2.6.1. Network Devices

In the Network devices tab, we can find all the network devices that we have already registered, the ones that the OpenNAC Enterprise system has discovered, and all the information related to them. Network devices send authentication information from user devices. There are several types of network devices, for instance, routers, switches, VPNs, Access Points, Wireless LAN Controller, and many others.

To register a network device in the OpenNAC Enterprise CMDB, look for the ON CMDB -> Network Devices in the left-side menu of the Administration Portal.

../../_images/networkdevices_overview.png


In the network devices tab, we can find the following columns:

  • IP: Shows the network device IP address.

  • IP management: Shows network device IP management address.

  • Backup connection type: Shows the backup connection type if the network device has backup.

  • Brand/Model: Shows the brand and the model for the network device.

  • Compliance status: Shows the number for the compliance status and two shortcuts: one that redirects to the Analytics -> Discover filtering the events for the IP of that network device, and the other that shows the compliance groups of tests.

  • Details: Shows a shortcut that shows the backups for that network device.

../../_images/nd_backup.png


  • Tags: Shows a bar with the number of tags of each type assigned to the device.

  • i: Allows you to expand the information.

../../_images/nd_more.png


2.6.1.1. Top menu

We can see the following options in the top menu:

  • Add new: Allows to add a new network device.

  • Edit: Allows to edit a single network device.

  • Bulk edit: Allows to edit a group of network devices.

  • Delete: Allows to delete the network devices selected.

  • Refresh: Allows to refresh the view.

  • Check snmp connectivity: Checks the connectivity to a network device SNMP.

../../_images/nd_snmp.png


Note

If a Network Device does not have the SNMP Properties configured, the ‘Configuration vars’ > ‘NetDev’ > ‘Snmp Properties’ are used.

  • Export data: Export data or the last Backup in JSON format. If you do not want to export the entire database, make sure you filter the table by the desired value before exporting. The files will be displayed for download in the Status > CMDB Exports section.

  • Import data: Import data from a JSON or XML file. This can be done over an entire page or after filtering the data.

  • Tags: Search devices by a partial or complete tag. Tag lists or regular expressions are not supported.

  • Filters: Search for devices on the selected business profile with predefined or custom filters such as IP, MAC address, and policy.

../../_images/ud_tag.png


  • Filters: Allows to search devices on the selected business profile with predefined or custom filters such as IP, MAC, and policy.

../../_images/ud_filter.png


2.6.1.2. Add new

To add a new Network Device to the OpenNAC Enterprise CMDB, use the Add New button. A new pop-up window will be displayed, and there we can find multiple tabs to configure all the desired parameters and the required information for the network device.

2.6.1.2.1. General

In this section, we can configure the main parameters for the device. The mandatory parameters are the IP, Brand and Model, the other parameters will be useful to complete the device information. In this tab we will also find the Tags fields, which will allow us to group the network devices based on different characteristics (physical location, device type, networks, etc). Check the Tags table to find all the available Tags and the information regarding them.

../../_images/networkdevices_general.png


2.6.1.2.2. Additional info

In this section we will be able to add more information about the device such as MAC address, location, maintenance dates, etc.

Note

This information is only used to complete the device information. It’s not going to be used by any product feature.

../../_images/networkdevices_additionalinformation.png


2.6.1.2.3. Disconnection settings

In this section, we will be able to configure the device disconnection methods (via CoA, SNMP, or API) and their parameters. By configuring these methods, we will be able to communicate with the network device to disconnect user devices, extract information, etc. If these parameters are not configured, the global settings will be applied (check Configuration -> Configuration vars -> NetDev).

../../_images/networkdevices_disconnectionsettings.png


To communicate with the network devices we will need:

  • When using SNMP, we will need to apply the proper SNMP settings for that the network device. We will need to configure the SNMP version (SNMP v2 o higher is recommended), the different communities (Read Only and Read and Write), and if we’re using SNMP v3 we will need to fill other parameters such as security level, authorization protocol, etc.

  • When using CoA, we will also need to apply the proper configuration to allow communication between the ON Core and the network device through the 3799 port. Also, we will need to configure the Shared Secret Key.

  • When using API Rest, we will need to add the protocol (http or https), the port, and the API Key that we will need to allow communication with other devices. For example, in the 2SRA use case, as we need to enable the configuration between the VPN Gateway and the ON Core nodes, we will need to apply the corresponding configuration so that from the VPN Gateway we can communicate with the ON Core to send disconnection requests.

2.6.1.2.4. Connection settings

In this tab, we can configure the required parameters for ssh connection and the privileged user (if needed). If these parameters are not configured, the global settings will be applied (check Configuration -> Configuration vars -> NetDev). These parameters will be used in the ON NetConf module as we will need those parameters to connect to the device via ssh to apply a given configuration.

