Avaya Integrated Management Release 6.0 Integrated Management Database Configuration

Transcription

1 Avaya Integrated Management Release 6.0 Integrated Management Database Configuration June 2010

2 2010 Avaya Inc. All Rights Reserved. Notice While reasonable efforts were made to ensure that the information in this document was complete and accurate at the time of printing, Avaya Inc. can assume no liability for any errors. Changes and corrections to the information in this document may be incorporated in future releases. For full legal page information, please see the complete document, Avaya Legal Page for Software Documentation, Document number To locate this document on the website, simply go to and search for the document number in the search box. Documentation disclaimer Avaya Inc. is not responsible for any modifications, additions, or deletions to the original published version of this documentation unless such modifications, additions, or deletions were performed by Avaya. Customer and/or End User agree to indemnify and hold harmless Avaya, Avaya's agents, servants and employees against all claims, lawsuits, demands and judgments arising out of, or in connection with, subsequent modifications, additions or deletions to this documentation to the extent made by the Customer or End User. Link disclaimer Avaya Inc. is not responsible for the contents or reliability of any linked Web sites referenced elsewhere within this documentation, and Avaya does not necessarily endorse the products, services, or information described or offered within them. We cannot guarantee that these links will work all of the time and we have no control over the availability of the linked pages. Warranty Avaya Inc. provides a limited warranty on this product. Refer to your sales agreement to establish the terms of the limited warranty. In addition, Avaya s standard warranty language, as well as information regarding support for this product, while under warranty, is available through the following Web site: Copyright Except where expressly stated otherwise, the Product is protected by copyright and other laws respecting proprietary rights. Unauthorized reproduction, transfer, and or use can be a criminal, as well as a civil, offense under the applicable law. Avaya support Avaya provides a telephone number for you to use to report problems or to ask questions about your product. The support telephone number is in the United States. For additional support telephone numbers, see the Avaya Web site:

3 Contents Preface Purpose Prerequisites Intended audience Conventions used in this document Additional resources Product documentation How to access documents on the Web Chapter 1: Resources and Notices Getting help with the installation Avaya Technology and Consulting Avaya Global Services Delivery Avaya Global Technical Services Avaya Professional Services Customized Management Solutions for Avaya Integrated Management Avaya contact information Third party resources System security notices Network security Toll fraud security Avaya disclaimer Toll fraud intervention Chapter 2: Overview What is new in this release Release 6.0 enhancements PC Requirements Configuration checklist Chapter 3: Setting up Integrated Management Database Configuring LDAP Issue Resolution Installing Integrated Management Database in a customer specified directory.. 20 Generating a random password for the Performance and Administration administrator user 20 Using the randomly generated password June

4 Contents Switching to the old Java plug-in Configuring a new installation Procedure 1: Logging into the Integrated Management Database Notifying the administrator when the user login fails Procedure 2: Adding locations Procedure 3: Configuring notification Procedure 4: Configuring the security defaults for Integrated Management Database27 Procedure 5: Configuring the SNMP settings Procedure 6: Configuring the LDAP server connection RADIUS authentication Procedure 7: Configuring a RADIUS server Testing connectivity information for a RADIUS server Authentication, Authorization and Accounting Procedure 8: Configuring Authentication, Authorization and Accounting.. 35 Sequence of AAA configuration methods Delay in the appearance of the MultiSite Administration user manager.. 36 Procedure 9: Adding a Secure Services Gateway as an element Procedure 10: Adding a Secure Access Link as an element Procedure 11: Adding a Network Management System element Procedure 12: Adding elements Adding a voice system Adding a messaging system or a similar application server Procedure 13: Creating a Fault and Performance Manager role Editing a Fault and Performance Manager role Procedure 14: Adding a user Copying an Integrated Management Database user Creating an Integrated Management Database role Creating a custom Integrated Management Database role Editing an Integrated Management Database role Deleting an Integrated Management Database role Procedure 15: Adding an LDAP group Copying an LDAP group Importing of configuration data Importing of user data Exporting of data Viewing the Integrated Management Database administration log Backing up Integrated Management Database Backing up data using the GUI utility Scheduling backups using the GUI utility Cancelling scheduled backups using the GUI utility Avaya Integrated Management Database Configuration

5 Contents Backing up data using the Command Line method Restoring Integrated Management Database Restoring data using the GUI utility Restoring data using the Command Line method Index June

6 Contents 6 Avaya Integrated Management Database Configuration

7 Preface Purpose This document explains how to configure Avaya Integrated Management database (IMD). Prerequisites Setting up IMD requires familiarity with network administration, knowledge of the Red Hat implementation of the Linux operating system, and proficiency with Linux administration. This document does not impart this knowledge but is nevertheless essential for a successful installation. This is why Avaya recommends that workstation or network administrators take the primary role in the initial configuration of Integrated Management Database. Intended audience This guide is intended for workstation or network administrators. Conventions used in this document In this document, we use the following typographical conventions: We use bold type for emphasis and for any information that you should type; for example: save translation. We use Courier font for any information that the computer screen displays; for example: login. We use arrows to indicate options that you should select on cascading menus; for example: Select File>Open means choose the Open option from the File menu. June

