encryption CC-SG supports AES-128 and AES-256. If you do not know if your browser uses AES, check with the browser manufacturer. You may also want to try navigating to the following web site usi ng the browser whose encryption method you want to check: https://www.fortify.ne t/ssl[...]

Chapter 15: Advanced Administration 236  Click the Key Length drop-down ar row to select the e ncryption level - 128 or 256.  The CC-SG Port field displays 80.  The Browser Connection P rotocol field displays HTTPS/SSL selected. 5. Click Update to save your changes. Configure Bro wser Connection Protocol: HTTP or HTTPS/SSL In Security Mana[...]

Chapter 15: Advanced Administration 237 Require strong pass words for all users 1. Choose Administration > Security. 2. Click the Login Settings tab. 3. Select the Strong Passwords Require d for All Users checkb ox. 4. Select a Maximum Password Length. Password s mu st contain fewer than the maximum number of characters. 5. Select a Password His[...]

Chapter 15: Advanced Administration 238 Lockout settings Administrators can lock out CC-SG users and SSH u sers after a specified number of failed login attempt s. You ca n en able this feature for locally authenticated users, for remote ly authenti cated users, or for all users. Note: By default, the admin account is locked out for five m inutes a[...]

Chapter 15: Advanced Administration 239 2. Open the Login Settings tab. 3. Deselect the Lockout Enabled for Local Users checkbox to disable lockout for locally authenticated user s. Desele ct the Lockout Enabled for Remote Users checkbox to disable lockout for remotely authenticated users. 4. Click Update to save your changes. Allow concurrent logi[...]

Chapter 15: Advanced Administration 240 Logo A small graphic file can be uploaded to CC-SG to act as a banner on the login page. The maximum size of the logo is 998 by 170 pixel s. To upload a logo: 1. Click Browse in the Logo ar ea of the Portal tab. An Open dialo g appears. 2. Select the graphic file you want to use as your logo in the dialog, an[...]

Chapter 15: Advanced Administration 241  Click Browse. A dialog win dow o pens.  In the dialog window, select the text file with the message you want to use, and then click Open. The maximum length of the text message is 10,000 characters.  Click Preview to preview the text contained in the file. The preview appears in the banner me ssage [...]

Chapter 15: Advanced Administration 242 a. Encryption Mode: If Require AES Encryption between Client and Server is selected in the Administration > Security > E ncryption screen, AES-128 is the default. If A ES is not required, DES 3 is the default. b. Private Key Length: 1024 is the default. c. Validity Period (days): Maximum 4 num eric char[...]

Chapter 15: Advanced Administration 243 14. Type raritan in the Password fiel d if the CSR was generate d by CC- SG. If a different application generated the CS R, use the password for that application. Note: If the imported certificate is sign e d by a root and subroot CA (certificate authority), using only a root or subroot certificate will fail.[...]

Chapter 15: Advanced Administration 244 Access Control List An IP Access Control List specifies ranges of client IP addresses for which you want to deny or allow ac cess to CC-SG. Each ent ry in the Access Control List becomes a rule that determines whether a user in a certain group, with a certai n IP addr ess, can access CC-SG. You can also set r[...]

Chapter 15: Advanced Administration 245 6. Click the Action drop-down arro w an d select Allow or Deny to specify whether the specified users in the IP range can access CC-SG. 7. Click Update to save your changes. To change the order in which CC-SG applies rules: 1. Choose Administration > Security. 2. Click the Access Control List tab. 3. Selec[...]

Chapter 15: Advanced Administration 246 7. Type a valid email address that will identify messages from CC-SG in the From field. 8. Type the number of times emails sho uld be re-sent should the send process fail in the Sending retries field. 9. Type the number of minutes (fro m 1-60) that shoul d elapse between sending retries in the Sending retry i[...]

Chapter 15: Advanced Administration 247 Schedule Sequential Tasks You may want to schedule tasks sequ en tially to confirm that expect ed behavior occurred. For example, you may want to schedul e an Upgrade Device Firmware task for a given device group, and th en schedule an Asset Management Report task immediat ely after it to confi rm that the co[...]

Chapter 15: Advanced Administration 248 Schedule a Task This section covers most tasks that can be sche dule d. See Schedule a Device Firmware Upgrade (on page 250) for d etails on scheduling device firm ware upgra de s. To schedule a task: 1. Choose Administration > Tasks. 2. Click New. 3. In the Main tab, type a name and description for the ta[...]

Chapter 15: Advanced Administration 249 b. Periodic: Use the up and down arrows to select the Start time at which the task should begin. Type the numbe r of times the task should be executed in the Repeat Co un t field. Type the time that should elapse between repetitions in the Rep eat Interval field. Click the drop-down menu and sele ct the unit [...]

Chapter 15: Advanced Administration 250 12. Specify email addresses to which a notification should be sent up on task success or failure. By defaul t, the email address of the user currently logged in is available. User em ail add resses configured in the User Profile. To add another em ail address, click Add, type the email address in the window t[...]

Chapter 15: Advanced Administration 251 a. Start Date/Time: Select the date and time at which the task begins. The start date/time must be later than the current date/time. b. Restrict Upgr ade Wi ndow and Lat est Upgrade Start Date/Time: If you must finish all upgrades within a specific wi ndo w of time, use these fields to specify the date and ti[...]

