Setting up Support for CiscoWorks ANI Server

CHAPTER 6 Setting up Support for CiscoWorks ANI Server The CiscoWorks Server includes tools required to properly set up the server to support other CiscoWorks applications. These features include: Configuring the ANI Server Enabling Multiple Community Strings Community String Guidelines Configuring the ANI Server Some CiscoWorks applications require the Asynchronous Network Interface (ANI) Server to automatically discover network devices. If your application does not use or require the ANI Server, then ANI Server is not available in the navigation tree. For applications that require the ANI Server, it is critical that you set up your network and the ANI Server to ensure that the network is properly discovered. 6-1

Configuring the ANI Server Chapter 6 Setting Up Your Network The Network Setup Overview table (Table 6-1) provides an overview of the tasks required to ensure that ANI properly discovers your network. Detailed information and instructions are available in the online help (select Server Configuration > Setup > ANI Server Admin). To perform these tasks, use the Command Line Interface (CLI) of the network devices in your network. Refer to the command reference guides for specific devices to obtain instructions about performing these tasks. Table 6-1 Network Setup Overview Task Purpose Required for Device and Physical Topology Discovery Upgrade software versions on devices. Verify connectivity to seed devices. Enable SNMP. Enable Cisco Discovery Protocol. Set unique sysname variable on devices. Enable ILMI on ATM devices. Configure DNS. To ensure that ANI Server successfully discovers and supports your network devices, upgrade your device software to the latest general deployment (GD) software release. The workstation on which ANI Server is installed must have connectivity to the seed devices in your network. If devices are not reachable, they cannot be discovered. ANI communicates with network devices using SNMP. ANI Server uses Cisco Discovery Protocol (CDP) to discover your network devices and layout. Using CDP, ANI identifies Cisco IOS devices by the sysname variable. If multiple devices share the same sysname variable, the devices cannot be discovered properly. ANI Server uses Integrated Local Management Interface (ILMI) to discover the ATM devices in your network. ANI uses Domain Name Services (DNS), if available, to perform device name lookups. If DNS is not available, ANI uses IP addresses. If you use DNS, ensure that all devices have unique host names and that DNS is properly configured. Required for Logical (VLAN and LANE) Discovery Note Successful logical discoveries require that you have also properly configured the network for device discoveries. 6-2

Chapter 6 Configuring the ANI Server Table 6-1 Network Setup Overview (continued) Task Configure VLAN Trunk Protocol. Configure VLAN trunks on Fast Ethernet and Gigabit Ethernet. Create the default LANE configuration server for ATM devices. VLAN Trunk Protocol (VTP), to discover, display, and configure VLANs. If a switch is connected to Fast Ethernet links and you want to configure it to carry more than one VLAN, you must enable ISL or IEEE 802.1Q. If you are running LAN Emulation (LANE) in your network, you must set up the main configuration server. Required for User Discovery Note Successful user discoveries require that you have also properly configured the network for device and logical discoveries. Connect users and hosts to the network. ANI can retrieve information about end-user devices and hosts only if those devices are actively connected to the network. Also, ANI can automatically collect user names only if users are actively connected to the network. Required for Path Determination Note Successful path discoveries require that you have also properly configured the network for device, logical, and user discoveries. Enable source routing. ANI might not be able to trace a reliable path between two end points if source routing is disabled on any intervening routers. Enable CDR logging on all Cisco Call Managers Purpose The call detail record (CDR) provides information such as the IP address of the phones and gateways, telephone numbers of the involved parties, and the time that the call was made. This information is used to determine a path involving any Cisco Call Manager devices. 6-3

Configuring the ANI Server Chapter 6 Setting Up the ANI Server The ANI Server automatically discovers devices in your network at a defined interval. To do this, the ANI Server must have access to your network devices and a discovery starting point (seed device). You provide ANI access to your network devices by ensuring that the community strings on your devices are known to the ANI Server. The ANI Server uses your specified seed device (or a set of seed devices) to initiate discovery. See Table 6-2 for a description of these and other tasks you can perform with the ANI Server. Table 6-2 ANI Server Tasks Task Purpose Action Required for Initial Discovery Verify community strings. Allows the ANI Server access to your network devices. Default community strings are public for the read-only string and public for the read-write string. Server Configuration>Setup> ANI Server Admin >SNMP Settings Add seed device. Initiates network discovery. Server Configuration>Setup> ANI Server Admin>Discovery Settings Use Reverse DNS Lookup Enable HSRP support for Path Analysis. Additional Tasks Schedule discovery and polling. Select this option if you want to use DNS in your network. Select this option to enable HSRP support for Path Analysis. If you run a path trace accross a network that has routers on which HSRP is configured, enable HSRP support for Path Analysis. When enabled, the HSRP environment will be recognised and trace will be displayed properly. Sets the frequency of network discovery and polling. Server Configuration>Setup> ANI Server Admin>Discovery Settings Server Configuration>Setup> ANI Server Admin>Discovery Settings Server Configuration>Setup> ANI Server Admin>Discovery Schedule 6-4

