NetMRI's Job Management feature set (Config Management –> > Job Management) enables automation of processes for monitoring and analyzing the network, and to perform routine maintenance. Job Management is also the enabling feature in the Automation Change Manager (ACM) system, which leverages support by the NetMRI appliance to automate tasks in the Infoblox NIOS grid network. Job Management and Job Automation operations involve the following NetMRI tools:
...
A job schedules a script to run against selected devices. You schedule jobs to run once or on a regular basis, at times you specify. Create and manage scheduled jobs at Config Management –> > Job Management –> > Scheduled Jobs tab.
You can import existing scripts using the Import icon on the Scripts tab. When you do so, ensure that your script uses the UTF-8 encoding.
...
At the top right of the page, click New. The Fill Out Job Details Wizard opens.
Enter a Job Name.
Click the Approved option if your user account allows it. (A job cannot be scheduled until approved. Another admin account may need to approve the scheduled job.)Type a Job Description of the job. Bulk push mode is supported only on Juniper and Cisco devices. Cisco downloads via TFTP, and Juniper configs download via the HTTP protocol.
Choose a job script or template from Scripts or Templates (selectable by tabs). If required by the script or template, enter data and/or select options. Any variables defined in the script will appear in a list to the right.
Choose the Push Mode option: Line by Line, Bulk, or Text File. This determines the method by which the config file is written to devices that are part of the job. For Push Mode, choosing Line by Line sets the template config sequence to be pushed to the device involved in the Job, one line at a time. Pushed in Bulk, the entire configuration is staged in NetMRI and then downloaded to the device. If any non-Cisco/Juniper device is part of the device group selected for the job, the job will revert to Line by Line mode. After choosing a script or template from their respective lists, you may see one or more input values that are required as a part of the job. Templates may furnish default values, or you can enter desired values in the defined fields.
When finished, click Next. If custom fields are defined for jobs, you will see the Fill out Custom Information screen. If none are defined, proceed to Step 7 below.
Fill in any other data associated with the job.
Click Next. The Select Device Groups or Devices page appears.
Click device groups and/or devices and click the –> > icon to add the group to the right pane of the page.
Click Next. The Schedule when Job should run page appears.
Specify the schedule for the job, including the Recurrence Pattern (Once, Hourly, Daily, Weekly, or Monthly), and the Execution Time (specify in half-hour increments). The selected Recurrence Pattern determines additional schedule settings based on the selection.
Click Next. The Enter User CLI Credentials page appears, for cases when user account CLI credentials are required for the job. If not, proceed to the next step. Choose Use the requester's stored CLI credentials, or Use the approver's stored CLI credentials. Or, choose Use these CLI credentials and enter and verify the Username and Password values and the equipment-associated Enable Password required for the account.
Click Next.
In the Review and save screen, review the job specifications. If changes are needed, click the < Previous button to return to an earlier screen.
Click Save.
...
In the Actions column, click the icon and choose Edit from the menu. The Job Wizard opens to the Summary of Job screen.
Click Edit. The Fill out Job Details screen appears.
Edit the job as needed. Use the Next –> > and <– Previous buttons to navigate the wizard.
Navigate to the Review and Save screen, and then click Save.
...
To run a script as a job immediately, perform the following:
Go to Config Management –>> Job Management –>> Scripts tab.
Hover the mouse over the Action menu for your desired script, and choose Run Now from the Action menu.
The Script Run Now window appears. You can choose to run a script (the default) or a template as a job. Templates support a push mode; scripts do not.If any input is required by the selected script, enter it in the right panel and click Next. (Note that in this step, the selected script is highlighted in the left pane of the window, listed with all other scripts in the library.)
If you have custom fields for data entry, add that information and click Next. If not, simply click Next.
Select the Device Groups or Devices to run the job against from their respective tabs and click the (–>>) button to add them to the job, and then click Next.
Click the -> and <- buttons to navigate pages of the Device Groups and Devices lists.
In the Devices list, use the Device Groups drop-down menu to choose the device group for device selection.
In the Devices list, use the Search box and type in a string of any length to search for a device name or an IP address. You can also search by the values shown in the Network View field.On the Review and Run page, review your settings. If necessary, use the <- Previous button to return to previous steps to make changes. When you are finished, click Run Now to begin the script or template execution.
