Getting Started. Version 9.1

Transcription

1 Getting Started Version 9.1

2 Contents About this Guide 4 Other Resources 4 Product Documentation 4 Online Training Program 4 Daily Online Q & A sessions 4 Prepare Your Customer's Network 5 Create a Probe Service Account 5 DNS Configuration 5 Getting Started Wizard 5 Review the Getting Started Videos 5 Step 1: Add a Customer/Site 6 Step 2: Add Devices 6 Step 3: Discovering Devices 7 Import Non-Windows Devices to N-central 9 Customize the Monitoring of Non-Windows Devices 9 Renaming Devices 9 Firewall Monitoring 10 Customize the Monitoring of Windows Devices 10 Hardware Monitoring 10 Application Monitoring 10 Patch Management 11 Probe Notifications 11 Endpoint Security 11 Scheduled Tasks 12 Testing Notifications 12 PSA Integration 12

3 Reporting 13 Appendix 14 Working with Proxy Servers 15 Configuring DNS Aging And Scavenging 16 Troubleshooting 19 Troubleshooting Discovery and Agent deployment 19 Troubleshooting Notifications 21 Troubleshooting Remote Control 23

4 About this Guide This guide is intended for all N-central users and will show you how to configure your customer's network to ensure optimal discovery and monitoring of devices on their network. Prepare Your Customer's Network on page 5 Getting Started Wizard on page 5 Import Non-Windows Devices to N-central on page 9 Customize the Monitoring of Non-Windows Devices on page 9 Customize the Monitoring of Windows Devices on page 10 Testing Notifications on page 12 Reporting on page 13 In addition, the following additional documents are provided as an Appendix: Working with Proxy Servers on page 15 Configuring DNS Aging And Scavenging on page 16 Troubleshooting on page 19 Other Resources After you have set up your first network, there are a number of additional resources available to you to show you how to setup additional features and use N-central to manage your customer networks. Product Documentation The N-central product documentation includes many additional searchable resources and troubleshooting tips. Access product documentation by clicking Help > Online Help in the N-central navigation pane. Online Training Program N-able Technologies provides a series of videos and documents logically ordered in the QuickStart program in the N-able Resource Center at Daily Online Q & A sessions Our Sales Engineers provide live online question and answer sessions daily. Dial into any session and ask your questions live. For more information, refer to This Guide is current as of October 18,

5 Prepare Your Customer's Network This section contains recommendations and procedures that you should follow to ensure that Agents and Probes can communicate with the N-central server and ensure that the Windows Probe can scan your customer s network successfully. Please review the following: Create a Probe Service Account on page 5 DNS Configuration on page 5 Create a Probe Service Account The installation of the Windows Software Probe requires a Domain Administrator account. Best Practice Create a new Domain Administrator account that will be used only for the probe. For more information on setting up and configuring Domain Administrator accounts, refer to Microsoft technical documentation. DNS Configuration The Windows Software probe requires that DNS be configured properly in order for it to function. In DHCP networks, it is strongly advised to verify that the DNS does not contain duplicate addresses for workstations and laptops. Duplicate entries will cause problems when installing agents and for N-central to function properly. To resolve the issue, configure DNS scavenging following the instructions provided in Configuring DNS Aging And Scavenging on page 16. Getting Started Wizard Using the wizard takes just a few steps to setup a customer. Review the Getting Started Videos on page 5 Step 1: Add a Customer/Site on page 6 Step 2: Add Devices on page 6 Step 3: Discovering Devices on page 7 Review the Getting Started Videos 1. Sign in to the N-central UI

