HPE OneView Global Dashboard 1.40 User Guide

Transcription

1 HPE OneView Global Dashboard 1.40 User Guide Abstract This user guide is intended for administrators who are using the HPE OneView Global Dashboard graphical user interface to monitor IT hardware in a converged infrastructure environment. Part Number: Published: February 2018 Edition: 1

2 Copyright 2016, 2018 Hewlett Packard Enterprise Notices The information contained herein is subject to change without notice. The only warranties for Hewlett Packard Enterprise products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein. Confidential computer software. Valid license from Hewlett Packard Enterprise required for possession, use, or copying. Consistent with FAR and , Commercial Computer Software, Computer Software Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor's standard commercial license. Links to third-party websites take you outside the Hewlett Packard Enterprise website. Hewlett Packard Enterprise has no control over and is not responsible for information outside the Hewlett Packard Enterprise website. Acknowledgments Microsoft, Windows, and Windows Server are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. VMware and VMware vsphere are registered trademarks of VMware, Inc. in the United States and/or other jurisdictions. Linux is a registered trademark of Linus Torvalds in the U.S. and other countries. Red Hat is a registered trademark of Red Hat Software, Inc. in the United States and other countries.

3 Contents Getting started...5 About HPE OneView Global Dashboard...5 System requirements for Global Dashboard (Support Matrix)... 5 Appliance VM and host requirements... 5 Supported web browsers... 6 Network... 7 Scale... 8 Screen resolution... 8 Supported versions of HPE OneView... 8 Supported version of HPE SimpliVity...8 Installing Global Dashboard on a hypervisor host... 9 Downloading and validating the authenticity of the Global Dashboard appliance file...9 Installing Global Dashboard on a VMware vsphere hypervisor host...10 Downloading the OVA file...10 Deploying the OVA file Installing Global Dashboard on a Hyper-V host Downloading the Hyper-V zip file Deploying the Hyper-V zip file...12 Installing Global Dashboard on a Linux host with QEMU/KVM Downloading the qcow2 tar.gz file...13 Deploying the qcow2 tar.gz file First-time setup of Global Dashboard...15 Starting Global Dashboard and logging in First time configuring the network Navigating the Global Dashboard user interface...17 Icon legend Accessing Global Dashboard online help Security users and appliances...20 User roles...20 User authentication Links to appliances Managing users and directory groups...22 Adding a user...22 Editing a user Removing a user...23 Adding a group...23 Editing the role for a directory group...24 Removing a directory group...24 Contents 3

4 Monitoring the health of resources Dashboard page Search page...25 Resource pages...25 Appliance Alerts page Dashboard Tasks page Working with reports and settings Reports page Available Enclosure Bays report Converged Systems Available Capacity report...32 Converged Systems Utilization report...32 Firmware Compliance report...33 Remote Support Services Events report...33 Server Inventory report...34 Server Firmware Details report Server Profile Template Utilization report...36 SPP Bundles report...36 Storage Pool Utilization report Virtual ID Conflict report Settings page Appliances page...38 Dashboard Customization page...41 Network Settings page Appliance Certificate page Directories page Users and directory groups page Groups page Backup Settings page Configuration page...56 Actions...56 Troubleshooting Global Dashboard An appliance could not be added to Global Dashboard...61 Appliance status is offline in Global Dashboard...62 Reconnecting an appliance failed in Global Dashboard Single sign-on (SSO) from Global Dashboard to an appliance failed Additional Global Dashboard troubleshooting...64 Websites Support and other resources...66 Accessing Hewlett Packard Enterprise Support Accessing updates...66 Customer self repair...67 Remote support Warranty information...67 Regulatory information...68 Documentation feedback Contents

