CajunRules Policy Manager for Windows NT Release Notes, Version 2.0

Transcription

1 CajunRules Policy Manager for Windows NT Release Notes, Version 2.0 Overview These Release Notes contain important information about the CajunRules for Windows NT, Version 2.0 Software. For installation information, refer to the CajunRules for Windows NT Policy Manager Getting Started Guide, Version 2.0. For information on using CajunRules, refer to the CajunRules Policy Manager User Guide, Version 2.0. Avaya maintains copies of these technical documents on the web server. To access online documentation in PDF format, use Netscape Navigator version 4.5 or higher or Microsoft Internet Explorer version 3.x or higher and enter the following URL: For more information about your LDAP directory servers, Cisco devices, or QIP, refer to that specific product s documentation. The following topics are covered in these Release Notes: Important Information on page 2 New Features on page 4 Known Problems and Workarounds on page 4 Functional Restrictions on page 7 Technical Support Contact Information on page 7 1

2 Important Information Pre-installation CajunRules Policy Manager CajunRules Policy Manager can be run on the Cajun P550/P880 Switch running version 4.0 or later and the Cajun P882 switch running version 5.0 or later. Contact Technical Support for more information. The CajunRules server must be running 24 hours per day so that it can enforce policies as scheduled. The Console does not have to be running all the time. If you are running a previous version of CajunRules, you must deinstall it before installing CajunRules version 2.0. You most likely also need to delete CajunRules objects and schema from the directory. CajunRules is supported only on Windows NT and Windows 2000, unless you are using Lucent s QIP. CajunRules does not support the QIP features on Windows LDAP Directory Server If your LDAP directory server is running on a Windows NT system, it must be installed on an NTFS partition. There may be a conflict with port 389 (the default port for the LDAP directory server) when installing Netscape as your LDAP directory server. Verify the port that Netscape is using. If port 389 is already in use, select another available port number. You need this information when installing CajunRules. If you are upgrading from CajunRules 1.0 and are using the NDS LDAP directory server, you must reinstall NDS before installing CajunRules. QIP CajunRules does not support QIP on Windows CajunRules supports QIP January 12,

3 Installation Miscellaneous Information If you want to install the CajunRules Policy Engine and Console on separate systems: 1. Install the CajunRules Policy Engine. 2. Start the CajunRules Policy Engine. 3. Install the CajunRules Console on the desired client host system. Make sure you enter the name or IP address of the host where the CajunRules Policy Engine is running. Only run the Console which connects remotely to the CajunRules Policy Engine. Do not start more than one CajunRules Policy Engine. If you have changed the default passwords, and then have to reinstall CajunRules, the default passwords no longer apply. The administrator-changed passwords are still in affect. If the newer passwords are not available, you must delete the entire LDAP directory. CajunRules is currently a non-secure java application. Refer to java.policy in the security directory of the install directory (default is C:\Avaya\CajunRules) for details. When logging in for the first time, log in as CRAdmin, password cajunrules. Note that the password is casesensitive. You are limited to one CajunRules Policy Engine. Only one administrative login is allowed write privileges at a time. If you leave the CajunRules Console logged in and start another copy of the Console on another system, the second login has read privileges only, regardless of his rights. When creating object names, the following characters should not be used:, /, \, +, =, <, >, ;, and, (comma). Do not use just a blank space when creating an activation name. Do not use the number 0 as the first character in a field. Do not use semicolons (;) in a field. Do not use a leading blank space in a field. You can manage up to 50 Cajun P550R switches. 3

4 All files are read-only. You must change the properties in order to edit them. When setting Activation periods with Start and Stop times, you must make sure the Stop time is at least 15 minutes later than the Start time. Initially, they are the same time. Cajun P550/P880/P882 devices running version 4.x support a maximum of 128 ACL entries. Cajun P550/P880 devices running version 5.0 support a maximum of 512 ACL entries. New Features CajunRules supports Cajun P880 and Cajun P330 devices. CajunRules supports Cisco 2500 and 7500 systems. You can open multiple Console windows. CajunRules supports policy validation. Known Problems and Workarounds Activation Periods Entering the maximum character limit for an activation period name may result in an LDAP constraint violation. NDS supports 64 characters. Do not use the maximum character string length. Cajun P550 Devices Cajun P550 devices do not support customized policy rules. If you do create customized policies for Cajun P550 devices, they are ignored or you may receive an error message stating This Device type contains interfaces and cannot be customized. However, the Abstract Policy is enforced. 4 January 12,

5 Cisco Devices CajunRules does not support policy on Cisco ATM interfaces. You cannot delete Cisco services. You can change existing services. It is possible to add the same Cisco router to the managed Devices list multiple times, by specifying a different IP Address for each instance. A Cisco router should be discovered and added to the set of managed Devices only once. Select an IP Address that CajunRules will use to contact and query the router. Once the router has been added, all interfaces on the router can be detected by CajunRules from that single IP address. Then, manage the interfaces individually by adding them to different domains, as desired. If the Service name is longer than 120 characters, it does not display on the Service pull-down menu. Keep Service name less than 120 characters in length. Console Console may crash if the network structure becomes too large. After adding and/or removing entities in the tree pane, duplicate entries may appear due to a repaint issue. Restart the Console to remove duplicate entries. Domains You may be unable to create/edit a domain in the Edit Table. The Apply key is disabled. You must edit the name. Refer to Chapter 6, Managing Domains in the CajunRules Policy Manager User Guide, Version

6 Policies Attempting to delete Network objects referenced from active policies results in an error. To avoid this, make sure all references to the element are deleted from all active policies before attempting to delete the object. You can check for references by selecting Show References. When a large policy (180+ ACLs) is deployed to a Cajun P550 or P880 device, it is possible that the CajunRules server status check times out before the device has completed the download and enabled the policy. The Console Detailed Status remains In Progress. However, the device has been successfully deployed. To confirm this, use the Device Manager to view the LDAP statistics and the IP Access List contents. If you double-click on the policy root node, and then add a policy from the tree, the Apply button in the Policy Editor becomes enabled. If you click Apply, nothing happens. Ignore the Apply key. If you create a custom version of a policy, but do not apply any changes to the custom rules, the custom policy is not saved, because, in effect, it is equivalent to the abstract policy. Edits to the policy that cause the policy view to refresh causes unmodified custom policies to disappear. Policy Engine You may receive either of the following messages: 'Fatal Error, Monitor thread existing' 'Policy engine going down' Restart your Policy Server, then restart CajunRules console. QIP Do not use Import and Add QIP User simultaneously. Allow one to complete before starting the other. 6 January 12,

7 Functional Restrictions Cisco Devices Cisco devices can support various combinations of queuing methods, depending on the device type and the IOS version. For Cisco device support, CajunRules does not restrict these combinations. Refer to you Cisco documentation for allowable combinations. Console Some items may not be available in the tree view pop-up menus. For example, if you have more than 16 services on a Cisco interface or more than 19 policies created, you cannot view all of them in the pop-up menu. In order to view them, you may have to change the resolution of your screen. Custom Policies When you create a new custom policy, you must make changes in the View pane and click Apply in order for the custom policy to be saved. Online Help You may receive an error message when referencing external links in the online help. Make sure you have a browser installed on your system. Technical Support Contact Information To contact Avaya s technical support: From the United States: Outside the United States: Contact your distributor. 7