Chapter 6 Configuring the ANI Server Table 6-2 ANI Server Tasks (continued) Task Purpose Action Modify SNMP settings. Limit discovery. Synchronize devices with Essentials. Schedule user and host acquisition. Modify system resources dedicated to discovery. Enhance discovery performance. Changes the number of SNMP retries and length of SNMP timeouts. Narrows the network discovery by IP address or VTP domain. Provides mechanism for sharing devices and device credentials with Resource Manager Essentials. Sets the frequency of user name and host acquisition. Assigns more or fewer system resources to ANI discovery to affect time to complete. Enables you to view and enhance discovery performance through tuning and metrics. Server Configuration>Setup> ANI Server Admin>SNMP Settings Server Configuration>Setup> ANI Server Admin >Discovery Settings Server Configuration>Setup> ANI Server Admin > Device Synchronization Server Configuration>Setup> ANI Server Admin> User and Host Acquisition Server Configuration>Setup> ANI Server Admin>Performance Settings Server Configuration> Diagnostics>Discovery Metrics See Table 6-3 for a description of administrative tasks you can perform. Table 6-3 Server Tools Tasks Task Purpose Action Administrative Tasks Perform self test. Check process failures. Runs self-tests and generates a report with the results Displays the failed process and time failure occurred Server Configuration > Diagnostics > Self Test Server Configuration > Diagnostics > Process Failures 6-5

Configuring the ANI Server Chapter 6 Table 6-3 Server Tools Tasks (continued) Task Purpose Action Obtain detailed status of ANI Server. Enhance ANI discovery performance. Displays detailed system configuration and settings for ANI Server Enables you to view and enhance discovery performance through tuning and metrics. Server Configuration>Diagnostics> Analyze ANI Server Server Configuration>Diagnostics> Discovery Metrics Modifying SNMP Settings You should ensure that the SNMP settings on the ANI Server correspond to the settings on your network devices. Note Default community strings are public for the read-only and read-write strings. If the community strings on your devices differ from these settings, you must edit the community strings before initiating the discovery process. You have the option to enable multiple community strings, and encrypt the community strings. In addition to editing the read and write access of your devices, you can modify the SNMP retries and timeout duration. Applying Changes to SNMP Settings Use this information to change community strings, SNMP retries, and SNMP timeouts on the ANI Server. Before You Begin When you make changes to the community strings, ANI discovery runs even if it is not scheduled to occur. 6-6

Chapter 6 Configuring the ANI Server Refer to Community String Guidelines for tips on entering valid community strings. Your login determines whether you can use this option. Procedure. Table 6-4 Step 1 Step 2 SNMP Variables From the CiscoWorks desktop, select Server Configuration > Setup > ANI Server Admin > SNMP Settings. Enter the community string. The SNMP variables are described in SNMP Variables Table. Variable Description Usage Notes target Device or range of devices to which you are assigning these community strings. If you do not specify a target, the default community strings apply to all devices in your network. read_community write_community timeout Password to allow read-only access to the devices. Password to allow write access to the devices. Duration, in seconds, for which the ANI server waits for a response from the device before performing the first retry If you do not specify the read community string for the specific target, the default value, public, is used. If you do not specify the write community string for the specific target, the default value, public, is used. The default setting is 6 seconds. If you increase the timeout period, discovery could take significantly longer to complete. SNMP timeouts should be the same for the same IP address ranges when you enable multiple community string option. 6-7

Configuring the ANI Server Chapter 6 Table 6-4 SNMP Variables Variable Description Usage Notes Retries Number of times the ANI server attempts to communicate with the device before declaring that the device has timed out. By default, the ANI server makes only one retry. If you increase the number of retries, discovery takes significantly longer to complete. SNMP retires should be the same for the same IP address ranges when you enable multiple community string option. The default retry policy doubles the previous timeout value for retry. For example, if you specify two retries, and the timeout is 3 seconds, a request takes: First try = 3 seconds First retry = 6 seconds Second retry = 12 seconds Total time = 21 seconds (3+6+12) seconds to timeout. Comments You can add comments here None. Step 3 Click Add to enter a new community string. Tip To enable Enabling Multiple Community Strings, select the Enable Multiple Community String checkbox. 6-8