../../_images/networkdevices_connectionsettings.png


2.6.1.2.5. Backup settings

In this tab we will be able to configure the required parameters for SSH or SCP connection. We can also define the privilege user if necessary. If these parameters are not configured, the global settings will be applied (check Configuration -> Configuration vars -> NetDev). These parameters will be used in the ON Netbackup module as we will need those parameters to connect and extract the current configuration of a device. If we configure the SSH backup connection type, a file will be generated when we execute a NetBackup. By choosing the SCP option, a file will be sent to the defined IP in the Backup IP field.

../../_images/networkdevices_backupsettings.png


2.6.1.2.6. Compliance

In this tab, we can enable the compliance tests execution and select which test we want to execute. Once we execute a NetBackup on the device (if we have enabled the Check compliance flag) we will execute the compliance tests to check if the device configuration complies with the selected tests. Check the ON Netbackup module to find more information on how to run compliance tests, create rules, etc.

../../_images/networkdevices_compliance.png


2.6.1.2.7. Custom fields

In this tab we can configure other parameters that are not already defined in the previous tabs. You can define any parameter and its desired value by clicking on the Add new button. This will allow us to implement filters to find our device by the custom parameters that we define.

../../_images/networkdevices_customfields.png


2.6.1.3. Bulk edit

The Bulk edit allows you to modify multiple network devices entries at the same time. To open the features window shown below, go to the upper menu of the Network Devices tab, and find the Bulk edit button:

../../_images/bulk_edit_nd.png


2.6.1.3.1. General

This section shows the number of the user devices that we are editing compared to the total number of user devices.

2.6.1.3.2. Edit properties

On this section, we can edit the properties for the network devices selected. We have two windows, the Device info and the Custom fields.

Note

Removed properties will be ignored.

2.6.1.3.2.1. General

In this section, we can configure the main parameters for the network devices. The parameters are the IP, Brand, and Model. The other parameters will be useful to complete the device information. In this tab, we will also find the Tags fields, this will allow us to group the network devices based on different characteristics (physical location, device type, networks, etc). Check the Tags table to find all the available Tags and their information.

../../_images/nd_ep_general.png


2.6.1.3.2.2. Additional info

In this section, we can add more information about the network devices such as MAC address, location, maintenance dates, etc.

Note

This information is only used to complete the network device information. It is not going to be used by any product feature.

../../_images/nd_ep_ai.png


2.6.1.3.2.3. Disconnection settings

In this section, we can configure the device disconnection methods (via CoA, SNMP, or API) and its parameters. By configuring these methods, we will be able to communicate with the network device to disconnect user devices, extract information, etc. If these parameters are not configured, the global settings will be applied (check Configuration -> Configuration vars -> NetDev).

../../_images/nd_ep_ds.png


To communicate with the network devices we will need:

  • When using SNMP, we will need to apply the proper SNMP settings for the network devices. We will need to configure the SNMP version (SNMP v2 o higher is recommended), the different communities (Read Only and Read and Write), and if we are using SNMP v3 we will need to fill in other parameters such as security level, authorization protocol, etc.

  • When using CoA, we will also need to apply the proper configuration to allow communication between the ON Core and the network device through the 3799 port. Also, we will need to configure the Shared Secret Key.

  • When using API Rest, we will need to add the protocol (http or https), the port, and the API Key that we will need to allow communication with other devices. For example, in the 2SRA use case, as we need to enable the configuration between the VPN Gateway and the ON Core nodes, we will need to apply the corresponding configuration so that from the VPN Gateway we can communicate with the ON Core to send disconnection requests.

2.6.1.3.2.4. Connection settings

In this tab, we can configure the required parameters for ssh connection and the privileged user (if needed). If these parameters are not configured, the global settings will be applied (check Configuration -> Configuration vars -> NetDev). These parameters will be used in the ON NetConf module as we will need those parameters to connect to the device via ssh to apply a given configuration.

../../_images/nd_ep_cs.png


2.6.1.3.2.5. Backup settings

In this tab we will be able to configure the required parameters for SSH or SCP connection (also we can define the privilege user if it’s needed). If these parameters not configured the global settings will be applied (check on Configuration -> Configuration vars -> NetDev). These parameters will be used in the NetBackup module (check the ON Netbackup module) as we will need those parameters to connect and extract the current configuration of a device. If we configure the SSH backup connection type, a file will be generated when we execute a NetBackup. By choosing the SCP option, a file will be send to defined ip in the Backup IP field.

../../_images/nd_ep_bs.png


2.6.1.3.2.6. Compliance

In this tab we will be able to enable the compliance tests execution and to select which test do we want to execute, so once we execute a NetBackup on the device, if we have enabled the Check compliance flag, we will execute the compliance tests to check if the device configuration complies with the selected tests. Check the ON Netbackup module to find more information on how to run compliance tests, create rules, etc.