8 Preface Additional resources For help to use IMD, access the IMD online help. It explains how you can perform basic administration tasks. To access the online help, click Help on the Integrated Management Database page. Product documentation The latest version of Avaya Integrated Management product documentation, including this document, is available from the Avaya Support Web Site. To view or download these documents from the Web, you must have access to the Internet, an Internet browser, and Adobe Reader. Adobe Reader 8.0 is provided on the Avaya Integrated Management CD and is also available from See How to access documents on the Web on page 8 for instructions on how to view or download these documents. How to access documents on the Web To view or download documents from the Avaya Support Web Site, follow these steps: 1. Access 2. Click Downloads. 3. Click the letter I in the alphabet listing. 4. Click the Integrated Management (All Offers). 5. Under Documentation, click the document category. The page displays a list of available documents for that product or offer in that category. 6. Click on Title to view product specific documentation. 8 Avaya Integrated Management Database Configuration

9 Chapter 1: Resources and Notices Avaya provides our customers with a variety of planning, consulting, and technical services. The sections below briefly describe the resources and services that are available. Client executives are your primary contact to obtain information and explore options to meet your specific business needs. Getting help with the installation If you are located within the United States and you want help installing or setting up IMD, call your Avaya representative. If you are located outside the United States, call your Avaya representative or distributor. Call at least four weeks before the date on which you want to install and configure IMD. Avaya Technology and Consulting Avaya Technology and Consulting (ATAC) works with client teams to develop detailed solutions for connectivity to Avaya media servers running Avaya Aura Communication Manager software. The ATAC also designs network configurations to support IMD. Avaya Global Services Delivery Avaya Global Services Delivery (GSD) provides support to Avaya Integrated Management client teams, field technicians, and customers. The GSD will bill customers for support on a time and materials basis if the following conditions exist: Customers do not provide remote access Customers do not have a current maintenance agreement Customers do not procure and install the required systems and software as defined in the Avaya Integrated Management Services Support Plan Customers request support that is outside the purchase agreement The GSD does not support hardware or software that customers purchase from third-party vendors. June

10 Resources and Notices Avaya Global Technical Services Avaya Global Technical Services answers customer calls about products in Avaya Integrated Management. They will either answer your questions directly or connect you with an associate who can answer questions about the products. Avaya Professional Services The Avaya Professional Services (APS) team of Avaya Integrated Management (AIM) consultants offers customers the following services: Platform readiness verification Avaya Integrated Management architectural planning, design, and overview Remote turnkey implementation and installation Avaya Integrated Management server configuration Customer acceptance verification Custom onsite services Onsite and remote knowledge transfer The APS Data Group consists of the following teams: Avaya Integrated Management Consultants The Avaya Integrated Management consulting team offers planning, design, implementation, consulting, and knowledge transfer services for the entire Avaya Integrated Management suite. This includes Site Administration, Voice Announcement Manager, Network Management Console with Software Update Manager, MultiSite Administration, and Fault and Performance Manager. The thrust of the APS team is to bring the correct methodology to these complex application deployments that span various regions, and to provide continuity to the overall project. Through proper integration and consulting, our customers can leverage the Avaya Integrated Management suite to lower the total cost of ownership, and proactively manage their VoIP network comfortably and confidently. Data Network Implementation Engineering The Data Network Implementation Engineering (formerly RNIS) team implements and upgrades or upgrades, existing or new data networks. This team analyzes the network design requirements and performance expectations of the customer. The team then creates the hardware and software installation specification used to implement data devices that include Cajun, VPN, Wireless LAN, Secure Gateways, Extreme, Juniper, and multivendor data equipment. 10 Avaya Integrated Management Database Configuration

11 Avaya contact information The APS Data Group provides support on a contract basis. Contact your local Avaya Account Team or Business Partner to purchase any implementation offer from the team. For more information, see Table 1: Customer-Accessible Resources on page 12, or contact Jon Machak at or machak@avaya.com. Customized Management Solutions for Avaya Integrated Management The Integrated Management Product Team understands customers needs and is focused on customer satisfaction. See Table 1: Customer-Accessible Resources on page 11 for contact information. The Product Team will assist customers with Avaya Integrated Management projects and will provide: Project Management An Integrated Management project person will work with the customer to access configuration and customization requirements for any or all applications within each Avaya Integrated Management offer. If custom work is required, the evaluation will include a proposed statement of work and price. Note that this offer is not intended to provide installation for customers that choose to implement Integrated Management applications using Avaya Services or third-party implementation services. Training Basic training can be performed remotely using an interactive medium to display the applications and a conference bridge for audio. On-site training can be customized to meet the customer s needs. Customized training will focus on application functionality that is relevant to the customer and provide focused knowledge transfer to facilitate application specific training. Avaya contact information Table 1 provides contact information that you may use if you need assistance during the process of installing and setting up Avaya Integrated Management. Table 1: Customer-Accessible Resources Resource Avaya Support Center Avaya Global Technical Services Avaya Professional Services (APS) Contact Information x , prompt 3 June