Chapter 6 Enabling Multiple Community Strings Step 4 Click Save to save the community strings. To encrypt a community string before saving, select the Encrypt Community Strings check box. Tip To logically group the IP addresses, click Refresh. To remove a community string, select the corresponding row and click Delete. Enabling Multiple Community Strings ANI provides the option to enable multiple community strings for a given subnet or network. By default, this feature is disabled. You can enable this feature by selecting the EnableMultipleCommunity String check box in the SNMP Settings window. Enabling this feature helps you manage a network having devices with different community strings. When only one community string is specified for a subnet or network, the discovery fails if ANI encounters a device with a community string different from that specified in ANI. Setting multiple community strings helps you overcome this concern. With the multiple strings feature enabled, you can set multiple community strings for the same IP address range. ANI tries each community string, one after the other, until the successful match is found. A typical scenario illustrates this feature. Assume that you are using IP addresses in the range 10.10.*.* and managing the subnet/network having devices with different community strings. Let the read/write community strings be (abc/cde), (def/fgh) and (ghi/ijk). With the multiple community string feature enabled, you can specify 10.10.*.* multiple times and provide a different community string each time, as shown in the Table 6-5. 6-9

Enabling Multiple Community Strings Chapter 6 Table 6-5 Community String for IP address IP Address Range Read Community Strings Write Community Strings 10.10.*.* abc cde 10.20.*.* def fgh 10.30.*.* ghi ijk ANI tries each community string specified in the IP address range, one after the other, until it finds the successful match. The following cases further illustrate how ANI finds the appropriate community strings when you enable this feature. Case 1 Let the IP address range and read/write community strings be as specified in Table 6-6. Table 6-6 Case 1 IP Address Range Read Community Strings Write Community Strings 10.10.10.* one one 10.10.10.* two two 10.10.10.* three three *.*.*.* public private For a device with IP address 10.10.10.10, ANI uses the first three entries to find the correct community string. This is because 10.10.10.* is the closest match for the device with IP address 10.10.10.10 6-10

Chapter 6 Enabling Multiple Community Strings Case 2 Let the IP Address range and read/write community strings be as specified in the Table 6-7. Table 6-7 Case 2 IP Address Range Read Community Strings Write Community Strings 10.10.[8-16].* one one 10.10.[8-16].* two two 10.10.[8-16].* three three *.*.*.* public private For a device with IP address 10.10.10.10, ANI uses the first three entries to find the correct community string. This is because 10.10.[8-16].* is the closest match for the device IP address 10.10.10.10. Case 3 Let the IP Address range and read/write community strings be as specified in the Table 6-8. Table 6-8 Case 3 IP Address Range Read Community Strings Write Community Strings 10.10.*.* one one 10.10.*.* two two 10.10.*.* three three 10.*.*.* public1 private1 *.*.*.* public2 private2 For a device with IP address 10.10.10.10, ANI uses the first three entries to find the correct community string. This is because 10.10.*.* is the closest match for the device IP address 10.10.10.10. 6-11

Community String Guidelines Chapter 6 Case 4 Let the IP address range and read/write community strings be as specified in the Table 6-9. Table 6-9 Case 4 IP Address Range Read Community Strings Write Community Strings 10.*.*.* one one 20.*.*.* two two *.*.*.* three three *.*.*.* public1 private1 *.*.*.* public2 private2 For a device with IP address 30.30.30.30, ANI uses the last three entries to find the correct community string. This is because *.*.*.* is the closest match for the device IP address 30.30.30.30. After the correct community string corresponding to a device is identified, ANI keeps it in memory until the ANI session is terminated. Once you stop/start ANI, it has to repeat the process to find the correct community string. Community String Guidelines Use these guidelines to modify the community strings: You can assign community strings to any of the following: Complete IP address 172.20.4.9 DNS name dnsname.mycompany.com Any wild cards, but wild cards must be based on IP addresses: *.*.*.* 172.*.*.* Range of address including wild cards: 172.20.[4-55].* 172.[21-30].[44-88].* 172.*.*.[121-255] 6-12

Chapter 6 Community String Guidelines You can add a combination of general and specific entries, but the ANI Server reads the community strings from most specific to least specific. If more than one entry matches for the same device, the most specific community string is used. When the pound sign (#) appears as the first character on a line, it indicates a comment. All printable characters, except for colons (:) are allowed in community strings. To encrypt the community string before saving, select the Encrypt Community Strings check box. Frequently Asked Questions Why can t I start my CiscoWorks application? If you cannot start your CiscoWorks application and receive error messages complaining that the WebServer or ANIServer might not be running (even though pdshow indicates that those processes are up and running), you might need to check how your machine is resolving its server name and IP address. The CiscoWorks CORBA applications require name resolution to work properly. Choose Domain Name Service (DNS) or any other form of name resolution supported by both your client and server. Configure the name resolution mechanism and restart the CiscoWorks Server to access the application correctly. How can I check the status of the ANI Server? To check the status of the ANI Server to determine if it is up and running properly: Step 1 Step 2 From the CiscoWorks desktop, select Server Configuration>Administration>Process Management>Process Status. Use the information in Table 6-10 to verify the current status of the ANI Server. 6-13