5 Getting started About HPE OneView Global Dashboard The HPE OneView Global Dashboard provides a unified view of health, alerting, and key resources managed by HPE OneView across multiple appliances and data center sites incorporating HPE BladeSystem c7000 enclosures and HPE ProLiant DL series rack mount servers, HPE Synergy, HPE Apollo 2000, 4000, and 6000, and HPE Hyper Converged 380 systems. As information about resources changes, those changes are updated in real time in Global Dashboard. A full refresh of all resources occurs approximately every 12 hours. (The HPE HC380 does not provide realtime updates. Data is polled automatically every 15 minutes.) Terms used in this document Appliance(s) Unless otherwise specified, this is a generic term referring to the remote appliance or appliances that can be monitored using Global Dashboard. These remote appliances can include HPE OneView appliances, HPE Synergy Composers, or HPE HC380 systems. HPE OneView appliance This is a generic term meaning either an HPE Synergy Composer or an HPE OneView virtual appliance. System requirements for Global Dashboard (Support Matrix) Appliance VM and host requirements HPE OneView Global Dashboard is a virtual appliance running on the following supported hypervisor hosts: Getting started 5

6 Table 1: Supported hypervisors and versions Hypervisor VMware vsphere ESXi Version update update update update update update update 1 Microsoft Hyper-V Hyper-V is supported on the following Microsoft Windows platforms with the Hyper-V role installed: Windows Server 2012 Windows Server 2012 R2 Windows Hyper-V Server 2012 Windows Hyper-V Server 2012 R2 Windows Server 2016 Microsoft Hyper-V Server 2016 QEMU/KVM on Linux Red Hat Enterprise Linux (RHEL) 7.2 RHEL 7.3 The appliance virtual machine (VM) must run on a VM host with ProLiant G7 class CPUs or later. The appliance VM requires the following: Two 2 GHz or greater virtual CPUs. 10 GB of memory dedicated to the appliance. 160 GB of thick-provisioned disk space. A connection to the management LAN. Hewlett Packard Enterprise recommends that you have separate networks for management and data. Supported web browsers 6 Supported web browsers

7 The following web browsers have been tested and qualified for use with Global Dashboard (recommended minimum versions): Microsoft Internet Explorer Version 11 Microsoft Edge Mozilla Firefox Version 45.x Mozilla Firefox ESR (Extended Support Release) Version 52.x Google Chrome Version 54.x NOTE: Microsoft Internet Explorer (IE) Version 11 cannot transfer files larger than 4 GB. When transferring large files, use Mozilla Firefox or Google Chrome browsers. IMPORTANT: Hewlett Packard Enterprise makes every effort to support new versions of and updates to supported web browsers. However, newer versions do not always work as expected. There might be issues with the web browsers that preclude support with the current release of Global Dashboard, or there might be a gap between the time when the web browsers are released and the time when browser support is available in Global Dashboard. In these cases, Hewlett Packard Enterprise will endeavor to support the newer browser version in the next maintenance release or full release of Global Dashboard. If you encounter a problem with a newer, untested version of a web browser, submit a report to your authorized support representative. In some cases, the short-term solution might be to revert to an earlier, supported web browser version. Network Minimum bandwidth: 1.5 Mbps Maximum network latency: 350 ms The following ports must be open to enable Global Dashboard to communicate with HPE OneView: HTTP port 80 HTTPS port 443 SCMB port 5671 Network 7

8 Scale Table 2: Appliance configuration maximums HPE OneView Appliance / HPE Synergy Composer 25 Maximum HPE HC380 systems 150 HPE SimpliVity OmniStack clusters 25 Concurrent users 5 Number of groups 3,000 NOTE: Adding a large number of resources in large number of groups can impact performance. Resources per group 20,000 Screen resolution Minimum resolution: 1024 x 768 Recommended resolution: 1280 x 1024 or greater. Supported versions of HPE OneView Any HPE OneView appliance prior to version 2.00 cannot be used or added with Global Dashboard If you are managing any HPE OneView appliances prior to version 2.00, you will need to update those appliances to a new version of HPE OneView before updating to Global Dashboard 1.40, or remove them from Global Dashboard prior to updating to Global Dashboard Future versions of HPE OneView Hewlett Packard Enterprise makes every effort for Global Dashboard to work with future versions of HPE OneView, however, unforeseen issues can occur. For this reason, future versions of HPE OneView (released after this Global Dashboard release) might require an updated version of Global Dashboard for Global Dashboard to work correctly. Supported version of HPE SimpliVity Global Dashboard requires HPE SimpliVity version (released April 2017) or later. 8 Scale