...
The Config Templates tab (Config Management –> > Job Management tab –> > Config Templates) provides an editing environment to develop standard configuration files. This feature is required for provisioning network devices using the Automation Change Manager's Bare Metal Provisioning (BMP) task, specifically for Cisco and Juniper routers and switches.
...
If any template variables do not have values declared against them, the appliance responds with an "All variables in the template must be replaced with values before testing as a policy" message.
To export a template, click Export, and then save the file.
To delete a template, click Delete, and then confirm the deletion.
Creating New Jobs From Config Templates
...
The Config File Template window (Config Management –> > Job Management –> > Config Templates –> > New) provides a Template Variables field as part of creating a template. As previously noted, variables are optional in template definition, but knowing their format is useful.
Defining variables for config templates uses the same format as for script variables, in which three entries are provided for each variable (the variable name, input type and input format) in the Template Variables field. A simple example is given below:
...
Lists are a key component in the Automation Change Manager (ACM) feature set. The Lists page (Config Management –> > Job Management –> > Lists) allows the creation, editing, importing, and exporting of lists to provide external lists of data to Perl/Python script variables, CCS script variables, and configuration template variables.
...
To import a list onto the NetMRI Lists page, perform the following:
On the Config Management –> > Job Management –> > Lists page, choose Import.
Click Browse and locate the CSV file in the file selector. Click Open after selecting the file.
Click Import to import the file onto the Lists page.
To create a new list, perform the following:
On the Config Management –> > Job Management –> > Lists page, choose Add.
Enter a List Name.
In the Description field, enter a meaningful description for the new list.
Type or copy and paste the list text into the text entry field.
Click Save at the bottom of the screen when you are finished.
To edit a list, perform the following:
On the Config Management –> > Job Management –> > Lists page, select a list in the left pane. The right pane refreshes to show the contents of the list.
Click the down arrow icon on a column header and choose Edit Column. The Column Name dialog box appears. Enter the new column name and click OK.
Click Add Row at the bottom right to add a new row to the list table, or click a check box for a row and click Delete Row to modify the set of table rows in the list.
Click Save when done.
To delete a list, perform the following:
On the Config Management –> > Job Management –> > Lists page, select the list to remove and choose Delete.
To export a list, perform the following:
On the Config Management –> > Job Management –> > Lists page, select the list to export and choose Export.
The browser prompts to open the data as a new Excel .CSV file or to save the data as a new file.
...
The Automation Change Manager (ACM) relies on a series of lists in the Config Management –> > Job Management –> > Lists page for use in automated jobs. You can edit these lists when necessary. The installed ACM lists consist of the following:
ACM Allowed DHCP Servers – List of any DHCP servers in the enterprise network, that are not to be included in any Rogue DHCP server reports. Defines to NetMRI and to the NIOS system that "these are the established DHCP servers in the network; do not report against these devices." Any router or other device that is not on this list, which offers DHCP-based IP configuration to clients connecting to the network will cause an issue to be fired by the Automation Change Manager.
ACM BMP Device Provisioning – Bare Metal Provisioning list, to identify each switch to be provisioned. New switches are identified by their MAC address, the management IP address and site settings, including a Site Settings Name which corresponds to a name in the ACM BMP Site Settings list. The MAC address is the hardware MAC address assigned to the device coming out of the factory, and which is usually stamped on the rear of the chassis or on the shipping box for the device. (This list is used in the topic Job Management and Automation Change Manager.)
ACM BMP Site Settings – Bare Metal Provisioning list to define the default switch port configuration. Consider it a branch office list–to contain the standardized configuration templates for any new devices installed in a given branch office network. This list defines values such as the Management VLAN ID and its VLAN name, the port designated for management VLAN traffic, the domain name, Syslog and Network Time Protocol server information, and VLANs on the provisioned device to be configured on individual access ports or ranges of access ports (VLAN1 Ports and VLAN2 Ports). (This list is used in the topic Job Management and Automation Change Manager.)