12 Resources and Notices Table 1: Customer-Accessible Resources Resource Integrated Management Product Team Contact Information Send to: Toll Fraud Intervention , prompt 1 Third party resources Table 2 lists contact information for third party vendors. Table 2: Vendor web sites Vendor Microsoft Red Hat Linux Web Sites Main site: Main site: System security notices Customers are solely responsible for the security of their system, network, and access to hardware and software. The sections below define the precautions that all customers should take to maintain the security of their systems. Network security IMD uses the standard security features on the supported Red Hat Linux operating system. Avaya strongly recommends that customers use passwords to prohibit access to their systems and to routinely change those passwords to maintain security. SECURITY ALERT:! SECURITY ALERT: Customers should always change passwords immediately after external vendors have completed installation, maintenance, troubleshooting, or other tasks on their system. 12 Avaya Integrated Management Database Configuration

13 System security notices Toll fraud security Although IMD is generally not at risk for toll fraud, customers are solely responsible for the security of their entire telecommunications system. Toll Fraud is the unauthorized use of a company s telecommunications system by unauthorized parties. Unauthorized parties are persons other than the company s employees, agents, subcontractors, or persons working on behalf of the company. Toll fraud can result in substantial additional charges for the company s telecommunications services. The company s system manager is responsible for the security of the company s system, which includes programming and configuring the equipment to prevent unauthorized use. Avaya disclaimer Avaya does not warrant that this product is immune from or will prevent unauthorized use of common-carrier telecommunications services or facilities accessed through or connected to it. Avaya will not be responsible for any charges that result from such unauthorized use. Toll fraud intervention If customers suspect that they are a victims of toll fraud and need technical assistance, they should refer to the phone number listed in Customer-Accessible Resources on page 11. June

14 Resources and Notices 14 Avaya Integrated Management Database Configuration

15 Chapter 2: Overview IMD (IMD) is a common data store for device data, such as configurations of voice systems, SIP servers, messaging systems, system adjuncts, and managed applications, that Avaya Integrated Management applications share. The following Avaya Integrated Management applications use the information stored in Integrated Management Database: Avaya MultiSite Administration (MSA) Avaya Fault and Performance Manager (FPM) What is new in this release Release 6.0 enhancements This release supports the following: Support for the following Avaya Aura Communication Manager servers: VCM on S8510 server VCM on S8300D server VCM on S8800 server Support for SNMP v3 Support for Secure Access Link (SAL) 1.8. June

16 Overview PC Requirements To access IMD, your PC should meet the following requirements: Parameter Requirement Operating system Microsoft Windows XP Professional with Service Pack 2, Microsoft Windows 2000 Professional with Service Pack 4, Microsoft Windows 2000 Server with Service Pack 4, Microsoft Windows 2003 Standard Edition Server with Service Pack 2, Microsoft Windows 2003 Enterprise Edition Server with Service Pack 2, Microsoft Windows Vista Business (32-bit and 64-bit editions), or Microsoft Windows Vista Enterprise (32-bit and 64-bit editions) Other software Internet Explorer 8.0 Internet Explorer 7.0 Internet Explorer 6.0 with Service Pack 1 or Mozilla Firefox 3.0 Processor RAM Available Disk Space CD-ROM Network Connectivity IP Addresses Display 1.5 GHz 512 MB Minimum: 100 MB on the drive that contains the Windows System folder (normally but not always the C: drive) Maximum: Up to 1GB (if this computer is running all Integrated Management client applications) Optional TCP/IP Static or dynamic (DNS preferred) SVGA 16 Avaya Integrated Management Database Configuration

17 Configuration checklist Configuration checklist If you upgraded an existing system that runs Avaya Integrated Management Release 5.2, you can log into Integrated Management Database and administer the system.to configure the RADIUS server, see Procedure 7: Configuring a RADIUS server on page 32.To configure Authentication, Authorization and Accounting in Integrated Management Database, see Procedure 8: Configuring Authentication, Authorization and Accounting on page 35. If you performed a new installation of the Avaya Integrated Management Release 6.0 software, you must configure Integrated Management Database. To configure Integrated Management Database, see Configuring a new installation on page 23. June