9 Installing Global Dashboard on a hypervisor host Global Dashboard is delivered in the following formats: Hypervisor host VMware vsphere hypervisor Format Packaged as an Open Virtual Appliance (OVA) file containing an Open Virtual Format (OVF) package. You can deploy the OVA using one of the following: The VMware vsphere Client (a Microsoft Windows application) or the vsphere Web Client installed on the host system The Command Line Interface (CLI) REST APIs This guide explains how to deploy the OVA using the VMware vsphere Client (a Microsoft Windows application) or the vsphere Web Client installed on the host system. To deploy the OVA file using this guide, you need: 1. The VMware vsphere Client (a Microsoft Windows application) or the vsphere Web Client installed on the host system. 2. Access to a VMware vcenter server to install Global Dashboard. Microsoft Hyper-V hypervisor Linux QEMU/KVM Packaged as an image zip file. To install Global Dashboard with this.zip file, the Hyper-V role must be installed on the Windows Server. Packaged as a tar.gz file. Downloading and validating the authenticity of the Global Dashboard appliance file You can download the HPE OneView Global Dashboard appliance file from the HPE Software Depot. The download is secure because your browser uses an HTTPS connection with trusted security certificates. Additionally, you can use the freely available GNU Privacy Guard (GPG) tools to validate the authenticity and integrity of the file. Use the following commands: gpg --verify <filename>.ova.sig <filename>.ova gpg --verify <filename>.zip.sig <filename>.zip Installing Global Dashboard on a hypervisor host 9

10 NOTE: This digital signature verification step is not required for upgrade installations. The upgrade file (the *.bin file) is already digitally signed, and the digital signature is automatically validated during the upgrade procedure. See the following web page for detailed verification instructions: codeverify Installing Global Dashboard on a VMware vsphere hypervisor host Downloading the OVA file The OVA file size is approximately 2.3 GB. Download time varies depending on your network connection. Hewlett Packard Enterprise recommends using a download manager that supports resuming downloads, such as the one provided by the HPE Software Depot. Procedure 1. Open a web browser. 2. Go to the HPE Software Depot and select Converged Infrastructure Management Software > OneView Management Software > HPE OneView Global Dashboard. If you have an account with HPE Software Depot, you must log in before downloading files. If are not registered, you will be prompted to do so. 3. Download the OVA file to a local directory. The local directory must be located on the system running the vsphere client or must be accessible through a web address. NOTE: The OVA file is digitally signed. You have the option to validate the authenticity and integrity of the download by following the instructions at Deploying the OVA file Procedure 1. Start the vsphere client and log into vcenter. If you are deploying on ESXi 6.5 hosts, make sure to log in to the new version of the vsphere web client. 2. From the menu, select File > Deploy OVF Template to launch the Deploy OVF Template wizard. a. On the Source screen, specify one of the following: The path to the OVA file Web address (URL) of the OVA file, if you made it accessible via a web server b. Verify the information on the OVF Template Details screen. c. On the Name and Location screen, enter a name and location for the deployed template that is unique within the inventory folder, and then select the inventory location. d. On the Host / Cluster screen, select the host or cluster on which to run the deployed template. 10 Installing Global Dashboard on a VMware vsphere hypervisor host