6 Note: The default initial view when you first sign in to N-central is the Getting Started Wizard. If you choose to close this view, you can access the wizard at any time under Help in the navigation pane. 2. Review the Architecture Overview video. 3. Review the Feature Fundamentals video. Step 1: Add a Customer/Site 1. Click Add Customer/Site. 2. Review the Learn how to deploy a customer/site network video. 3. In the Customer/Site Name field, type the name of your customer/site. 4. Configure the License Type and Default Credentials as appropriate. 5. Click Save and Continue. Step 2: Add Devices 6. In the Install a Windows Probe to Discover the Network section, click Download the Probe. Note: For most situations, we recommend that you install the probe on a Windows Server device. However, in cases where you have small numbers of managed devices, installing the probe on a Windows Workstation will also work. The reason for this is that Windows XP, Vista or Windows 7 limit the number of outbound concurrent connections. When the number of outbound concurrent connections is limited, this impedes the ability of the Windows Probe to discover and monitor devices. 7. The InstallShield installer will perform a check on the environment that will warn you of any issues it may find related to the functionality of the probe within your network. These warnings or failures should be addressed before proceeding. 8. Select the location where you would like to install the N-central probe software. Click Next to continue. 9. If you need a proxy string, select I need to use a Proxy Server and specify the proxy information, if you need help, refer to Working with Proxy Servers on page Click Next. 11. On the next screen, do one of the following: - 6 -

7 If the probe is being installed in a workgroup, select Workgroup User, otherwise Select Domain User, specify the Domain Administrator credentials. 12. Click Next. 13. On the AMT Datastore Registration screen, you can optionally provide the credentials to be used with Intel vpro -based devices. 14. Click Next. Step 3: Discovering Devices 1. On the Network Discovery screen, enter a name for the discovery job in the Discovery Name field and then click Add. After you have clicked Add, you can edit the other fields on this screen. 2. In the Target Network section, select IP Range and enter the IP range (for example, ) in which the probe will be installed. 3. Click Next. 4. If applicable, select one or more of the following tabs in the Advanced Discovery Options screen or skip to step

8 SNMP Select Use SNMP to have the discovery job use the SNMP GET command to query devices for information. This requires configuring the following properties: Community String - the exact community string of the devices which is used by the Windows Probe to retrieve the data through SNMP. The community string of devices should be obtained from your administrator or from device manufacturers. Port - defines the port number that SNMP will monitor for device information. SNMP Version - defines the version of SNMP to be used when querying devices. VMWare Select Discover ESX/ESXI Servers to include virtualization server devices in the discovery job. This requires configuring the following properties: Username - the user credentials required to obtain data from virtualization servers. Password - the user security code required to obtain data from virtualization servers. CIM Ports - defines the values for CIM ports to be scanned by the discovery job. Webservice Ports - defines the values for Web service ports to be scanned by the discovery job. Backup Exec Select Discover Backup Exec Jobs to have the discovery job look for the Backup Database Instance - the type of database. User Name - the name of the user required to access the database. Password - the password required to access the database. Exec Service on discovered devices. This requires configuring the following properties: Xilocore/Asigra Select Discover Xilocore/Asigra Jobs to have the discovery job look for either the Xilocore Backup Service or the Asigra Backup Service. This requires configuring the following properties: User Name - the name of the user required to access the database. Password - the password required to access the database. Port - the port number used to connect to the DS-Client server. Asigra DLL path - the location of Asigra DLL files. If the location is not correctly identified, the discovery job will not discover Asigra or Xilocore backup sets properly. 5. If you want to add another discovery job, click Add Additional Discovery Job; otherwise, click Next. 6. Click Install. At this point, the Getting Started Wizard will automatically start the Customer/Site Wizard

9 Import Non-Windows Devices to N-central By default, N-central does not automatically import non-windows devices. To import non-windows devices into N-central. 1. Select Add/Import Devices. Once the Customer/Site Wizard has been completed, you can import devices by following the procedure outlined below. 2. Select the All Devices view. 3. In the Add Devices view, click Add. 4. Click Import. 5. Select the devices that you would like to import. 6. Click Import. 7. Click Finish to import the selected devices. All of the imported devices should appear in the All Devices view. The next step is to customize the monitoring of the imported devices. Customize the Monitoring of Non-Windows Devices Renaming Devices Devices that are not registered in DNS will be listed in N-central with an IP address. Examples of these devices can include switches, routers, firewalls, or IP telephones. These devices can be renamed to a more user-friendly name by performing the following: 1. Click All Devices view in the navigation pane. 2. Click the device that you would like to edit in the Name column. 3. Select the Properties tab. 4. Modify the Name. Note: This is only a label in N-central and will not make any changes to the operating system or network configuration of the device itself. 5. Click OK