../../_images/nd_ep_c.png


2.6.1.3.2.7. Custom fields

In this tab we will be able to configure other parameters that are not already defined in the previous tabs, you can define any parameter and it’s desired value by clicking in the Add new button. This will allow us to implement filters to find our device by the custom parameters that we define.

../../_images/nd_ep_cf.png


2.6.1.3.3. Remove properties

It is possible to delete different properties for the user devices selected. The properties to delete are the following:

../../_images/ud_rm.png


  • Hostname: Allows deleting the hostname.

  • IP management: Allows deleting the IP management.

  • Description: Allows deleting the description.

  • Version: Allows deleting the version.

  • CPE: Allows deleting the CPE.

  • SNMP version: Allows deleting the SNMP version.

  • SNMP RO: Allows deleting the SNMP RO.

  • SNMP RW: Allows deleting the SNMP RW.

  • SNMP v3 Security name: Allows deleting the SNMP v3 Security name.

  • SNMP v3 Security level: Allows deleting the SNMP v3 Security level.

  • SNMP v3 Authorization protocol: Allows deleting the SNMP v3 Authorization protocol.

  • SNMP v3 Authorization pass phrase: Allows deleting the SNMP v3 Authorization pass phrase.

  • SNMP v3 Privacy protocol: Allows deleting the SNMP v3 Privacy protocol.

  • SNMP v3 Privacy pass phrase: Allows deleting the SNMP v3 Privacy pass phrase.

  • CoA password: Allows deleting the CoA password.

  • CoA port: Allows deleting the CoA port.

  • API Rest protocol: Allows deleting the API Rest protocol.

  • API Rest port: Allows deleting the API Rest port.

  • API key: Allows deleting the API key.

  • Disconnection type: Allows deleting the Disconnection type.

  • Purchase date: Allows deleting the Purchase date.

  • Purchase order: Allows deleting the Purchase order.

  • Warranty: Allows deleting the Warranty.

  • Maintenance: Allows deleting the Maintenance.

  • EOL: Allows deleting the EOL.

  • Connection type: Allows deleting the Connection type.

  • User: Allows deleting the User.

  • Password: Allows deleting the Password.

  • Privilege user: Allows deleting the Privilege user.

  • Backup connection type: Allows deleting the Backup connection type.

  • Backup user: Allows deleting the Backup user.

  • Backup password: Allows deleting the Backup password.

  • Backup IP: Allows deleting the Backup IP.

  • Backup path: Allows deleting the Backup path.

  • Backup filename: Allows deleting the Backup filename.

  • Backup privilege: Allows deleting the Backup privilege.

  • Check compliance: Allows deleting the Check compliance.

  • Compliance groups of tests: Allows deleting the Compliance groups of tests.

  • Tags: Allows deleting multiple tags.

  • Custom fields: Allows deleting multiple custom fields.

2.6.1.4. Script to update tags

There is a script that allows adding and removing tags from NETWORK DEVICES. Apply it when it is necessary to deal with large volumes of devices and tags. We will use a CSV file to specify the IP address of the network device(s) and the tag(s) that we want to add or remove. We can also remove tags on a “large scale” according to the prefix of a tag (ONC, LBD, etc.), in this case, we will remove the tags that contain a specified prefix.

The script is the following:

/usr/share/opennac/utils/scripts/netdev_mod_tags.php

The available options are:

  • -u: user (admin by default)

  • -p: user password (opennac by default)

  • -h: host ip (127.0.0.1 by default)

  • -a: add the tags associated with an IP address on the CSV file

  • -d: delete the tags associated with an IP address on the CSV file

  • -l: lists the network devices whose tags match with a given prefix

  • -r: remove tags from network devices whose tags match with a given prefix

Execution example with all parameters:

./netdev_mod_tags.php -h <apiip> -u <apiuser> -p <apipwd> [-a add | -d delete ]  <file.csv> ||  [ -r delete partial | -l list] <Partial Tag>

2.6.1.4.1. List using partial tag

List the devices that match the specified partial tag.

Example of tag prefix for deleting partial/list:

NDT_OF, LFL_, ICT,

Execution example:

./netdev_mod_tags.php -l <partial_tag>

2.6.1.4.2. Delete using partial tag

All tags with the specified prefix (partial tag) will be deleted

Execution example:

./netdev_mod_tags.php -a partial -t <partial_tag>

2.6.1.4.3. Add/Remove tags using csv file

To add or remove tags using a CSV file, we need to relate the specific IP to the tags that we want to remove or add.

The CSV file that must be added to add/delete options, contains a list of IP addresses, referring to the network devices, and the associated tags to add or remove:

Example CSV file:

<IP>,<tag01>,<tag02>,<tag03>
<IP>,<tag01>,<tag02>

Execution example:

./netdev_mod_tags.php [-a | -d] <file.csv>