Chapter 15: Advanced Administration 252 Change a Scheduled Task You can change a schedul ed task before it runs. To change a scheduled task: 1. Select the task you want to change. 2. Click Edit. 3. Change the task specifi cations as needed. See Schedule a Task (on page 248) and Sch ed ule a Devic e Firmware Upgrade (on page 250) for tab description[...]

Chapter 15: Advanced Administration 253 Delete a Task You can delete a task to remove it from the Task Ma nager. You cannot delete a task that is currently running. To delete a task: • Select the task, then click Delete. SSH Access to CC-SG Use Secure Shell (SSH) clients, such as Putty or OpenSHH Client , to access a command lin e interfa ce to S[...]

Chapter 15: Advanced Administration 254 To display all SSH commands: • At the shell prompt, type ls to display all commands av ailable. Get Help for SSH Commands You can get limited help for all commands at once. You can also g e t in- depth help on a single com mand at a time. To get help for a single SSH command: 1. At the shell prompt, type th[...]

Chapter 15: Advanced Administration 255 SSH Commands and Parameters The following table lists all command s available in SSH. You must be assigned the appropriate privilege s in CC-SG to a ccess each command. Some commands have additional pa ra meters that you must type to execute the command. For more information abo ut how to type commands, see C[...]

Chapter 15: Advanced Administration 256 To search for text from piped output s tream: grep search_term To view the help screen for all commands: help To list available device configura tion backups: listbackups <[-id <device_id>] | [host]> To list available devices: listdevices To list firmware versions available for upgrade: listfirmwa[...]

Chapter 15: Advanced Administration 257 To restart a device: restartdevice <[-id <device_id>] | [host]> To restore a device configuration : restoredevice <[-host <host>] | [-id <device_id>]> [backup_id] To shutdown CC-SG: shutdowncc minutes [message] To open an SSH connection to an SX device: ssh [-e <escape_char>[...]

Chapter 15: Advanced Administration 258 Command syntax Device ID v alue You should type ssh -id <device_id> 100 ssh -id 100 • The default escape charac ter is a tilde followed by a peri od. For example: ~. See End SSH Connections (on page 260) for details on u sing th e escap e character and the ex it command. You may have problems using th[...]

Chapter 15: Advanced Administration 259 2. Connect to the device by typing ssh -id <device_id> . Using the figure above as an example, you ca n co nnect to SX-229 by typing ssh -id 1370 . Use SSH to Connect to a Node v ia a Serial Out-of-Band Interface You can use SSH to connect to a node through its a ssociated seri al out- of-band interface[...]

Chapter 15: Advanced Administration 260 Command Alias Description get_write gw Gets Write Access. Allows SSH user to execute commands at targ et serve r while browser user can o nly observe proceedings. get_history gh Gets History. Displays the last few commands and re sult s at target server. send_break sb Sends Break. Breaks the lo op in targ et [...]

Chapter 15: Advanced Administration 261 Serial Admin Port The serial admin port on CC-SG can b e connected directly to a Raritan serial device, such as Dominion SX or KSX. You can connect to the SX or KSX vi a the IP address using a terminal emulation program, such as HyperTerminal or PuTTY . Set the baud rate in the terminal emulation program to m[...]

Chapter 15: Advanced Administration 262 3. A new window opens with your CC-S G serial number. Web Services API You must accept the End User Agreement before addi ng a We b Services API client to CC-SG. You can add up to five WS-API clients. See the CC-SG Web Services API Guide for details on using the API. To add a Web Services API: 1. Select Acces[...]

Chapter 15: Advanced Administration 263 h. Division/Department Name: CSR tag is Organization Unit Name. Maximum 64 characters. i. Fully Qualified Domain Na me: CSR tag is Common Name. j. Administrator Email Address: Type in th e email address of the administrator who is resp onsible for the certificate re quest. k. Challenge Password: Maxi mum 64 c[...]

264 The Diagnosti c Co nsole is a non-gr aphical, menu-based interfa ce t hat provides local access to CC-SG. You can access Di agno stic Console from a serial or KVM port. See Access Diagnostic Console via VGA/Keyboard/Mouse Port (on pag e 2 64). Or, you can acce ss Diag nostic Console from a Secure S hell (SSH) client, such as PuT TY or OpenSSH C[...]

Chapter 16: Diagnostic Console 265 Status Console About Status Console • You can use the Status Console to chec k the health o f CC-SG, the various services CC-SG uses, and the attached network. • By default, Status Console does not require a pa ssword. • You can configure CC-SG to provid e the Status Co nsole information over a Web interface[...]

Chapter 16: Diagnostic Console 266 2: Access the Status Con sole v ia web browser: 1. Using a supported Internet browser, type this URL: http(s)://<IP_address>/status/ where <IP_address> is the IP address of the CC-SG. Note the forward slash (/) followi ng /status is mandatory. For example, https://10.20.3.30/status/ . 2. A status page [...]

Chapter 16: Diagnostic Console 267 CC-SG Title, Date and Time The CC-SG title is constant so users know that they are conne cted to a CC-SG unit. The date and time at the top of the sc reen is the last time when the CC- SG data was polled. The date and time reflect the timing value s sav ed on the CC-SG server. Message of the Day The Message of the[...]