11 e. On the Storage screen, select a storage destination for the VM files. f. On the Disk Format screen, select the format for storing the virtual disks. IMPORTANT: Thick Provisioning is highly recommended. If you select Thin Provisioning, the appliance VM is suspended if the VM host runs out of disk space. If this occurs during actions such as upgrading firmware, applying a profile, or performing a backup of appliance updates, it can result in failures that are difficult to diagnose and might require a service call to resolve. Hewlett Packard Enterprise also recommends that you select Eager Zeroed. g. On the Network Mapping screen, select a network that has connectivity to your management LAN. h. On the Ready to Complete screen, verify your selections. Use the Back button to make changes, if necessary. Click Finish to complete the template and start deployment. When the deployment is complete, the VM is available for use. NOTE: If you are planning on using the hypervisor host to set the time, you should configure the host with NTP. 3. On the Summary tab, click Power on. Click the Console tab to watch the appliance start. It takes approximately 10 minutes, depending on your hardware, from the time the appliance is powered on until it is ready to accept browser connections. During this time, the vsphere virtual console displays the message Please wait while the appliance starts. Installing Global Dashboard on a Hyper-V host Downloading the Hyper-V zip file If you do not have the Hyper-V zip file on physical media, download the zip file from the Software Depot. The zip file is approximately 2.2 GB. Download time varies depending on your network connection. Hewlett Packard Enterprise recommends using a download manager that supports resuming downloads, such as the one provided by the Software Depot. Procedure 1. Open a browser on a system running the hypervisor client. 2. Go to the HPE Software Depot and select Converged Infrastructure Management Software > OneView Management Software > HPE OneView Global Dashboard. If you have an account with HPE Software Depot, you must log in before downloading files. If are not registered, you will be prompted to do so. 3. Download the zip file to a local directory. NOTE: The zip file is digitally signed. You have the option to validate the authenticity and integrity by following the instructions at Installing Global Dashboard on a Hyper-V host 11

12 Deploying the Hyper-V zip file Procedure 1. Extract the Hyper-V image zip file to a location accessible from the Hyper-V host. 2. Open the Hyper-V Manager. Right-click on the Hyper-V host and select Import Virtual Machines. 3. In the Import Virtual Machine wizard, browse to where you unpacked the Hyper-V image zip file and click through until you see the directories called Snapshots, Virtual Hard Disks and Virtual Machines. Select the parent directory of those three directories. 4. Continue through the steps in the wizard to import the appliance virtual machine. IMPORTANT: Be sure to select Copy the virtual machine (create a new unique ID) option. 5. Verify that the VM is configured to meet the host requirements, set up thick provisioning, and set up network adapters on your VM host. To edit settings on the VM, right-click on the appliance VM and select Settings. For appliance VM and host requirements: See Appliance VM and host requirements on page 5. Thick provisioning: Use a fixed size disk in Hyper-V after the VM is imported. Select Settings and select the virtual hard disk. Edit the current disk, select Convert, and then select Fixed size. Change the size of the VM hard disk to the new fixed size disk you just created. IMPORTANT: Thick Provisioning is highly recommended. If you select Thin Provisioning, the appliance VM is suspended if the VM host runs out of disk space. If this occurs during actions such as upgrading firmware, applying a profile, or performing a backup of appliance updates, it can result in failures that are difficult to diagnose and might require a service call to resolve. For network adapters: Use the hypervisor UI to set the VM network adapters. The appliance supports one NIC on the management LAN. You will normally connect the network adapter to one or more virtual switches, depending on your networking configuration. IMPORTANT: Be sure to uncheck the VLAN ID box if you are not using VLANs and VLAN identifiers. 6. Before powering on your virtual appliance, verify the date and time are set properly on your VM host system. Maintain an accurate time on the VM host system, using tools such as NTP, because the VM guest will synchronize with that time. If your VM host does not have the time set properly, the following message displays when you boot the appliance: The time and date on your hypervisor appears to be incorrect. Please power off your appliance, correct the time and date on your hypervisor, and power on your appliance. If you encounter this problem, follow the instructions in the message. 12 Deploying the Hyper-V zip file