18 Overview 18 Avaya Integrated Management Database Configuration

19 Chapter 3: Setting up Integrated Management Database In Avaya Integrated Management (IM), the device data, such as configurations of voice systems, messaging systems, system adjuncts, managed applications, and user accounts are stored in the Integrated Management Database. The Integrated Management applications, Avaya MultiSite Administration and Avaya Fault and Performance Manager, share this data. The Avaya Integrated Management applications retrieve this data and verify user accounts from Integrated Management Database. You must configure Integrated Management Database to use the Integrated Management applications. If you upgraded an existing system that runs Avaya Integrated Management Release 5.2 software, you can log into Integrated Management Database and administer the system. To configure the RADIUS server, see Procedure 7: Configuring a RADIUS server on page 32. To configure Authentication, Authorization and Accounting in Integrated Management Database, see Procedure 8: Configuring Authentication, Authorization and Accounting on page 35. If you performed a new installation of the Avaya Integrated Management Release 6.0 software, see Configuring a new installation on page 23 for the configuration procedure. Configuring LDAP Issue Users who added the Active Directory Server as the LDAP server in Integrated Management Database, and were placed under the SubDN of the BaseDN, could not log in to MultiSite Administration. Resolution Integrated Management 6.0 addresses this issue by changing the LDAP implementation for Integrated Management Database and MultiSite Administration. Changes were made to the field for the LDAP User in Integrated Management Database. An increase in the length of the field now makes it possible for the user to enter the complete administrator DN in the field. June

20 Setting up Integrated Management Database If a user is placed under a BaseDN different from the BaseDN in Integrated Management Database, then the LDAP administrator DN must be configured in Integrated Management Database. If a user, who has configured the LDAP server in Integrated Management Database, enters just the user name in the LDAP Administrator settings, the system displays a pop-up warning. The warning prompts the user to enter the complete UserDN, if the user is placed under a different BaseDN. Installing Integrated Management Database in a customer specified directory Integrated Management Release 6.0 supports the installation of Integrated Management Database in a customer specified directory. The default directory continues to be /opt/avaya, but the Performance and Administration installer makes provision for users to specify an alternate directory to install Integrated Management Database on the Linux server. The equivalent for /opt in Release 6.0 is <install location>. Generating a random password for the Performance and Administration administrator user Earlier versions of Integrated Management had a predefined password for the administrator password. This predefined password compromised password security. Integrated Management 6.0 enhances password security with a mechanism that replaces the predefined password for the administrator user in the Performance and Administration 6.0 installer. The new mechanism provides the user the options to: specify a password leave the password field blank so that the system can generate a random password Support for this feature is available only for fresh Integrated Management 6.0 installations and the system displays a message to this effect on the installer screen. The system also displays the message during an installation in the console mode. Support for this feature does not extend to upgrades. 20 Avaya Integrated Management Database Configuration

21 Generating a random password for the Performance and Administration administrator user During the Performance and Administration installation, the system displays a prompt for the administrator user. You can enter the password for the admin. user or let the system generate the password manually for you. At the prompt, the administrator user can specify a password or can leave the field blank. The password that the user specifies must be alphanumeric, at least eight characters long, without special characters, and without spaces. If the administrator user enters a password that is less than eight characters long or contains spaces, the system displays the following error message: You have entered an invalid password. If the user leaves the Password field blank, the system generates a random password and displays it to the user. This is done only when the installation is complete. The system does not display it immediately. The user can neither copy nor edit the password. The same password is also available in the file <Sys Mgmt Installation Directory>/avaya/VisAbility/html/ im_env.props as an AIM_ADMIN variable. The user logs in to Integrated Management Database the first time with this password. Thereafter, the user can reset the password. The equivalent directory for the /opt in release 6.0 is < install location >. Using the randomly generated password To use the randomly generated password: 1. Complete a fresh Integrated Management 6.0 installation. During the installation, the system displays a prompt for a password for the administrator user. If the user fails to enter a password, the application retrieves the random password from the im_env.props file as the variable AIM_ADMIN. 2. Use this password to log into Integrated Management Database. Integrated Management Database accepts this password and the system displays the change password message. If the user enters a password, it must be alphanumeric, have tallest eight characters, and without spaces or special characters. If the user enters a password, the user can access Integrated Management Database with it. June

22 Setting up Integrated Management Database Switching to the old Java plug-in Integrated Management ensures that fresh or upgrade installations of Performance and Administration 6.0 on RHEL 5, 32 or 64 bits, display the JRE version as JRE 1.6.0_11 has been replaced with JRE Performance and Administration enables the new Java Plug-in by default. However, if the user encounters problems when running the applets with the new Java Plug-in, the user can switch to the old Java plug-in. To switch to the old Java plug-in: 1. Click Start. 2. Click Control Panel. 3. Double-click Java Control Panel. 4. Click the Advanced tab on Java Control Panel. 5. Scroll to the Java Plug-in entry. 6. Clear the Enable next-generation Java Plug-in check box. 7. Click OK and restart the browser. 22 Avaya Integrated Management Database Configuration