Chapter 16: Diagnostic Console 268 Information Description Restoring CC-SG is in t he process of restoring itself and database queri es are temporarily suspended. Down Database server has not st arted yet. Most of the access to the CC-SG server is through the Web. This field shows the state of the Web server a nd available statuses include: Respond[...]

Chapter 16: Diagnostic Console 269 Information Description Speed The speed that this interface is operating: 10, 100 or 1000 Mbits per se cond. Duplex Indicate whether the interface i s Full- or Half-duplex. IPAddr The current Ipv4 Address of this interface. RX -Pkts The number of IP packet s received on this interface since CC-SG was booted. TX -P[...]

Chapter 16: Diagnostic Console 270 Status Console v ia Web Browser After connecting to the Status Console via the web bro wser, the re a d- only Status Console web page appears. The web page displays the same info rm ation as the Status Console, and also updates the information approximat ely every 5 seconds. For information on the links for CC-SG [...]

Chapter 16: Diagnostic Console 271 Administrator Console About Administrator Co nsole The Administrator Con sol e allows you to set some initial parameters, provide initial networking configuration, debu g log files, and perform some limited diagnostics a nd re starting CC-SG. The default login for the Administrator Console is: • Username: admin [...]

Chapter 16: Diagnostic Console 272 The main Administrator Console screen appears. Administrator Console Sc reen Administrator Console screen co nsists of 4 main areas. • Menu bar: You can perform Administ rator Console function s by activating the menu bar. Press Ctrl+X to activate the menu bar or click a menu i tem using the mouse if you access [...]

Chapter 16: Diagnostic Console 273 • Status bar: Status bar is just above the navigation keys bar. It displays some important system information, including CC-SG' s seri al number, firmware version, and the time when the information shown in the main display area wa s loa ded or updated. Screenshots co ntaining this information may be useful[...]

Chapter 16: Diagnostic Console 274 Edit Diagnostic Console Configuration The Diagnostic Co nsole can be accessed via the serial port (COM 1), VGA/Keyboard/Mouse (KVM) port, or fr om SSH clients. If you want to access Status Console, one more a c ce ss mechanism, Web ac cess, is also available. For each port type, you can config ur e whethe r or not[...]

Chapter 16: Diagnostic Console 275 4. Click Save. Edit Network Interfaces Configuration (Network Interfaces) In Network Interface Configuration, you can perform i nitial setup tasks, such as setting the hostna m e and IP addre s s of the CC-SG. 1. Choose Operation > Network Inte rfaces > Network Interface Co nfig. 2. If the network interfaces[...]

Chapter 16: Diagnostic Console 276  Even if DHCP is being used to determine the IP configuratio n for an interface, you must provide a properl y formatted IP address and Netmask. 6. In the Adapter Speed, select a li ne speed. The other values of 10, 100, and 1000 Mbps are on a scrollable list (wh ere only one value is visible at any given time) [...]

Chapter 16: Diagnostic Console 277 Option Description Record Route Records route. Turns on the IP record route option, which will store the route of the packet inside the IP header. Use Broadcast Address Allows pingin g a bro ad cast message. Adaptive Timing Adaptive ping. In terpacket interval adapts to round-trip time, so that effectively not mor[...]

Chapter 16: Diagnostic Console 278 Option Description No DNS Resolution Does not resolve addresses to host names. Use ICMP (vs. normal UDP) Use ICMP ECHO instead of UDP datagrams. 4. Type values for how many hops the tra c eroute command will use i n outgoing probe packets (def ault is 30), th e UDP destination port to use in probes (default is 33 [...]

Chapter 16: Diagnostic Console 279 Although you can delete all other routes, including the Default Gateway, doing this will greatly impact the communication with CC- SG.[...]

Chapter 16: Diagnostic Console 280 View Log Files in Diagnostic Console You can view one or more log files si mul taneously via LogViewer, which allows browsing through se veral files at once to examine system activity. The Logfile list is updated only when the asso ciated l ist becomes active, as when a user enters the logfile list are a, or wh en[...]

Chapter 16: Diagnostic Console 281 3. Click with the mouse or use the arrow keys to navigat e and press the Space bar to select a log file, marking it with an X. You can view more than one log file at a time. To sort the Logfiles to View list: The Sort Logfile list by options control the ord er in which logfiles are displayed in the Logfile to View[...]

Chapter 16: Diagnostic Console 282 Option Description contents of this package is not available to customer. Exported logfiles will be available for up to 10 days, a nd then the system will automat ically delete them . View View the selected log(s). When View is selected with Individual Wi ndows, the LogViewer displays:  While viewing log files,[...]

Chapter 16: Diagnostic Console 283 Note: System load is static as of the start of this Admin Console se ssion - use the TOP utility to dynamical ly monitor system resources. To filter a log file with a regular expression: 1. Type e to add or edit a regular expressi on and select a log from the list if you have chosen to view several. 2. Type A to a[...]

Chapter 16: Diagnostic Console 284 Diagnostic Console. See Restarting CC-SG (on page 200). Restarting CC-SG in Diagnostic Cons ole will NOT notify users that it is being restarted. To restart CC-SG with Diagnostic Co nsole: 1. Choose Operation > Admin > CC-SG Resta rt. 2. Either click Restart CC-SG Applic ation or press Enter. Confirm the res[...]