Community String Guidelines Chapter 6 Table 6-10 ANI Server Status State Explanation Solution Administrator has shut down the server. Administrator has shut down the server. Failed to Run. Program started No management msgs received. Administrator intentionally shut down the ANI Server. ANI Server has failed to come back up. ANI Server could not start up initially. ANI Server is in the process of starting up. Start the ANI Server to get it up-and-running again. Might occur after stopping and restarting the ANI Server. Check the log for details: On Solaris: /var/adm/cscopx/logs/daemons.log On Windows: NMSROOT\log\ANIServer.log, where NMSROOT is the directory where you installed CiscoWorks. Wait a few minutes, and check the status again. 6-14

Chapter 6 Community String Guidelines Table 6-10 ANI Server Status (continued) State Explanation Solution Running but busy flag set. The ANI Server cannot load the database. Run reinitdb.pl to reinitialize the database. Normal state. ANI Server is up-and-running normally. Can also appear when the ANI Server is hung or not responding. The ANI database is corrupted, and the ANI Server cannot run with a corrupted database. None. Everything is normal. If discovery does not appear to be completing, check the log for details: On Solaris: /var/adm/cscopx/logs/daemons.log On Windows: NMSROOT\log\ANIServer.log where NMSROOT is the directory where you installed CiscoWorks. Reinitialize the database: From the command prompt or shell window, run: On Solaris: $NMSROOT/campus/bin/reinitdb.pl On Windows: perl NMSROOT\campus\bin\reinitdb.pl where $NMSROOT and NMSROOT are the directories where you installed CiscoWorks, in Solaris and Windows respectively. How can I verify whether the ANI discovery is complete or almost complete? Use the Discovery Metrics task to check if discovery is in progress. From the CiscoWorks desktop: Step 1 Step 2 Select Server Configuration >Diagnostics>Discovery Metrics. Use the Percent Complete column to determine if the discovery task is finished. 6-15

Community String Guidelines Chapter 6 How can I verify whether the ANI Server is fully functional? The CiscoWorks Server includes several tools to verify varying functional states of the ANI Server. To progressively determine the cause of any problems: Step 1 Step 2 Step 3 Step 4 Select Server Configuration >About the Server >About ANI Server>Copyrights and Versions. If this page appears, you have verified that the web server and its applets are working properly. If this page does not appear, the problem is not related to the ANI Server. The CiscoWorks web server is not running properly. Select Server Configuration >About the Server >About ANI Server>Devices Support. If a list of icons, device names, and device OIDs appears, you have verified that the ANI Server is up-and-running. If an error occurs, follow the suggestions appropriate to the reported state of the ANI Server (see Table 6-10). Select Server Configuration >Diagnostics >Analyze ANI Server. If this page appears, verify that the name of the ANI Server and the host running it is correct. If an error occurs, follow the suggestions appropriate to the reported state of the ANI Server (see Table 6-10). Select Server Configuration>Diagnostics>Discovery Metrics. If this page appears, you have verified that the ANI Server is working. If an error occurs, the ANI Server is not working properly. 6-16

Chapter 6 Community String Guidelines Table 6-11 Troubleshooting Suggestions Symptom Probable Cause Possible Solutions Setup The ANI Server cannot load the database. Run reinitdb.pl to reinitialize the database. Cannot access the ANI supported devices. Unable to analyze the ANI Server because a message states that you are not authorized. When using a Campus Manager application, a error occurs: Cannot connect to ANI Server. The ANI database is corrupted, and the ANI Server cannot run with a corrupted database. ANI may have restarted since you last connected. Reinitialize the database: From the command prompt or shell window, where $NMSROOT is the root directory where you installed CiscoWorks, run: On Solaris: $NMSRROOT/campus/bin/reinitdb.pl On Windows: perl NMSROOT\campus\bin\reinitdb.pl where $NMSROOT and NMSROOT are the directories where you installed CiscoWorks, in Solaris and Windows respectively. Log out of CiscoWorks and log in again: 1. Click Logout. 2. Enter your user name and password. 3. Click Connect and attempt to use the Campus application again. 6-17

Community String Guidelines Chapter 6 6-18