ACM BMP Switch Model Interface Defs – Bare Metal Provisioning list defining the interfaces for the device types expected to be provisioned through the job. If the switch model to be provisioned is already in this table, no further information is needed here. The entries follow the standard slot/port designator formats for Cisco and Juniper devices such as Cisco 2950 and 3750 switches and Juniper EX2200 switches. You may need to create your own definitions within this list (or even new lists) to match switch port designators for provisioning other device types. (This list is used in the topic Job Management and Automation Change Manager.)
ACM Script Settings – Defines the VLAN to which any rogue DHCP server, detected and isolated on the network, is placed for remedial action. By default, when this task executes, the isolation VLAN is defined as VLAN 99.
...
In some cases, a switch type may not be defined in the LIsts page. To define a new list entry:
Go to Config Management –> > Job Management –> > Lists.
Select the ACM BMP Switch Model Interface Defs list in the left pane.
Click Add Row.
Under Vendor Model, enter the desired model name (Cisco or Juniper). Example: cisco_catalyst6500. The name cited here must match that for a Config Template.
Enter the slot/port values, including port ranges, separated by commas, in the Interfaces column.
Click Save.
...
You create and manage triggered jobs in the Config Management –> > Job Management –> > Triggered Jobs tab. You define triggered jobs using a Triggered Jobs Wizard. The table of jobs includes the following columns of information:
...
| Note |
|---|
Note
|
...
Set the NIOS DHCP appliances to serve DHCP Options 66 for Cisco devices and DHCP Option 68 for Juniper devices. Each setting, if used, also requires entry of the IP address for NetMRI.
Set the NetMRI inactivity timeout (60 minutes by default; In NetMRI, go to Settings icon –>Setup –> >Setup > Advanced Settings –> > User Interface category –> > Inactivity Timer), and set this value to a higher time duration than for any NIOS system (in NIOS, go to Grid –> > Grid Properties).
Register the NetMRI appliance with NIOS, with or without a certificate for secure HTTPS communication.
Obtain the factory MAC address for each of the new devices to be installed into the network, plus the initial IP address to be assigned to the devices.
The admin account running ACM jobs on NIOS, and performing ACM setup on the NetMRI system, must be properly defined on both systems. The user name must be the same on both systems. Access privileges must be equivalent on both sides of the configuration; the account Roles/Privileges defined in NetMRI determine the ACM features to which the user has access in NIOS. The ACM system supports single sign-on between the NIOS and NetMRI appliances When you sign on to one appliance in ACM, the other appliance automatically recognizes the login.
Set the admin accounts to be notified when ACM Issues and events pop up. The best location to view event information is the Task Viewer in NIOS' Automation Tasks Dashboard. Triggering issues and events are reported on NetMRI's main Issues page in Network Analysis –> > Issues. Additional configuration may be needed to ensure notifications are sent to the right people. You may need to define NetMRI Issue notifications in the Settings icon –> > Notifications section –> > Subscriptions page. Notifications are sent in three ways: Syslog messages, e-mail and SNMP traps.
All NIOS appliances running DHCP services must be configured to forward syslog messages to NetMRI. This ensures the Automation Change Manager detects the correct events for triggering jobs.
Activate a TFTP server with configuration stub files and full configuration files for the device types to be supported. NetMRI has a built-in TFTP server that is always running by default and is accessible by the same methods as any TFTP server.
...
In NetMRI, go to Settings icon –>General >General Settings –> > Advanced Settings and go to the NIOS Administration section.
Under NIOS User Name (on Page 2 of Advanced Settings), click the gear icon and choose Edit.
Enter the user name of a NIOS admin account with privileges to validate DHCP servers located on the network by NetMRI. Click OK when finished.
Under NIOS Password (on Page 2 of Advanced Settings), click the gear icon and choose Edit.
Enter the password for the admin account you entered in Step 3, re-enter it to confirm; click OK when finished.
...
If the discovered device/end host is found to be running a DHCP server, NetMRI raises a Rogue DHCP Server Detected issue and a series of events takes place, further described in the topic Activating Rogue DHCP Server Remediation.