Chapter 16: Diagnostic Console 285 2. Either click REBOOT System or press Enter to reboot CC-SG. Confirm the reboot in the next screen to proceed. Power Off CC-SG System from Diagnostic Console This option will power off the CC-SG unit. Logged -in users will not receive a notification. CC-SG, SSH, and Diagnostic Console users (including this sessio[...]

Chapter 16: Diagnostic Console 286 2. Either click Power OFF the CC-S G or press Enter to remove AC power from the CC-SG. Confirm the power off operation in the next screen to proceed. Reset CC Super-User Pa ss word with Diagnostic Console This option will reset the password fo r the CC Super User account to the factory default value. Factory defau[...]

Chapter 16: Diagnostic Console 287 2. Either click Reset CC-SG GUI A d min Password or press Enter to change the admin password back to factory default. Confi rm the password reset in the next screen to proceed. Reset CC-SG Factory Configuration (Admin) This option will reset all or parts of the CC-SG system back to their factory default values. Al[...]

Chapter 16: Diagnostic Console 288 Option Description Full CC-SG Database Reset This option removes the existing CC-SG databa se a nd builds a new version with the factory default val ues. Network settings, SNMP settings, firmware, and diagnostic console se ttings are not part of the CC-SG database. IP-ACL settings are reset with a Full Database re[...]

Chapter 16: Diagnostic Console 289 Option Description Diagnostic Console Reset This option restores Di agnostic Con sole settings back to factory defaults. IP Access Co ntrol Lists Reset This option removes all entries from the IP-ACL tabl e. IP-ACL settings are reset with a Full Database reset whether you select the IP Access Control Lists reset o[...]

Chapter 16: Diagnostic Console 290 2. In the Password History Depth field, type the number of passwords that will be remembered. The default setting is five. 3. Select either Regular, Random, or Strong for the admi n and statu s (if enabled) passwords. Password setting Description Regular These are standa rd. Passwords must be longer than four char[...]

Chapter 16: Diagnostic Console 291 Password setting Description every password must have at least one digit in it. Diagnostic Console Account Configuration By default, the status account does not require a passwo rd, but you can configure it to require one. Other aspects of the admi n password can be configured and the Field Support ac co u nts can[...]

Chapter 16: Diagnostic Console 292 Setting Description User User Name (Read-only ). This i s the current user name or ID for this account. Last Changed (Read-only). This is the date of the last passwo rd ch ange fo r this account. Expire (Read-only). This is the da y that this account must ch ange its password. Mode A configurable option if the a[...]

Chapter 16: Diagnostic Console 293 Configure Remote System Monitoring You can enable the remote system mo ni toring feature to use the GKrellM tool. The GKrellM tool provides a graphical view of resource utilization on the CC-SG unit. This tool is simi lar to the Windows Task Manager's Performance tab. 1: Enable remote system monitoring for th[...]

Chapter 16: Diagnostic Console 294 3: Configure the remote sy stem monitoring client to work with CC-SG: Follow the instructions in the Read Me file to set the CC-SG unit as the target to monitor. Windows users must use the comman d line to locate the Gkrellm installation directory and then run the command s spe cified in the Read. Display Historic[...]

Chapter 16: Diagnostic Console 295 Display RAID Status and Disk Utilization This option displays the sta t us of CC -SG disks, incl uding disk size, active and up status, state of the RAID-1, and amount of space cu rrently used by various file sy st ems. To display disk status of the CC-SG: 1. Choose Operation > Utilities > Disk / RAID Utilit[...]

Chapter 16: Diagnostic Console 296 Perform Disk or RAID Tests You can manually perform SMART disk drive tests or RAID check and repair operations. To perform a disk drive test or a RAID chec k and repair operation: 1. Choose Operation > Utilities > Disk/RAID Utilities > Manual Disk/RAID Tests. 2. To perform a SMART disk drive test: a. In t[...]

Chapter 16: Diagnostic Console 297 d. After the test is complete, you can view the results in the Repair/Rebuild RAID screen. See Repai r or Rebuild RAI D Disks (on page 299). If a non-zero value displays in the Mis- Match column for the given Array, indicating that there may be a problem, you should contact Raritan Techni cal Su pport for assistan[...]

Chapter 16: Diagnostic Console 298 Schedule Disk Tests You can schedule SMART-based test s of the disk drives to be periodically performed. Firmware on the disk d rive wil l perform these tests, and you can view the test results in the Repair/ Rebuild screen. See Repair or Rebuild RAID Disks (on page 299). SMART tests can be p erformed while CC-SG [...]

Chapter 16: Diagnostic Console 299 2. Click with the mouse or use the arrow keys to navigat e and press the Space bar to select a test type, ma rking it with an X. Different types of tests take a different period of time.  A Short test takes about 2 minut es to complete when the system is lightly loaded.  A Conveyance test takes about 5 minut[...]

Chapter 16: Diagnostic Console 300 2. If any item does not show "No" un der the "Replace??" or "Rebuild??" column, contact Raritan T ech nical Support for assistance.  A good system:  A contrived system showing multiple pro blem s: The system will update displaye d information when you move between Disk Drive Sta[...]

Chapter 16: Diagnostic Console 301 4. Selecting either Replace Di sk Drive or Rebuild RAID Array, and follow onscreen instru ction s unt il you finish the operation. View Top Display with Diagnostic Console Top Display allows you to view the list of currently-ru nning processes and their attributes, as well as overall sy stem he alth. To display th[...]