23 Configuring a new installation Configuring a new installation If you performed a new installation of the Avaya Integrated Management Release 6.0 software, you must configure Integrated Management Database. To configure Integrated Management Database, perform the following procedures: 1. Log into Integrated Management Database. For the procedure, see Procedure 1: Logging into the Integrated Management Database on page Add locations to Integrated Management Database. For the procedure, see Procedure 2: Adding locations on page Configure the notification. For the configuration procedure, see Procedure 3: Configuring notification on page Configure the security defaults for Integrated Management Database. For the configuration procedure, see Procedure 4: Configuring the security defaults for Integrated Management Database on page Configure the SNMP settings. For the configuration procedure, see Procedure 5: Configuring the SNMP settings on page Configure the LDAP server connection. For the configuration procedure, see Procedure 6: Configuring the LDAP server connection on page Configure the RADIUS server. For the configuration procedure, see Procedure 7: Configuring a RADIUS server on page Configure AAA. For the procedure, see Procedure 8: Configuring Authentication, Authorization and Accounting on page Add a Secure Services Gateway (SSG) as an element to Integrated Management Database. For the procedure, see Procedure 9: Adding a Secure Services Gateway as an element on page Add Network Management System elements to Integrated Management Database. For the procedure, see Procedure 11: Adding a Network Management System element on page Add elements to Integrated Management Database. For the procedure, see Procedure 12: Adding elements on page Create Fault and Performance Manager Roles. For the procedure, see Procedure 13: Creating a Fault and Performance Manager role on page Add users to Integrated Management Database. For the procedure, see Procedure 14: Adding a user on page Add LDAP groups to Integrated Management Database. For the procedure, see Procedure 15: Adding an LDAP group on page 56. June

24 Setting up Integrated Management Database Procedure 1: Logging into the Integrated Management Database To log into Integrated Management Database: 1. Using Microsoft Internet Explorer 6.0 SP1 or a later version of it, proceed to the IP address, FQDN or hostname of the Linux server to view the Avaya Integrated Management Launch Products page. The system displays the Before You Begin page. 2. Click Continue. The system displays the Logon page. The first time you log into Integrated Management Database, you must change the default password. 3. Click Change Password. The system displays the Change Password page. 4. In the User ID field, enter admin. 5. In the Current Password field, enter admin In the New Password field, enter your new password. 7. In the Re-Type New Password field, re-enter your new password. 8. Click Change Password. The system displays the message: Status: Password successfully changed. 9. Click Go to IMD Login. The system displays the Logon page. 10. In the User ID field, enter admin. 11. In the Password field, enter your new password, and click Logon. The system displays the Integrated Management Database Administrator page. For the procedure to add locations, see Procedure 2: Adding locations on page 25. Notifying the administrator when the user login fails Integrated Management Database users that have their logins disabled, after more Authentication Fails than the number permitted, may notify their administrators to have their logins unlocked. To notify the administrator in the event of a login lock: If the number of attempted logins exceeds the number set as # Authentication Fails on Users, the system displays the message: Login has been disabled. Contact your administrator. Click Notify to Admin. The system displays the Notify to Administrator page. 24 Avaya Integrated Management Database Configuration

25 Configuring a new installation The page holds the following pertinent information: the ID of the administrator the address of the server to which the user attempted login the status of the authentication attempt details as to whether it was successful the status of the transmission from the server such as details as to whether it was successful. Your administrator receives the following I am a user of IMD and my name is... My IMD login has been locked. Please unlock it. Procedure 2: Adding locations You should add at least one location to Integrated Management Database. To add a location: 1. Click Locations on the navigation pane. The system displays the Locations page. 2. Click New location. The system displays the Add Location page. 3. Enter the information for the new location. It is important to enter the following information for a location: - Contact - Telephone number of the contact - address of the contact 4. When finished, click Add. 5. Repeat Steps 2 through 4 for each location. When finished, see Procedure 3: Configuring notification on page 26 for information on configuring notification. June

26 Setting up Integrated Management Database Procedure 3: Configuring notification You must configure the SMTP server so that MultiSite Administration and Fault and Performance Manager can send notifications. To configure the server information: 1. Click Server on the navigation pane. The system displays the Change SMTP Server Configuration page. 2. In the Primary SMTP Server area, enter the IP address or fully-qualified domain name (FQDN) of the primary SMTP server 3. In the SMTP Service TCP Port field, enter the TCP port number of the server. The default TCP port number for SMTP is In the SMTP Server Login field, enter the login ID for the SMTP server. The login ID is optional. 5. In the SMTP Server Password field, enter the password for the SMTP server. The password is optional. 6. In the Re-Type SMTP Server Password field, re-enter the password for the SMTP server. 7. In the Avaya IM From field, enter the account that you want the system to display in the From field in the messages sent from MultiSite Administration and Fault and Performance Manager. 8. In the Secondary SMTP Server area, enter the IP address or FQDN of the secondary server in the SMTP Server IP Address field. The secondary SMTP server is used for redundancy and backup purposes. 9. In the SMTP Service TCP Port field, enter the TCP port number of the server. 10. In the SMTP Server Login field, enter the login ID for the SMTP server. 11. In the SMTP Server Password field, enter the password for the SMTP server. 12. In the Re-Type SMTP Server Password field, re-enter the password for the SMTP server. 13. In the Avaya IM From field, enter the account that you want the system to display in the From field in the messages sent from MultiSite Administration and Fault and Performance Manager. 14. When finished, click Save. 15. If you want to send an message to verify that the SMTP server is configured properly within Integrated Management Database, enter your address in the text box next to the Send Test button, and then click Send Test to. The system displays the IMD Server Test page and shows the progress and status of the SMTP sessions even while it sends the test to the specified address. 16. Click Close Window. 26 Avaya Integrated Management Database Configuration