13 7. Power on the virtual machine for the first time. In the Hyper-V Manager, right-click on the appliance VM and power it on. It takes approximately 10 minutes, depending on your hardware, from the time the appliance is powered on until it is ready to accept browser connections. 8. On the console you will see the appliance license and support screens. You are now ready to log into your appliance for the first time. Installing Global Dashboard on a Linux host with QEMU/KVM Downloading the qcow2 tar.gz file The tar.gz file is approximately 2.3 GB. Download time varies depending on your network connection. Hewlett Packard Enterprise recommends using a download manager that supports resuming downloads, such as the one provided by the HPE Software Depot. Procedure 1. Open a web browser. 2. Go to the HPE Software Depot and select Converged Infrastructure Management Software > OneView Management Software > HPE OneView Global Dashboard. If you have an account with HPE Software Depot, you must log in before downloading files. If you are not registered, you will be prompted to do so. 3. Download the tar.gz file to a local directory. NOTE: The tar.gz file is digitally signed. You have the option to validate the authenticity and integrity of the download by following the instructions at Deploying the qcow2 tar.gz file Procedure 1. Extract the qcow2 image tar.gz file to a location accessible from the Linux host. 2. Open Virtual Machine Manager, or any other virtual machine management tool. 3. From the menu of Virtual Machine Manager, select File > New Virtual Machine to launch the New VM wizard. In the wizard, complete the following steps: a. Select the Import existing disk image option for installing the operating system. b. Browse to the location of the qcow2 file. Select Linux for the OS type, and CentOS 6.7 for the Version. If CentOS 6.7 is not in the Version list, select Generic for both the OS type and Version. c. Set Memory (RAM) to MiB, and CPUs to 2. Installing Global Dashboard on a Linux host with QEMU/KVM 13

14 d. Specify the name of the VM. Expand the Network selection, and select a network device that has connectivity to your management LAN. e. Select Bridge as the Source mode. f. Click Finish. The appliance will now start from the virtual machine console. 14 Installing Global Dashboard on a hypervisor host

15 First-time setup of Global Dashboard Procedure 1. Start Global Dashboard. 2. Configure network settings. Starting Global Dashboard and logging in Prerequisites Global Dashboard must be installed on a hypervisor host. Procedure 1. Access the host on which HPE OneView Global Dashboard was deployed using one of the following methods: VMware console: Use the browser in the VMware console to connect to the VM. Web browser: If the VM is on a network that has DHCP, use a web browser on your local machine to connect to the VM by typing the DHCP IP address in the address bar. For a list of supported browsers, see Supported web browsers on page 6. The first time HPE OneView Global Dashboard is started, it can take up to 10 minutes for the system to become available to configure. The following message appears on the screen until Global Dashboard is ready to configure. 2. On the HPE OneView Global Dashboard EULA page, review the end user agreement and click Agree to continue. If you click Disagree, the installation process is cancelled. 3. You must log in as an administrator on the local domain to configure Global Dashboard for the first time. After first-time setup, you can add additional local users, as well as users from an authentication directory service. Use the following default credentials to log in for the first time: Username: Administrator Password: admin Login Domains: LOCAL 4. When prompted, set a new administrator password of at least 8 characters to replace the default password. The password should not contain a space or any of the following characters: < > ;, " ' & \ / + : = 5. Suggested actions: Add an appliance and configure active directory. First-time setup of Global Dashboard 15

16 First time configuring the network Procedure 1. Under General, specify a Host Name for Global Dashboard. 2. Under IPv4, select either DHCP or Static. a. If you select DHCP: Under DNS, select either From DHCP or Manually. If you select Manually, you can optionally specify the IP addresses of the Preferred DNS server and the Alternate DNS server. b. If you select Static: Specify the IPv4 address, IPv4 Subnet, and IPv4 Gateway address Under DNS, specify the Preferred DNS server and the Alternate DNS server. 3. Click OK. 16 First time configuring the network

17 Navigating the Global Dashboard user interface 1 Left navigation menu: Click the icon to close the menu. Click the icon to re-open the menu. 2 Resource name: Click to go to the resource page in Global Dashboard. 3 Ring chart: When a resource category contains more than one status condition, the conditions are represented by different colors: Green = OK, Grey = Unknown, Yellow = Warning, Red = Critical Click the status color on the ring to go to a filtered view of the resource page showing resources with the selected status condition. For more information, see Dashboard page. 4 Resource summary: Lists all status conditions for resources in the category. Click a status condition to go to a filtered view of the Global Dashboard resource page that shows only the resources with the selected status condition. 5 Global filter: Use the global filter to restrict Global Dashboard to show only the resources in a specific group or subgroup. For more information about groups, see Groups page. Table Continued Navigating the Global Dashboard user interface 17