10 Firewall Monitoring N-central can monitor the following elements on most firewalls: CPU, Connections, Memory, Traffic, and Syslog messages. This requires SNMP and Syslog configuration changes on the firewall and asset discovery must be performed again. The procedure for this is documented in "Configuring Firewall Services" available on the N- able Resource Center under Support > Product Documentation. Customize the Monitoring of Windows Devices Hardware Monitoring If the server is a Dell, HP, IBM or Intel-branded server, you can monitor certain hardware elements including: Fan Status, Logical Drives, Physical Drives, Power Supplies, RAID Controllers, and Temperature. This requires the installation of management agents from the appropriate vendors. SNMP must also be configured and asset discovery performed again. The procedure for this is documented in "Configuring Servers for Hardware Monitoring" available on the N-able Resource Center under Support > Product Documentation. Application Monitoring By default, N-central has applied service templates (groups of services) to the managed devices based on their folder membership. This will be the baseline for monitoring. Some servers will have unique applications running on them and to monitor the applications, you will need to apply the appropriate service template. 1. Click All Devices view in the navigation pane. 2. Select the check box next to the device on which you want to monitor an application. 3. Select Apply Service Templates from the drop-down list

11 4. If required, click Expand to display service templates that correspond to the device class. 5. Select the service templates as required. 6. Click > to move them one at a time or click >> to select and move all the service templates. 7. Click Apply. 8. Expand the tree in the Service Template Application Report screen to view any messages. 9. Click OK. Note: Additional Service Templates are available on the N-able Resource Center. Patch Management By default, the Patch Status service has been added to all Windows devices that have an agent installed. This service monitors for missing patches. The patch management feature in N-central is based on APIlevel integration with Microsoft WSUS and Microsoft Windows Update. For more information on configuring this feature, please refer to "Providing Patch Management With N-central" available on the N- able Resource Center under Support > Product Documentation. Probe Notifications By default, you will not receive an alert if the Windows Software Probe stops working. To configure notifications for the Probe Status service, perform the following for each customer: 1. In the View Selection Menu, select the appropriate customer. 2. In the navigation pane, click Configuration > Monitoring > Notifications. 3. In the Name column, click O Minute Delay. 4. Click Trigger Details. 5. Select Servers (Applications). 6. Select the Probe. 7. Click > to move the probe to the right-hand column. 8. Click Save. Endpoint Security The Endpoint Security feature is powered by Panda Security applications and provides comprehensive antivirus and anti-malware protection for Windows Workstation and Windows Servers. Endpoint Security can also be configured for Microsoft Exchange 2003, Exchange 2007 and Exchange 2010 servers to provide integrated Anti-Virus, Anti-Spam and Content Filtering capabilities specifically for Exchange mail

12 servers. Endpoint Security can be fully deployed and managed from within N-central. For more information, refer to "Endpoint Security" in the N-central technical documentation. Scheduled Tasks You can configure Scheduled Tasks to automate routine maintenance tasks. The following tasks can be configured for Windows devices: Endpoint Security Scans File Transfers Scripts Push Third Party Software WSUS server cleanup To access this feature, click Configuration > Scheduled Tasks in the navigation pane. Testing Notifications By default, N-central is configured with a very capable notification system. In order to make sure that your notifications are working properly, perform the following: 1. In the View Selection Menu, select the appropriate service organization. 2. In the navigation pane, click Configuration > Monitoring > Notifications. 3. Click 0 Minute Delay. 4. Verify that the correct recipients have been configured for the notification. 5. Click Save (or Cancel if no changes have been made). 6. Select the check box next to 0 Minute Delay. 7. Click Test Notification. You should receive an notification within a few minutes. If you do not receive a notification, follow the instructions provided in Troubleshooting on page 19. PSA Integration N-central can integrate with the following PSA tools: Autotask Connectwise