Chapter 16: Diagnostic Console 302  NTP is not enabled or not configured properly:  NTP is properly configured and ru nning:[...]

Chapter 16: Diagnostic Console 303 Take a System Snapshot When CC-SG does not function properly , it is extremely helpful if you can capture the information stored in CC-SG, such as the system lo gs, configurations or database, and provid e it to Raritan T echnical Support for analysis and troublesho oting. 1: Take a snapshot of CC-SG: 1. Choose Op[...]

Chapter 16: Diagnostic Console 304 2: Retrieve the CC-SG snapshot file: 1. Using a supported Internet browser, type this URL: http(s)://<IP_address>/upload/ where <IP_address> is the IP address of the CC-SG. Note the forward slash (/) followi ng /upload is mandatory. For example, https://10.20.3.30/upload/ . 2. The Enter Network Passwor[...]

305 If you have a CC-SG and Power IQ, ther e are several s way s to use them together. 1. Control power to Power IQ IT devices vi a CC-SG. For example, if you want to control power to a Power IQ IT device which is also a CC-SG nod e, you can u se a Power IQ Proxy interface to give power control commands in CC-SG. 2. Use CSV file imports and exports[...]

Chapter 17: Power IQ Integration 306 2. Type a name for the device in the Power IQ Device Name field. The name must be unique for the Power IQ Device providing the service. CC-SG does not accept duplicate names. See Nami ng Conventions (on page 353) for detail s on CC-SG's rules for name length s. 3. Type the IP Address or Host nam e of the de[...]

Chapter 17: Power IQ Integration 307 Import Power Strips from Power IQ You can import Dominion P X devices and their outlet names from Powe r IQ. If the Dominion PX devices are already mana ged by CC-SG, you must delete them first. The import adds the Dominio n PX devices, a nd configures and names the outlets spe cified in the CS V file. Non-Domin[...]

Chapter 17: Power IQ Integration 308 Column number Tag or value Details Default is FALSE. 7 Description Optional. Step 3: Import the edit ed CSV file into CC-SG 1. In the CC-SG Admin Client, choose Adm inistration > I mport > Import Powerstrips. 2. Click Browse and select the CSV file to import. Cli ck Open. 3. Click Validate. The Analysis Re[...]

Chapter 17: Power IQ Integration 309 4. Click Save. Step 2: Edit the CSV file and import into Power IQ: The export file contains three sect ion s. Rea d the co mments in the CSV file for instructions on how to use each section as part of a Power IQ multi-tabbed CSV import file. See the Power IQ User Guide and CSV Import Template in the Support sect[...]

310 In This Chapter V1 Model................................................................................................ 310 E1 Model................................................................................................ 311 V1 Model V1 General Specifications Form Factor 1U Dimensions (DxWxH) 24.21”x 19.09” x 1.75” 615 mm x 485 m[...]

Appendix A: Specifications for V1 and E1 311 Operating Humidity 5% - 95% RH Altitude Operate properly at any altitude between 0 to 10,000 feet, storage 40,000 feet (Estimated) Vibration 5-55-5 HZ, 0.38mm,1 minut es pe r cycle; 30 minutes for each axis (X,Y,Z) Shock N/A E1 Model E1 General Specifications Form Factor 2U Dimensions (DxWxH) 27.05”x 1[...]

Appendix A: Specifications for V1 and E1 312 Operating Non-Operating Tempera ture -40°-70° C Humidity 5-90%, non-condensing Altitude Sea level to 40,000 feet Vibration 10 Hz to 300 Hz sweep at 2 g con stant acceleration for one hour on each of the perpendicul ar axes X, Y, and Z Shock 30 g for 11 ms with a ½ sine wave for each of the perpendicul[...]

313 This appendix contain s ne twork re quirements, including add resses, protocols, and ports, of a typical CC-SG deployme nt. It includes information about how to configure your netwo rk for both external access and internal security and routing poli c y enforcement. Details are provided for the benefit of a TCP/IP net work administrator. The TCP[...]

Appendix B: CC-SG and Network Configuration 314 Port Number Protocol Purpose Details Raritan device that will be externally accessed. The other ports in the table must be opened only for accessing CC-SG. AES-128/AES-256 encrypted if configured. 80 and 443 for Control System nodes 80, 443, 902, and 903 for Virtual Host and Virtual Machine Nodes TCP [...]

Appendix B: CC-SG and Network Configuration 315 CC-SG and Raritan Devices A main role of CC-SG is to manage and cont rol Raritan devices, such as Dominion KX II. Typically, CC-SG communicates with these devices over a TCP/IP network (local, WAN, or VPN) and both TCP and UDP protocols are used as follows: Communication Direction Port Number Protocol[...]

Appendix B: CC-SG and Network Configuration 316 Communication Direction Port Number Protocol Configurable? Details CC-SG to CC-SG 5432 TCP no From HA-JDBC on Primary to Backup PostgreSQL DB server. Not encrypted. CC-SG to CC-SG 8732 TCP no Primary-Backup server sync clustering control data exchange. MD5 encrypted. CC-SG to CC-SG 3232 TCP no Primary[...]