27 Configuring a new installation When finished, configure the security defaults. For the procedure, see Procedure 4: Configuring the security defaults for Integrated Management Database on page 27. Procedure 4: Configuring the security defaults for Integrated Management Database Use this procedure to change the defaults for the following security settings: The frequency at which users can change their passwords The minimum length of passwords The frequency at which passwords expire The number of failed login attempts before the user is locked out of the system Provision to block users from modifying their Integrated Management Database account settings Provision to block users from changing the user password from MultiSite Administration/ Fault and Performance Manager Provision to block multiple instances of the same user logging into Integrated Management Database The time limit for a session To configure the defaults for the security settings: 1. Click Security on the navigation pane. The system displays the Change Security Defaults page. 2. From the Allowed Password Change Frequency field, enter the frequency at which users can change their passwords. The options available are Daily, None, Hourly, Weekly, and Monthly. 3. In the Password Minimum Length field, enter the minimum length required for passwords. If you want to disable the minimum required length for passwords, enter 0. For security reasons, you should enable the minimum length of password feature. 4. In the Password Aging Interval field, enter the number of days after which passwords will expire. If you do not want passwords to expire, enter 0. For security reasons, you should enable the password aging feature. 5. In the Invalid Password Attempts field, enter the number of failed login attempts after which the user is locked out of the system. If you do not want users to ever get locked out of the system due to invalid login attempts, enter 0. June

28 Setting up Integrated Management Database For security reasons, you should enable the invalid password attempts feature. 6. If you want to prevent users from modifying their Integrated Management Database account settings, select the Block User Self Modification check box. 7. If you want to block multiple instances of the same user logging into Integrated Management Database, select the Block Concurrent Users check box. The Delete check box was disabled in Integrated Management Database 5.0 to prevent the deletion of users who accessed Integrated Management Database under the Concurrent Users provision. Integrated Management Database 6.0 has revoked this disablement and allows the IMDSuperUser to delete users. 8. If you want to prevent users from modifying the user password from MultiSite Administration/Fault and Performance Manager, select Disable Change Password. 9. If you want to specify the time limit for a session, enter the appropriate setting in the Session Limit field. If the Block Concurrent Users check box is selected, and the session limit has expired, the other user will be able to log into Integrated Management Database. If the Block Concurrent Users check box is selected, and a user clicks Close on the browser window, the session is kept open until the session limit expires. If the user tries to log in again, then the system displays a User already logged in message. A user who wants to leave a session has to log out from Integrated Management Database. 10. When finished, click Save. When finished, configure the SNMP settings. For the configuration procedure, see Procedure 5: Configuring the SNMP settings on page 28. Procedure 5: Configuring the SNMP settings You can define a global default SNMP configuration for Fault and Performance Manager. Fault and Performance Manager uses this default configuration to access media gateways and other devices that do not have an SNMP community string directly defined. To configure the SNMP settings: Click SNMP on the navigation pane. The system displays the Change SNMP Configuration page. SNMP V1/V2 Configuration 1. If you would like to enable SNMPv1, select the SNMPv1 Enabled check box. 2. If you would like to enable SNMPv2, select the SNMPv2 Enabled check box. 28 Avaya Integrated Management Database Configuration

29 Configuring a new installation 3. In the SNMP Read Community field, enter the SNMP get community string. The system uses this to validate SNMP set requests. 4. In the SNMP Write Community field, enter the SNMP set community string. The system uses this to validate SNMP set requests. SNMP V3 Configuration If you would like to enable SNMPv3, click SNMPv3 Enabled. Remote Agent Configuration 1. Enter the SNMP User Name. This user name should be the same as the one you configured on the Communication Manager for SNMP v3. 2. Select the appropriate Authentication Protocol from the following: MD5 SHA NoAuth 3. Specify a password for SNMP v3 authentication. This password should be the same as the one you configured on the Communication Manager for SNMP v3 authentication. 4. Re-enter the Authentication Password specified in the above field. 5. Select the appropriate Privacy Protocol from the following: DES AES NoPriv 6. Specify a password for SNMP v3 privacy. This password should be the same as the one you configured on the Communication Manager for SNMP v3 privacy. 7. Re-enter the Privacy Password specified in the above field. Trap Receiver Configuration 1. Enter the SNMP Trap Receiver User Name. This user name should be the same as the one you configured on the Communication Manager for SNMP v3. 2. Select the appropriate Trap Receiver Authentication Protocol from the following: MD5 SHA NoAuth 3. Specify a password for SNMP v3 Trap Receiver authentication. This password should be the same as the one you configured on the Communication Manager for SNMP v3 authentication. June