13 Tigerpaw This feature is configured under Configuration > PSA Integration. For more information, refer to the "Integrating N-central With Your PSA Solution" document available on the N-able Resource Center. Reporting Sample reports can be downloaded from the following link: This self-extracting executable contains a spreadsheet describing all of the available reports and the corresponding PDF reports

14 Appendix The following documents provide background information to some of the procedures in the Getting Started Guide. Working with Proxy Servers on page 15 Configuring DNS Aging And Scavenging on page 16 Troubleshooting on page

15 Working with Proxy Servers Agents and probes are capable of communicating through: non-authenticating proxy servers, clear-text authenticating proxy servers, Internet Security and Acceleration (ISA) 2000/2004/2006 proxy servers, and, Microsoft Forefront Threat Management Gateway (TMG) proxy servers. If a proxy server resides on your customer s network, you may need to configure the N-central 9.1 agent/probe software so that it can pass information through the proxy server and on to your N- central 9.1 server. To configure an agent/probe to use a proxy string, specify the proxy string during the creation of the agent/probe in the N-central 9.1 UI. The information below will outline the appropriate proxy string to enter based on the type of proxy server implemented in your customer s network. Non-authenticating Proxies The proxy string must have the following format: name>:<port number> name>:<port number> Example: Clear-text Authenticating Proxies The proxy string must have the following format: user>:<proxy password>@<server name>:<port number> user>:<proxy password>@<server name>:<port number> Example: Microsoft ISA and Forefront TMG Proxies The proxy string must have the following format: of the proxy>\<proxy user in domain>:<proxy password in domain>@<server name>:<port number> Example: Note: Basic HTTP authentication must be activated for this to work. For more information, refer to the Microsoft Knowledge Base document: How to Allow Third-Party Internet Application Connections through ISA Server 2000 (specifically, Method 2: Enable Basic Authentication for Outgoing Web Requests)

16 Warning! The procedures explained above and in the Microsoft KB document should be reviewed, approved and implemented by a Microsoft Certified Professional holding a Microsoft Certified Systems Engineer + Internet or equivalent designation or experience. Confirm with your customer that the operations described above are considered permissible. Do not proceed without customer consent. It is also possible to configure an ISA/TMG server to permit direct access that will allow the agents and probes to communicate with the N-central 9.1 server. For the steps required to make this configuration change, please refer to the following: ISA servers - Configuring Web Proxy Clients for Direct Access TMG servers - Bypassing Forefront TMG for Web proxy client requests Configuring DNS Aging And Scavenging DNS in a DHCP network can contain invalid entries if scavenging is not enabled to automatically remove stale resource records. To configure scavenging, perform the following: 1. Access the DNS Management console. 2. Right-click the DNS Server name. 3. Select Set Aging and Scavenging for all zones

17 4. Select Scavenge stale resource records

18 5. Click OK. 6. Select Apply these settings to the existing Active Directory integrated zones. 7. Click OK. 8. Right-click the domain under the Forward Lookup Zones. 9. Select Properties