Appendix B: CC-SG and Network Configuration 317 Communication Direction Port Number Protocol Configurable? Details PC Client to CC-SG 443 TCP no Client-server communi cati on. SSL/AES-128/AES-256 encrypted if configured. PC Client to CC-SG 80 TCP no Client-server communication. Not encrypted. If SSL is enabled, Port 80 is redire cted to 443. PC Cli[...]

Appendix B: CC-SG and Network Configuration 318 Communication Direction Port Number Protocol Configurable? Details Client to Raritan Device to Out-of-Band KVM Node (Direct Mode) 5000 (on Raritan Device) TCP yes Client-server communication. SSL/AES-128/AES-256 encrypted if configured. Client to Raritan Dominion SX Device to Out-of-Band Serial Node ([...]

Appendix B: CC-SG and Network Configuration 319 Communication Direction Port Number Protocol Configurable? Details CC-SG to SNMP Manager 162 UDP yes SNMP stand ard CC-SG Internal Ports CC-SG uses several ports for intern al function s, and its local firewall function blocks access to these port s. Ho wever, some external scanners may detect these a[...]

Appendix B: CC-SG and Network Configuration 320 VNC Access to Nodes Port 5800 or 5900 must be open for VNC acce ss to node s. SSH Access to Nodes Port 22 must be open for SSH access to nodes. Remote System Monitori ng Port When the Remote System Monitoring feature i s enabled, port 19150 is opened by default. See Configure Remote System Monitoring [...]

321 This table shows which pri vilege must be assigned for a user to have access to a CC-SG menu item. *None means that no particular privilege is required. Any use r who has access to CC-SG will be able to view and access these menus and commands. Menu > Sub- menu Menu Item Required Privilege Description Secure Gateway This menu is available fo[...]

Appendix C: User Group Privileges 322 Menu > Sub- menu Menu Item Required Privilege Description Devices This menu and the Devices tree is available only for users with any one of the following privileges: Device, Port, and Node Management Device Configuration and Upgrade Managem ent Discover Devices Device, Port, and Node Management > Device [...]

Appendix C: User Group Privileges 323 Menu > Sub- menu Menu Item Required Privilege Description Management or Device Configuration and Upgrade Management > Launch User Station Admin Device, Port, and Node Management > Disconnect Users Device, Port, and Node Management or Device Configuration and Upgrade Management > Topology View Device[...]

Appendix C: User Group Privileges 324 Menu > Sub- menu Menu Item Required Privilege Description > By Port Number Device, Port, and Node Management or Device Configuration and Upgrade Management Nodes This menu and the Nodes tree is available only for use rs with any one of the following privileges: Device, Port, and Node Management Node In-Ba[...]

Appendix C: User Group Privileges 325 Menu > Sub- menu Menu Item Required Privilege Description Control Configure Blades Device, Port, and Node Management Ping Node Device, Port, and Node Management Bookmark Node Interface Node In-band Access or Node Out-of-band Access > Node Sorting Options > By Node Name Any of the following: Device, Por[...]

Appendix C: User Group Privileges 326 Menu > Sub- menu Menu Item Required Privilege Description Node Power Cont rol > Tree View Any of the following: Device, Port, and Node Management or Node In-band Access or Node Out-of-band Access or Node Power Cont rol Associations This menu is available o nly fo r users with the User Security Management [...]

Appendix C: User Group Privileges 327 Menu > Sub- menu Menu Item Required Privilege Description > Devices > Device Asset Report Device, Port, and Node Management or Device Configuration and Upgrade Management > Device Group Data Device, Port, and Node Management > Query Port Device, Port, and Node Management > Nodes > Node Asse[...]

Appendix C: User Group Privileges 328 Menu > Sub- menu Menu Item Required Privilege Description Upgrade Management Configuration CC Setup and Control Cluster Configuration CC Setup and Control Neighborhood CC Setup and Cont rol Security CC Setup and Control Notifications CC Setup and Control Tasks CC Setup an d Control Compatibility Matrix Devic[...]

Appendix C: User Group Privileges 329 Menu > Sub- menu Menu Item Required Privilege Description Device, Port, and Node Management Export Devices CC Setup and Control and Device, Port, and Node Management Export Power IQ Data CC Setu p an d Control and Device, Port, and Node Management System Maintenance Backup CC Setup and Control Restore CC Set[...]

330 CC-SG provides the following SNMP traps: SNMP Trap Description ccUnavailable CC-SG applic ation is unavailable. ccAvailable CC-SG application is available. ccUserLogin CC-SG u se r logge d in. ccUserLogout CC-SG user logged out. ccPortConnectionStarted CC-SG session started. ccPortConnectionStopped CC-SG session stopped. ccPortConnectionTermi n[...]

Appendix D: SNMP Traps 331 SNMP Trap Description ccDiagnosticConsoleLo gout User has logged out of the CC-SG Diag nosti c Console. ccUserGroupAdded A new user group has been added to CC-SG. ccUserGroupDeleted CC-SG user group has been deleted. ccUserGroupModified CC-SG user group has been modified. ccSuperuse rNam eChanged CC-SG Supe ruser username[...]

332 This section contains more information about CSV file import s. In This Chapter Common CSV File Requirem ent s ......................................................... 333 Audit Trail Entrie s for Importing ............................................................. 334 Troubleshoot CSV File Problems .........................................[...]