18 6 User identification: Indicates the login name and role of the current user. 7 Session menu: Click the user icon to open the session menu, which provides options to access online help and logout. Icon legend The following icons appear on pages throughout Global Dashboard: Table 3: Icon legend Screen element Function Click to search. or Click to select filters to display on the page. The total number of resources appears at the top of the icon. When a filter is selected, the icon turns green and displays the number of filtered resources at the bottom of the icon. Click to export report data in CSV format. Click to open the online help. Click to open the actions menu for group-related operations. Click to edit settings. Click to add information to the current page. Click to close menu or window. or or or or Resource status is critical. Resource status is a warning. Resource status is disabled. Resource status is ok. or Resource status is unknown. The icon also appears on the details page under Converged Systems for HPE HC380 systems and HPE SimpliVity, since the HPE HC380 and HPE SimpliVity do not provide real-time updates. This icon appears briefly when a process is running, such as when you log in to Global Dashboard, or when Global Dashboard is connecting to a directory or synchronizing information from a selected appliance or resource. When the process is complete, this icon is replaced by a status icon. Table Continued 18 Icon legend

19 Screen element Function Designates user role for the current session. Click to log out, view user information, or to access online help. Click to collect and download all appliance logs in one.tar.gz file (under Settings page > Actions). Click to save a backup of all Global Dashboard settings. Click to restore Global Dashboard settings from a backup. Click to test the connection between Global Dashboard and an appliance or resource. Click to update Global Dashboard. Restart the appliance. Click the Set log level icon to choose levels for logging into the appliance. Choose between normal and verbose. Click the HPE support access icon to turn on or off authorized services access. Click the global filter icon to restrict Global Dashboard to display information about the resources in a specific group or subgroup. Click to open all icons related to the Global Dashboard page. Click to customize a report (Reports page). Click to a report (Reports page). Click to save a custom report (Reports page). Click to open the directory group browser (Settings page, Users and Directory Groups). Accessing Global Dashboard online help To view Global Dashboard online help, click the Session icon In the Help sidebar, links appear to the following information:, and then click Help. Help on this page: Opens the help topic for the current page in a new browser tab. Browse help: Opens the online help in a new tab. End-User License agreement: Opens the End User License agreement (EULA). HPE OneView Forum: Opens the online forum for HPE OneView in a new tab. Accessing Global Dashboard online help 19

20 Security users and appliances Security for the HPE OneView Global Dashboard is managed through user roles, login options, and appliance link behavior. User roles Global Dashboard supports three user roles: Infrastructure Administrator, Operator, and Kiosk. The following tasks are supported by each user role: Infrastructure Administrator X X X X Operator Kiosk Task Perform first-time setup. Configure and modify network settings. Add, modify, and remove appliances, users, groups, and directory servers. Reconnect appliances. X X X Customize dashboard view. X X X Select or view resource information based on a group. X 24/7 viewing of the dashboard X X View resource information across appliances. X X Access appliances via links. (Requires existing access rights to the appliance.) X X X Change own password. X X Single sign-on (SSO) for HPE OneView. X X View, download and reports. X X X Set log level. Set HPE support access. Update software. X X Ping. X X X Create a support dump. (Operator can only download encrypted logs.) Restart Global Dashboard. Table Continued 20 Security users and appliances