30 Setting up Integrated Management Database 4. Re-enter the Trap Receiver Authentication Password specified in the above field. 5. Select the appropriate Trap Receiver Privacy Protocol from the following: DES AES NoPriv 6. Specify a password for SNMP v3 privacy. This password should be the same as the one you configured on the Communication Manager for SNMP v3 privacy. 7. Re-enter the Trap Receiver Privacy Password specified in the above field. Click Save. When finished, configure the LDAP server connection. For the configuration procedure, see Procedure 6: Configuring the LDAP server connection on page 30. Procedure 6: Configuring the LDAP server connection Use this procedure to configure the LDAP server connection and authentication information that MultiSite Administration and Fault and Performance Manager use for authentication. If you use Microsoft Active Directory, the default group number attribute is called primarygroupid. If you use OpenLDAP or LDAPS, the default group number attribute is called gidnumber. Make sure you enter this primarygroupid/gidnumber for the Integrated Management Database groups. To configure the LDAP server connection and authentication information: 1. Click LDAP Server on the navigation pane. The system displays the Change LDAP Server Configuration page. 2. In the Primary LDAP Server area, in the LDAP Server IP Address/FQDN field, enter the IP address or fully qualified domain name (FQDN) of the primary LDAP server. 3. In the LDAP Service TCP Port field, enter the TCP port number of the LDAP server. The TCP port number for LDAP is usually 389. When SSL is selected, the port is usually Select the LDAP Server SSL Enabled check box if SSL is enabled on the LDAP server. 5. Select the LDAP Server MD5 Enabled check box if MD5 is enabled on the LDAP server. 6. In the LDAP Server BaseDN field, enter the basedn for the LDAP server. 7. In the LDAP User field, enter the login ID for the LDAP server. 8. In the LDAP Password field, enter the password for the LDAP server. The password is optional. 9. In the Secondary LDAP Server area, in the LDAP Server IP Address/FQDN field, enter the IP address or fully qualified domain name (FQDN) of the secondary LDAP server. 30 Avaya Integrated Management Database Configuration

31 Configuring a new installation 10. In the LDAP Service TCP Port field, enter the TCP port number of the LDAP server. The TCP port number for LDAP is usually 389. When SSL is selected, the port is usually Select the LDAP Server SSL Enabled check box if SSL is enabled on the LDAP server. 12. Select the LDAP Server MD5 Enabled check box if MD5 is enabled on the LDAP server. 13. In the LDAP Server BaseDN field, enter the basedn for the LDAP server. 14. In the LDAP User field, enter the login ID for the LDAP server. 15. In the LDAP Password field, enter the password for the LDAP server. The password is optional. 16. In the Retry Configuration area, enter the number of times you want to retry the connection to the LDAP server or servers. A retry occurs when Integrated Management Database receives LDAP read errors during authentication sessions. 17. In the Seconds between Retries field, enter the interval, in seconds, between each retry. 18. Select Active Directory if you want to use LDAP Active Directory for the Primary LDAP Server or the Secondary LDAP Server. 19. When finished, click Save. 20. If you want to verify that the connection to the LDAP server or servers is configured properly within Integrated Management Database, click Test LDAP Servers. The system displays the IMD LDAP Server Test window and displays the progress and status of the connection to the LDAP server or servers. The system displays the Test LDAP button only after you save the settings. 21. Click Close Window. 22. Click OK. RADIUS authentication In Integrated Management 6.0, MultiSite Administration, Fault and Performance Manager and Integrated Management Database support authentication of users through RADIUS. These applications connect to the RADIUS server to authenticate a user. Integrated Management Database is the logical place to have the authentication configured as the IP address and other parameters of this server is shared information. Authentication with the RADIUS server is done with the use of a shared secret: the authentication process uses a challenge and response routine to establish the authenticity of a user. The addition of extra logs for RADIUS and LDAP users in Integrated Management Database ensures that logs are reported correctly in Integrated Management Database. The extra logs also ascertain the exact causes for RADIUS or LDAP authentication failures. June