19 10. Select Aging. 11. Repeat the procedure from step 4 to step 7 above. 12. Right-click the subnet under the Reverse Lookup Zones. 13. Repeat the procedure from step 9 to step 11 above. For more information, review the following article: Troubleshooting Troubleshooting Discovery and Agent deployment Under certain circumstances, the probe will not be able to gather the necessary asset information or remotely install the Windows agents. The following are the most common problems and possible solutions: Windows Workstations are not discovered The most common reason for a workstation not being discovered in N-central is that a local firewall is preventing remote access. To verify whether this is the problem, log on to the probe and try to ping the workstation. If this fails, you will need to configure the firewall to allow remote access from the probe. If the ping is successful, try running the asset discovery again. Enable Remote Administration Exception in Windows Firewall 1. Open the appropriate group policy on your customer s domain controller. 2. Click Computer Configuration > Administrative Templates > Network > Network Connections > Windows Firewall > Domain Profile. 3. In the right-hand UI pane, double-click Windows Firewall: Allow remote administration exception. 4. Under the Settings tab, select Enabled. 5. In the Allow unsolicited incoming messages from: field, type * to accept messages from anyone or the IP address of your Windows Probe. 6. Click OK. 7. Close the Group Policy Object Editor window. 8. Close the Active Directory Users and Computers window. For more information, refer to the Microsoft document "Enable or Disable the Remote Administration Exception"

20 Note: Any changes made to the group policy of a domain will not be applied by members of the domain until one of the following conditions is met: The computer is rebooted, or The default update interval has been exceeded (90 minutes on domain members, and five minutes for domain controllers), or The following command is run on the domain member: gpupdate /Target: computer. For more information on the group policy update interval and the gpupdate command, refer to the Microsoft document "Group Policy does not refresh". Windows Workstations are discovered as device class OTHER The Windows Probe discovers the asset information of Windows devices using WMI. This asset information is used to define the device class. If the Windows Workstation has a device class of Other, the WMI discovery has failed. The most common reasons for discovery failure are: a local firewall is enabled, the workstation is not part of the domain, or there are WMI permission problems between the probe and the workstation. To change the device class and install the Windows Agent without relying on WMI, try the troubleshooting procedures described below. Installing a Windows Agent when the Device Class is Other You can try to install an agent to the Windows devices that were discovered as device class Other by simply changing the device class of the device and selecting the Local Agent option. This can be performed for a single device by selecting the device and the Properties tab. This can also be performed for multiple devices by using the Bulk Edit feature: 1. Navigate to the appropriate customer. 2. Select the All Devices view. 3. Sort the list of devices by Device Class. 4. Select all of the devices with the class Other. 5. Click Edit. 6. Change the device class to Workstations - Windows. 7. Select Local Agent. 8. Select Install Using. 9. Click OK

21 Windows agent not automatically installed Check the agent install error message on the Properties tab or the Agent tab of the device. Possible causes: The ADMIN$ share is not accessible from the probe. There is a permission problem accessing the ADMIN$ share. Incorrect DNS configuration. Device is discovered as device class Other. A potential solution is to test access to the ADMIN$ by performing the following: 1. Log on to the probe with the same account that is used by the probe. 2. Ping the computer by name and by IP address. 3. If successful, try accessing the \\PCname\ADMIN$. 4. If both of these are successful, run the asset discovery again. Troubleshooting Notifications Troubleshooting notifications is common in order to discover why a notification was not sent. There are a number of potential causes for a notification not being transmitted that need to be reviewed. New notifications are triggered on state changes, escalation and repeat notifications are triggered on an elapsed time from the initial state change. To troubleshoot notifications 1. Review the Incident Summary Report and examine the lists of all of the incidents and associated escalations that trigger notifications, the acknowledgments, and the resolution times over a specified period. If the specific incident is listed in this report, N-central has detected a state change in a service that is associated with a notification profile. 2. Review the Notifications Sent Report (it displays a copy of the notifications that were sent to a specific user). If the notification is listed in this report, N-central transmitted the notification. Based on this information, you should: a. Verify the mail relay server settings in the NAC (only if no notifications are received). b. Verify that the message is not still with the mail relay server. c. Verify the user's spam filter. 3. Review the User Notification Method (it determines a user's address that is used for notifications as well as the associated schedule). Based on this setting, you should: a. Verify that the address is correct