NIOS DHCP configuration intuitively supports custom DHCP options, which follow the RFC 2132 guidelines. DHCP configuration settings can quickly apply across the entire NIOS grid (in NIOS, Grid Manager –> > DHCP –> > Grid DHCP Properties), or to a specific DHCP range on a specific member. The same guideline applies if NetMRI operates with a standalone NIOS appliance running the DHCP service in the network. You can also create new DHCP ranges on any NIOS appliance running DHCP, to support Cisco and Juniper DHCP options for ACM bare-metal provisioning.
...
Ensure the DHCP Options configuration is defined for all NIOS DHCP servers/DHCP ranges that will inter-operate with the Automation Change Manager.
Configure the NIOS appliance to forward Syslog notifications to NetMRI; on the NIOS appliance, choose Grid –> > Grid Manager –> > Members –> > Grid Properties. Choose UDP as the transport protocol.
Ensure the NIOS appliance is running the NTP protocol:
From the Grid tab, select the Grid Manager tab -> Members tab -> Grid_member check box.
Expand the Toolbar and click NTP -> NTP Member Config. If the Enable this Member as an NTP Server checkbox is enabled, nothing else needs to be done and you continue to Step 4.
Ensure the TFTP server is up and running with the desired initial configuration files ready for download, and reachable within the network.
The required admin user accounts should receive the appropriate notifications when Bare Metal Provisioning jobs occur. Consult the topic Defining a Job Notification for more information.
Ensure that the proper license is installed in the NetMRI appliance by going to Settings icon –>Setup –> >Setup > Settings Summary; check the Module Settings list. Automation Change Manager should read Enabled. (If necessary, also ensure the proper license is already installed in the NIOS system.)
Register NetMRI with the NIOS system. This is done in NIOS through the following:
From the Dashboards tab, select the Tasks tab.
In the Automation Tasks pane, click the down arrow gadget and select ACM Registration.
Under ACM Settings, do the following:
Enter the IP address or resolved host name of the Automation Change Manager system supporting the Automation task pack. Optionally, you can load a CA certificate from NetMRI to NIOS to secure communications between the two systems.
Enter the ACM Admin Password.
Click Register to commit settings. After registration, the ACM Registration menu item changes to read ACM Deregistration to support disconnection from the Automation Change Manager appliance.
To set NetMRI to receive syslog messages from the NIOS appliances running DHCP, do the following on the NIOS system:
From the Dashboards tab, select the Tasks tab.
In the Automation Tasks pane, click the down arrow gadget and select ACM Registration.
Under ACM Settings, do the following:
Enter the IP address or resolved host name of the Automation Change Manager system supporting the Automation task pack. Optionally, you can load a CA certificate from NetMRI to NIOS to secure communications between the two systems.
Enter the ACM Admin Password.
Click Register to commit settings. After registration, the ACM Registration menu item changes to read ACM Deregistration to support disconnection from the Automation Change Manager appliance.
Set up the DHCP protocol in the NIOS appliances. On each NIOS system running DHCP that you expect to participate in auto-configuring network devices, set the DHCP ranges as follows. For the NIOS Grid, do the following:
Choose the Grid tab –> > Grid Manager –> > Services. Select DHCP. All members in the NIOS network running DHCP show a green box under the DHCP column, indicating members acting as DHCP servers.
Click the link for the member with a DHCP range you want to use for serving DHCP configuration to new devices through ACM. The Members Home page for the select appliance appears, displaying the list of DHCP ranges running on the appliance.
Select the checkbox for the DHCP Range to modify and click Edit.
Click IPv4 DHCP Options and scroll to Custom DHCP Options. For Cisco devices, choose option 66 and enter the FQDN or the IP address of the TFTP server (which can be the NetMRI system, a NIOS appliance, or another system).
Click Save and Close.
Follow the same steps for any other DHCP range as necessary.
In the NetMRI appliance, choose Settings icon –> > General Settings –> > Advanced Settings and make sure that the Discovery Ignore Duplicate MACs and the Discovery Truncate IP History settings are turned on.
Choose Settings icon –> > Setup –> > Credentials –> > CLI and add a new USER credential of admin/infoblox, with an ENABLE password of infoblox. These credentials are pushed to the bare metal device after it boots with its TFTP configuration.