Appendix E: CSV File Imports 333 Common CSV File Requirements The best way to create the CSV file is to export a file from CC-SG, and then use the exported CSV file as an example for creating your own. The export file contains comments at the top that describ e each item in the file. The comments can be used a s instructions for creating a file for[...]

Appendix E: CSV File Imports 334 Audit Trail Entries for Importing Each item imported into CC-SG is logged in the Audi t Trail. Skippe d duplicates are not logged in the Audit Trail. The Audit Trail includes an entry for the following a ctio ns, und er the Message Type "Configuration." • Import of CSV file started • Import of CSV file[...]

Appendix E: CSV File Imports 335 Troubleshoot CSV File Problems To troubleshoot CSV file validation: Error messages appea r in the Problems area of the Import page. The error messages identify problems that a re foun d in the CSV file during validation. You can save the list of errors to a CSV file. Each error includes the line number wh ere the e [...]

336 • Launching CC-SG from your web brow ser requi re s a Java plug-in. If your machine has an incorrect version, CC-SG will guide you through the installation steps. If your machine do es n ot have a Java plug-in, CC-SG cannot aut omatically lau nch. In this case, you must uninstall or disable your old Java versio n and provide serial port conne[...]

Appendix F: Troubleshooting 337 • If you access more than one CC-SG unit using the same client and Firefox, you may see a "Secure Conne ction Fail ed" message that says you have an invalid certificate. You can resume access by clearing the invalid certificate from your browser. a. In Firefox, choose Tools > Options. b. Click Advanced[...]

338 CC-SG comes with a few diagnostic utilities which ma y be extremely helpful for you or Raritan Technical Support to analy se and debug the cause of CC-SG problems. In This Chapter Memory Diagnostic ................................................................................ 338 Debug Mode ....................................................[...]

Appendix G: Diagnostic Utilities 339  Capture the Memtest86+ screen containing the memory errors and contact Raritan Technical Suppo rt for assi stance.  Shut down CC-SG and re-install the memory DIMM modules to ensure the contact is good. Then perform the Memte st86+ diagnostic to verify if the memory issue is resolved. 2: Terminate the Memt[...]

Appendix G: Diagnostic Utilities 340 CC-SG Disk Monitoring If CC-SG disk space exhaustion in one or more f ile sy stems occurs, it may negatively impact your operation and even result s in the loss of some engineering data. Therefore, you shoul d monit or the CC-SG disk usage and take corrective actions to prev ent or re solve potential issues. You[...]

Appendix G: Diagnostic Utilities 341 File system Data Corrective action /sg/DB CC-SG database Contac t Raritan Te chnical Support /opt CC-SG backups and snapshots 1. Save any new snapshot files on a remote client PC. See Take a System Snapshot (on page 303 ) for the retrieval procedure. 2. Enter the System Snapshot menu (see " Take a System Sn[...]

Appendix G: Diagnostic Utilities 342 Note: For file system problem s that ar e not m entioned in this section, or when the corrective actions you take cannot re solve the problems, contact Raritan Te chni cal Support for assistan ce.[...]

343 CC-SG can be configured to point to an RSA RADIUS Server that supports two-factor authent ication via an associated RSA Authentication Manager. CC-SG acts as a RADIUS clie nt and sends user authentication requests to RSA RADIUS Server. T he authentication request includes user id, a fixed password, and a dynamic toke n co de. In This Chapter Su[...]

344 In This Chapter General FAQs ........................................................................................ 344 Authenticat ion FAQs .............................................................................. 346 Security FAQs ....................................................................................... 347 Accountin g FA[...]

Appendix I: FAQs 345 Question Answer Can I upgrade to newer versions of CC-SG software as they become available? Yes. Contact your authori zed Ra ritan sales representative or Raritan, Inc. directly. How many nodes and/or Dominion units and/or IP- Reach units can be connecte d to CC-SG? There is no specified limit to the number of nodes and/or Domi[...]

Appendix I: FAQs 346 Question Answer model with IP-Reach and the IP User Station (UST-IP). The network model scale s throu gh use of the TCP/IP network and aggregates access through CC-SG, so users don't have to know IP addresse s or the topology of access device s. It also provide s the convenience of single sign -on. Will CC-SG auto-detect a[...]

Appendix I: FAQs 347 Question Answer security t ools su ch as LDAP, AD, RADIUS, and so on? TACACS+, RADIUS, and LDAP. Why does the erro r me ssage "Incorrect username and/or password" appear after I correctly enter a valid username and password to log into CC-SG? Check the user account in AD. If AD is set to "Logon To" specific [...]

Appendix I: FAQs 348 Question Answer WAN, but LAN, too)? Does CC-SG support CRL List, that is, LDAP list of invalid certificates? No. Does CC-SG support Client Certificate Request? No. Accounting FAQs Question Answer Accounting The event times in the Audit Trail report seem incorrect. Why? Log event times are logged according to the time settings o[...]

Appendix I: FAQs 349 Grouping FAQs Question Answer Grouping Is it possible to put a given server in more than one group? Yes. Just as one user ca n belon g to multiple groups, one device can belong to multiple groups. For example, a Sun in NYC could be part of Group Sun: "Ostype = Solaris" and Group New York: "location = NYC." W[...]