21 Infrastructure Administrator X Operator Kiosk Task Factory Reset Global Dashboard. X X View current certificate. X X X X X Create certificate request. Import certificate. Backup and restore configuration settings (including scheduled backup). Create, modify and delete custom reports. Configure settings for s sent from Global Dashboard, such as reports. User authentication Global Dashboard provides two ways to authenticate users: local and directory server. Local users: These accounts are stored on Global Dashboard and are managed on the Settings > Users and Directory Groups page. Directory service: These accounts are stored on a directory service on the network. Logins to Global Dashboard are validated by querying the directory service. Support for the directory service must be configured by an Infrastructure Administrator on the Settings > Directories page, and then can be managed on the Settings > Users and Directory Groups page. Links to appliances Both administrators and operators can use links throughout Global Dashboard to access the selected appliance or resource. If a user has existing rights on the remote appliance, clicking a resource link activates single sign-on (SSO) to the remote appliance without any user input. If a user does not have rights on the remote appliance, clicking a resource link opens the login page on the remote appliance where the user can log in with appropriate credentials. User authentication 21

22 Managing users and directory groups Use the Users and Directory Groups page to manage local user accounts and directory groups on Global Dashboard. Adding a user Perform this task from the Settings > Users and Directory Groups page. Prerequisites Only Global Dashboard users who have the Infrastructure Administrator role can add users. Procedure 1. On the Users and Directory Groups page, click the add icon. 2. Select the type Local Users. 3. Enter a login name, full name (optional), and initial password. To enable single sign-on (SSO) for this user, enter the same login name and password that is used to log in to the remote HPE OneView instance. 4. Enter the password again to confirm the password. 5. Select a role: Infrastructure administrator or Operator. 6. Click OK. Editing a user Perform this task from the Settings > Users and Directory Groups page. Prerequisites If you are logged in as an Operator (local user), you can only edit your credentials. If you are logged in as the default Infrastructure Administrator, you can edit credentials for all other users. If you are logged in as a non-default Infrastructure Administrator, you can edit credentials for all other users, except for the default administrator. Procedure 1. On the Users and Directory Groups page, click the login name. 2. On the details page that appears on the right, click Edit. 3. Enter the full name (optional). 4. If you are changing your password: 22 Managing users and directory groups

23 a. Enter your current password in the Current Password field. b. Enter a new password in the New Password field. c. Type the new password again in the Confirm Password field. 5. If you are changing the password for another user: a. Enter the new password in the Initial Password field. b. Enter the new password again in the Confirm Password field. 6. Select the role: Infrastructure administrator or Operator. 7. Click OK. Removing a user Perform this task from the Settings > Users and Directory Groups page. Prerequisites Only Global Dashboard users who have the Infrastructure Administrator role can remove users. You cannot remove yourself as a user or remove the default administrator. Procedure 1. On the Users and Directory Groups page, click the login name you want to remove. 2. On the details page that appears on the right, click Remove. 3. Click Remove to verify the removal. When you remove users, their sessions stay active until the users log out. Adding a group Perform this task from the Settings > Groups page. Prerequisites Only Global Dashboard users who have the Infrastructure Administrator role can add a group. Procedure 1. On the Groups page, click the add icon. 2. Add a name. Group names cannot be duplicated. 3. Optional: Add a parent group. 4. Click Create. Removing a user 23

24 Editing the role for a directory group Perform this task from the Settings > Users and Directory Groups page. Prerequisites Only Global Dashboard users who have the Infrastructure Administrator role can change the role for a directory group. Procedure 1. On the Users and Directory Groups page, click the group name (for the group you want to change). 2. On the details page that appears on the right, click Edit. 3. Select the role: Infrastructure administrator or Operator. 4. Click OK. Removing a directory group Perform this task from the Settings > Users and Directory Groups page. Prerequisites Only Global Dashboard users who have the Infrastructure Administrator role can remove a directory group. Procedure 1. On the Users and Directory Groups page, click the group name (for the group you want to remove). 2. On the details page that appears on the right, click Remove. 3. Click Remove to verify the removal. When you remove a directory group, the sessions for users in the directory group stay active until logged out. 24 Editing the role for a directory group