Choose Settings icon –> > Setup –> > Credentials –> > SNMPv1/2c and click the autoconfig community string (it defaults to Priority 16). Click Edit and change its Priority value to 1.
In the SNMPv1/2c page, click New and create a new community string infoblox. Assign it a Priority value of 2 and click Add.
Continue to the following topic, Deployment for Bare Metal Provisioning, Pt. 2
To set NetMRI to receive syslog messages from the NIOS appliances running DHCP, do the following on the NIOS system:
Choose the Grid tab – >Grid > Grid Manager –> > Members. Any member in the NIOS network running DHCP shows a green box under the DHCP column, indicating the members of the network that act as DHCP servers.
Click the checkbox for at least one of the members running DHCP. (You can select more than one to perform this action.)
Choose Grid Properties, and then choose Monitoring.
Enable the Log to External Syslog Servers checkbox.
To define NetMRI to receive Syslog messages, click the Add icon of the External Syslog Servers table and enter the Address information in the new row. Choose UDP as the transport. (Other table row settings should normally be left at their defaults.)
Click Save and Close. Individual NIOS appliances may need to be restarted for the changes to take effect.
...
If you plan to create any new config templates for different device models beyond the models built in to the Automation Change Manager release, do so now. Note that the set of variables defined in the config templates are fixed. They are set by the values in the columns in the TAE BMP Device Provisioning list or from the TAE BMP Site Settings list.
In the TAE BMP Switch Model Interface Defs list: If the switch model to be provisioned is already in the table, no information needs to be entered about interface configuration. If you have new model information, add the Vendor Model Key value and interfaces values for the new device types from Juniper or Cisco. Click Save when done. The Vendor Model Key must be named identically to the config template referenced by the system. For example, the Config Template
cisco_catalyst295024matches the corresponding Vendor Model Key field in the list.
The TAE BMP Switch Model Interface Defs list maps the device model to the ports available on that type of device. The Model column is the name of the device model as reported by the device. The same model name is also used to select the configuration template to be used for the device.
...
In the TAE BMP Site Settings list: this list defines default configurations of switch ports. When you have a standard configuration for (example) Sales Branches, you set that configuration once in this list. Define any new list records you need for new site settings. New table rows may be added for this data set.
Among other settings, ports are assigned to VLANs in this list. Other vital settings include the Site Name, domain name, Syslog and NTP server and the site code. You also use the {} brackets for port ranges in this table. Click Save when done with changes.
...
In the ACM BMP Device Provisioning list: Identify the device(s) to be provisioned, and enter the Factory MAC addresses, site-assigned management IP addresses, mask and gateway information, and the cross-reference to a BMP Site Settings list record (in the Site Settings Name field). If you have a significant number of values to enter, you can import them into the list. Click Save when done.
...
Using a terminal program, open a CLI session on the NetMRI appliance using the admin account, and enter the tftpsync command. The default device config files are copied to the
tftpbootdirectory on the NetMRI appliance.
...
Go to the NIOS appliance and open the Tasks Dashboard.
...
Click the Settings icon for the Bare Metal Provisioning task. The NetMRI instance appears in a new browser tab, displaying the Job History page. You track job execution here or in the NIOS Task Dashboard's Task Viewer.
Perl Scripts for Bare Metal Provisioning
...
Rogue DHCP remediation begins with preventing established, legitimate DHCP servers, such as NIOS appliances supporting the DHCP service, from being identified as a rogue server. You compile all legitimate DHCP servers on the network into the ACM Allowed DHCP Servers list (Config Management –> > Job Management –> > Lists);
Because the Rogue DHCP jobs are issue-driven, a suspected rogue device may first need to be detected by NetMRI. Ensure fingerprinting is enabled in the NetMRI system (Settings – Setup –> > Network Polling –> > Fingerprinting checkbox);
Also ensure that the required user accounts get the appropriate notifications when Rogue DHCP events occur.
NetMRI also scans the standard DHCP TCP and UDP ports (check settings in (Settings – Setup –> > Network Polling and enter "bootp" as the search string in the Port Scan List).
The NIOS administrator account username and password should be added to Advanced Settings (Settings icon –>General >General Settings –> > Advanced Settings –> > page to the NIOS Administrator category).