32 Setting up Integrated Management Database Integrated Management Database provides a RADIUS Server page to configure the RADIUS server or servers to be used for authentication. Procedure 7: Configuring a RADIUS server To access the Radius server page: 1. Enter your user ID and password and log into Integrated Management Database. The system displays the IMD Database Administration page. 2. Click RADIUS Server on the navigation pane. The system displays the Change Radius Server Configuration page. To configure the Primary RADIUS server. 3. In the RADIUS Server IP Address/FQDN field, enter the values for the RADIUS Server IP Address or FQDN.The default value is blank. 4. In the RADIUS Service TCP Port field, enter the value for the RADIUS Service TCP Port.The default value is In the RADIUS Server Shared Secret field, enter the RADIUS server shared secret.the default value is blank. 6. In the RADIUS User field, enter the name of the RADIUS user.the default value is blank. 7. In the RADIUS Password field, enter a RADIUS password.the default value is blank. To configure the Secondary RADIUS Server. 8. In the RADIUS Server IP Address/FQDN field, enter the values for RADIUS Server IP Address or FQDN.The default value is blank. 9. In the RADIUS Service TCP Port field, enter the value for the RADIUS Service TCP Port.The default value is In the RADIUS Server Shared Secret field, enter the RADIUS server shared secret.the default value is blank. 11. In the RADIUS User field, enter the name of the RADIUS user.the default value is blank. 12. In the RADIUS Password field, enter a RADIUS password.the default value is blank. To configure retries. 13. In the Number of Retries field, enter a value.the default value is In the Seconds between retries field, enter a value.the default value is Click Save. The RADIUS server configurations are saved. Applications use the Timeout and Retry values when dealing with RADIUS connection issues during authentication sessions. The Timeout field controls the number of seconds the module 32 Avaya Integrated Management Database Configuration

33 Configuring a new installation pauses in its processing before it processes the information that the server has failed to respond. A user can make five attempts before the application stops further attempts. Configure RADIUS as the primary authentication option on the Change AAA Configuration page in Integrated Management Database for the proper functioning of RADIUS. Testing connectivity information for a RADIUS server Integrated Management 6.0 provides a Test RADIUS Servers button to test the connectivity of the RADIUS servers. This button tests the RADIUS server information from Integrated Management Database. To test the connectivity information configured for the RADIUS servers: 1. Click RADIUS Server on the navigation pane. The system displays the Change RADIUS Server Configuration page. 2. Enter values for the Primary RADIUS, the Secondary RADIUS Server, or both. 3. Click Save. The system displays the RADIUS Configuration page. 4. Click Test RADIUS Servers. The system displays the IMD RADIUS Server Test page with the results of the RADIUS server connectivity test. The system displays the Test RADIUS Servers button only after you save the settings. Authentication, Authorization and Accounting The Integrated Management Database process of Authentication, Authorization and Accounting (AAA) for users who try accessing the Integrated Management applications needs user accounts and assigned roles. The system administrator creates user accounts in the RADIUS authentication system. For authorization, a user needs to have a role assigned, using a Group ID, directly within Integrated Management Database or on an LDAP server. Methods used for authentication and authorization Integrated Management Database authenticates and authorizes users in two ways: through login group numbers or through matches for local Integrated Management Database permissions. June

34 Setting up Integrated Management Database Using login group numbers Integrated Management Database follows the steps in this section to authenticate and authorize users with the login group numbers. 1. A user with a user account and assigned role accesses Integrated Management Database, MultiSite Administration or Fault and Performance Manager. 2. The application queries RADIUS for the authentication of the user. The application uses a user name and a password for the authentication. 3. The application queries the LDAP server for the profile number and login group number of the user, if the configuration for the authorization mechanism is LDAP. Applications use the profile number to select a user profile within Integrated Management Database or MultiSite Administration. Integrated Management Database holds the Fault and Performance Manager profile.the user profile controls the access to be provided to the user: If no group number matches the value obtained from the LDAP server, then the application denies access to the user. Using matches for local Integrated Management Database permissions Integrated Management Database follows the steps in this section to authenticate and authorize users with matches for local Integrated Management Database permissions. 1. A user accesses Integrated Management Database, MultiSite Administration or Fault and Performance Manager. 2. The application queries RADIUS for the authentication of the user. The application uses a user name and a password for the authentication. 3. The application checks the local Integrated Management Database permissions for a match to the authenticated user name and uses that role for authorization, if LOCAL authorization is configured. If no user name matches the user name that the RADIUS server authenticated, then the application denies access to the user. The application logs all user access attempts through an external RADIUS server, irrespective of success and failure. Salient features: Integrated Management Database holds the IP address and credentials for access to the RADIUS server. For local authorization, Integrated Management Database holds the user profile definitions for itself and Fault and Performance Manager. MultiSite Administration holds the user profile information or permissions it needs. For LDAP authentication, the user is assigned a group number instead of a user ID. Integrated Management Database, Fault and Performance Manager and MultiSite Administration provide authorizations based on group number permissions. 34 Avaya Integrated Management Database Configuration