22 b. Verify that the schedule includes the time that the incident happened. If the incident occurred outside the user's schedule, the incident will be listed in the Incident Summary report and no notification will be listed in the Notification Sent report. 4. Send a test notification by performing the following: a. Navigate to the appropriate customer. b. Select the All Devices view. c. Click the device that you would like to use for the test in the Name column. d. Select the Associations tab. e. Verify that the correct notification profiles are associated with the device. f. Select the Status tab. g. In the Service column, click the service that you would like to use for the test. h. Select the Thresholds tab. i. Reverse the values for one of the threshold settings. j. In the navigation pane, click Views > Active Issues. k. After a moment, the incident should be displayed and the notification received. 5. Review the Detailed Status Report (it presents a detailed overview of the service state changes on a device over time) and verify the time of the incident to confirm whether the service was in a Failed state. If the service was not in a Failed state, verify that the thresholds have been configured correctly. 6. Review the Raw Monitored Data Report (it provides detailed information for a particular service): a. Review the time period when you expected an incident. b. Verify how long the service was in a Failed state. c. Note the duration that the service was in a Failed state. 7. In the notification profile, review the Notification Profile Delay (the amount of time that a service must be in a specified state before a notification is sent). If the duration that the service was in a Failed state is less than the delay configured in the profile, you may need to adjust the delay value. 8. Verify the default Notification Profile-Triggers that are associated with the relevant folders by performing the following: a. In the View Selection Menu, select the appropriate customer

23 b. In the navigation pane, click Configuration > Monitoring > Notifications. c. Click 0 Minute Delay. d. Select the Trigger Details tab. e. Verify that the service you are troubleshooting is displayed in the appropriate trigger with the correct state. f. Verify that the service you are troubleshooting is associated with the folder to which the device belongs. Troubleshooting Remote Control If you are having problems with remote control, verify that your network equipment supports UDP peerto-peer connections. You should also verify that port TCP 22 is open outbound from your customer s network and inbound to your N-central server. For more information, refer to the Remote Control section of the Security Statement document for more details on remote control architecture

24 Disclaimer This document may include planned release dates for service packs and version upgrades. These dates are based on our current development plans and on our best estimates of the research and development time required to build, test, and implement each of the documented features. This document does not represent any firm commitments by N-able Technologies Inc. to features and/or dates. N-able Technologies will at its best effort, try to meet the specified schedule and will update this document should there be any significant changes. N-able Technologies reserves the right to change the release schedule and the content of any of the planned updates or enhancements without notice. Publication or dissemination of this document alone is not intended to create and does not constitute a business relationship between N-able Technologies and the recipient. Feedback N-able Technologies is a market driven organization that places importance on customer, partner and alliance feedback. All feedback is welcome at the following address: feedback@n-able.com. About N-able Technologies N-able Technologies is the global leader in remote monitoring and management software for managed service providers and IT departments. N-able s award-winning N-central platform and complementary toolsets, backed by best-in-class business and technical services, are proven to reduce IT support costs, improve network performance and increase productivity through the proactive monitoring, management and optimization of IP-enabled devices and IT infrastructure. N-able is 100% channel-friendly and maintains operations in North America, the U.K., the Netherlands and Australia. Copyright 2012 N-able Technologies All rights reserved. This document contains information intended for the exclusive use of N-able Technologies' personnel, partners, and potential partners. The information herein is restricted in use and is strictly confidential and subject to change without notice. No part of this document may be altered, reproduced, or transmitted in any form or by any means, electronic or mechanical, for any purpose, without the express written permission of N-able Technologies. Copyright protection includes, but is not limited to, program code, program documentation, and material generated from the software product displayed on the screen, such as graphics, icons, screen displays, screen layouts, and buttons. N-able Technologies, N-central, and Report Manager are trademarks or registered trademarks of N-able Technologies International Inc., licensed for use by N-able Technologies, Inc. All other names and trademarks are the property of their respective holders.