...
The upstream switch port from which the DHCP messages originated is found, and that upstream port has only a single downstream MAC address connected to it. This downstream MAC address is the culprit.
A Rogue DHCP Server Located Issue displays in NetMRI's main Issues table (Network Analysis –> > Issues) and in the NIOS Task Viewer. Then, after approval, the Isolate Rogue DHCP Server task activates.
Click the Issue name in the Title column; the Issue Viewer appears in a separate browser window. Details of the issue are substantial, including the specific Device IP address, the device MAC and type, the identity of the upstream switch and the upstream interface, and the Last Seen timestamp.
Any previously configured notifications will arrive at the admin's Inbox or through other channels.Go to the NIOS system and open the Tasks Dashboard.
Click the Settings icon for the Rogue DHCP Server Remediation task. The NetMRI instance appears in a new browser tab, displaying the Job History page. This is where you track job execution in NetMRI. The page lists the Locate and Isolate jobs and their results. You can also open the Task Viewer in the NIOS Task Dashboard.
...
Whether the match is positive or negative, triggering issues are reported on NetMRI's main Issues page in Network Analysis –> > Issues and in the NIOS Task Viewer. NetMRI Issue notifications are created, in the Settings icon –> > Notifications section –> > Subscriptions page. The system sends notifications in one of three ways: Syslog messages, e-mail and SNMP traps.
...
The Job History tab (Config Management –> > Job Management –> > Job History tab) lists all running jobs, scheduled jobs, and jobs that finish with errors. Information displayed in the table includes job status, start and end times, and run count.
...
The Details tab provides detailed information about the selected job, including start and end times for the job, the current Job status, and the IP addresses and names for any devices against which the job runs.
To view job details for a device: Click the hyperlink in the Status column. The Job Details Viewers opens for the chosen job, automatically displaying the Process Log for the selected job (see Viewing Job Details for more information).
Click the hyperlink in the IP Address column. The Device Viewer appears for the device associated with the chosen IP address (see Inspecting Devices in the Network for more details).The Issues tab lists issues raised by the job.
To view Issue details, click a hyperlink in the Title column.The Files tab lists files created using the ARCHIVE keyword. You can view and download files from within this tab. (If the ARCHIVE keyword is not used in the script, this tab is empty.)
Click the Cancel icon for that device. The Cancel icon appears in the Actions column for a device only if the job is currently pending or running on that device. The Actions column is empty if the job has been completed for all devices.
Turn auto-refresh On or Off from the Refresh dropdown.
Click Cancel All to cancel all running Jobs in the page.
...
If a script includes the ability to run multiple sessions, you can see the sessions running under the JobDetailsViewer–>Connections JobDetailsViewer>Connections drop-down list.
The Script tab displays the full script run against the device;
The StatusLog tab shows the results of various internal script operations. Some of the information here may be useful in troubleshooting a failure. A color-coded view of the information in this tab is available in the ProcessLog tab;
The ProcessLog tab shows individual steps or actions in the job on the device, including which matches occurred and whether an issue was generated (if the script generates an issue). This analysis is limited to 500 lines of output; if more than 500 lines of output were created, you can view the entire analysis in the process.pdf file available in the Files tab;
The SessionLog tab lists the session details, indicating all CLI events that occurred during the job;
The Files tab provides links to download any files related to the job for this device. The all.zip file contains copies of all associated files for convenience in downloading.
...
To import a new Perl or Python library file, do the following:
On the Config Management –> > Job Management –> > Library page, click the Import icon on the top right.
In the file requester, click Browse to navigate to the location of the file on the local appliance, select the file, and click Import.
To create a new Perl or Python Library file, do the following:
On the Config Management –> > Job Management –> > Library page, click the New icon on the top right.
Add a Name for the new script.
Enter the desired Category for the new script. (The Category field allows you to define any category you wish; the Library of scripts is sortable by the Category column.)
Enter a new Description for the script.
Enter the new script in the large text field in the Add Script requester. A script previously written in a text editor can also be copied and pasted.
Click Save or Save and Close to save your changes.
Click Export to save your changes to n external file.
Click Cancel to remove changes.
...