Appendix I: FAQs 350 Interoperability FAQs Question Answer Interoperability How does CC-SG integrate with Blade Chassis products ? CC-SG can support any device with a KVM or se rial interface as a transparent pass-through. To what level is CC-SG able to integrate with third party KVM tools, down to third party KVM port level or simply box level? Th[...]

Appendix I: FAQs 351[...]

352 The following keyboard sh ortcuts can b e used in the Java-based Admin Client. Operation Ke y board Shortcut Refresh F5 Print panel Ctrl + P Help F1 Insert row in Association s table Ctrl + I Appendix J Keyboard Shortcuts[...]

353 This appendix include s inf ormation about the naming conventions used in CC-SG. Comply with the maximum character lengths when na ming all the parts of your CC -SG configuration. In This Chapter User Info rmation .................................................................................... 353 Node Information ..........................[...]

Appendix K: Naming Conventions 354 Field in CC-SG Number of characters CC-SG allo ws Audit Information 256 Location Information Field in CC-SG Number of characters CC-SG allo ws Department 64 Site 64 Location 128 Contact Information Field in CC-SG Number of characters CC-SG allo ws Primary Contact Name 64 Telephone Number 32 Cell Phone 32 Secondary[...]

Appendix K: Naming Conventions 355 Field in CC-SG Number of characters CC-SG allo ws periods are converted to hyphens. Device Description 160 Device IP/Hostname 64 Username 64 Password 64 Notes 256 Port Information Field in CC-SG Number of characters CC-SG allo ws Port Name 32 Associations Field in CC-SG Number of characters CC-SG allo ws Category [...]

356 Prior to version 4.0, CC-SG Diagno stic Console displays a number of messages on the screen each time whe n it boots up. These messages are standard Linux diagnostic and warning messages and usually do not imply any system problems. The table o ffers a short introduction to a few frequent messages. Message Description hda: The me ssage indicate[...]

357 A About Administrator Console • 264, 271 About Applications for Accessing Nodes • 207 About Associations • 21 About CC-SG LAN Ports • 211, 212, 215 About CC-SG passwords • 237 About Connection Modes • 78, 219 About Default Applications • 209 About Interfaces • 78, 219 About LDAP and CC-SG • 173 About Network Setup • 3, 10, 2[...]

Index 358 Adding, Editing, and Deleting User Groups • 84, 132 Adding, Editing, and Deleting Users • 136 Administration • 355 Administrator Console • 271 Administrator Console Screen • 272 Advanced Administration • 137, 138, 165, 169, 206 AES Encryption • 234 All Users Data Rep ort • 18 5 Allow concurrent logins per username • 239 [...]

Index 359 Checking and Upg radi ng Application Versions • 11, 207 Checking the Compatibility Matrix • 11 Clear the Browser's Cache • 202, 203, 336 Clear the Java Cache • 202, 203, 208, 336 Client Browser Requireme nts • 4 Command Tips • 255, 257 Common CSV File Requirement s • 24, 55, 113, 140, 333 Configure a Combination of Dire[...]

Index 360 Delete a User • 138 Delete a User Group • 134 Delete a Virtual Infrastructure • 96 Delete a Virtual Machine Node • 95, 96 Delete an Application • 209 Delete an Interface • 94, 109 Delete Control Systems and Virtual Hosts • 95, 96 Delete Firmware • 211 Deleting a Device • 30, 39 Deleting a Policy • 152 Deleting a Port ?[...]

Index 361 Finding Your CC-SG Serial Numb er • 261 Flow for Authentication • 161 G General FAQs • 344 Get Help for SSH Commands • 254 Getting Started • 10 Grouping FAQs • 349 H Hide or Show Report Filters • 182 How to Create Association s • 22 I IBM LDAP Configuration Settings • xvi, 176 Import Categories and Elements • 25 Import[...]

Index 362 Notification Manager • 245, 247 O Older Version of Application Opens After Upgrading • xvi, 12, 208 OpenLDAP (eDirectory) Configuration Settings • 176 P Paragon II System Controller (P2-SC) • 67 Pausing CC-SG's Management of a De vice • 65 PC Clients to CC-SG • 316 PC Clients to Nodes • 317 Perform Disk or RAID Test s ?[...]

Index 363 Save, Upload, and Delete Device Backup Files • 63 Saving and Deleting Backup Files • 194, 196, 198 Schedule a Device Firmware Upgrade • 248, 250, 252 Schedule a Task • 170, 172, 248, 252 Schedule a Task that is Similar to Another Task • 252 Schedule Disk Tests • 298 Schedule Sequential Tasks • 247 Scheduled Reports • 191, [...]

Index 364 User Information • 353 User Management • 13, 18 Users and User Groups • 50, 124, 129, 153, 162, 177, 178 Users CSV File Requirements • xvi, 140 Using Chat • 111 Using Custom Views in the Admin Client • 155 Using Reports • 180 V V1 Environmental Requirements • 310 V1 General Specifications • 310 V1 Model • 310 View by C[...]

[...]

U.S./Canada/Latin America Monday - Friday 8 a.m. - 6 p.m. ET Phone: 800-724- 809 0 or 732- 764- 8886 For CommandCenter NOC: Press 6, then Pr ess 1 For CommandCenter Secure Gateway : Press 6, then Press 2 Fax: 732-764-88 87 Email for CommandCenter NOC: tech-ccnoc@rarita n .com Email for all o ther products: tech @raritan.com China Beijing Monday - F[...]