25 Monitoring the health of resources Dashboard page Use the charts on the Dashboard page to obtain a visual overview of the general health and status of the appliances and managed resources across all data centers. The resource information is updated in real time to reflect resource changes on the appliance, letting you immediately see resources that need your attention. A full refresh of all resources occurs every 12 hours. (The HPE HC380 and HPE SimpliVity do not provide real-time updates. Data is polled automatically every 15 minutes.) Each resource is represented by a ring chart showing the status of the resource, as well as the number of resources that share the same status. The following colors indicate status conditions: Color Green Yellow Red Gray Indication A healthy status (for the HPE HC380 and HPE SimpliVity, indicates connectivity to the appliance only) An event has occurred that might require your attention A critical condition that requires your immediate attention A disabled or unknown status Clicking a resource name takes you to the resource page filtered to show all status conditions. Clicking the resource count, any of the ring charts, or the status labels below the chart takes you to the resource page filtered for the selected status. Search page Use this page to find the specific resource that you want to view. Click Search or the search icon. Any information shown on the detailed resource pages are valid search terms. See the main page for each resource for the types of information available. Resource pages Resource pages provide detailed information about the resources in a particular category, and enable you to assign resources to groups. Resource pages are provided for: Enclosures Server Hardware Server Profiles Server Profile Templates Storage Systems Monitoring the health of resources 25

26 Storage Pools Volumes Converged Systems SAN Managers SANs To open a resource page, select it in the main navigation menu, or on the Dashboard page. Resource page features All resource pages have the following common features: Resource table: Each resource page presents a list of resources in a table. All managed resources appear in the table by default. Resource details pane: When you select a resource in the table, detailed information is presented about the resource in a new pane on the right side of the screen. A link is also provided to open the resource management page for the selected resource on the appliance. Search: To see a list of specific resources, click Search or the search icon and specify a search term. Actions pane: Click the icon to open the Actions pane which enables you to add resources to a group or remove resources from a group. Filter: To see a subset of resources based on status condition, click the filter icon and select one or more status conditions from the list that opens: When filter status is All, the filter is disabled and the total number of available resources is shown above the filter icon. When the filter is active, the icon turns green and displays the number of filtered resources below the icon. For example, the following icon indicates that 28 resources out of a total of 356 match the currently selected status conditions: 26 Monitoring the health of resources

27 Appliance Alerts page Use the Appliance Alerts page to monitor and report on active critical alerts across your data centers. NOTE: Global Dashboard only shows active critical alerts. Once an alert is cleared in the managed appliance, it does not show up in Global Dashboard. The table at the bottom of the page shows the following information for critical alerts: Status Resource Name Resource Type Alert Occurred Appliance Model State Description Corrective Action The table can be sorted by each column by clicking on the column header. The arrow indicates the current primary sort column. Click Search or the search icon and enter search terms to view a list of specific alerts. Click the CSV icon to save report information in CSV format. Dashboard Tasks page Use the Dashboard Tasks page to monitor the status of Global Dashboard tasks, and to refer to the history of tasks. Global Dashboard tasks included on this page are: Add, remove, reconnect and rename appliances Add, update, or remove users Create, update, and delete groups Add, update, or remove an LDAP directory Add, remove certificate Backup Configure network settings Configure remote backup Create certificate signing request Create support dump Appliance Alerts page 27

28 Restart Restore Set HPE support access Upload certificate revocation list (CRL) The following information is provided for each task: Status icon Task description Status description: Completed, In Progress, Error, Warning, or Unknown Date Click Search or the search icon and enter search terms to locate a specific task. Click the filter icon to filter the report by Status. 28 Monitoring the health of resources

29 Working with reports and settings Reports page Use the reports to view aggregated information about appliances and resources across your data centers. Several default reports are defined. You can create customized versions of these reports to display the information that best meets your needs. To generate a report, click the report name on the Reports page. The resulting report page will list both default (factory-delivered) and any customized reports. Most reports have the following features: Report search Click the search icon and enter a search term on which to filter the report data. In the following example, only resource names and appliances containing bl are displayed in the table. If you use multiple search terms, each search term narrows the focus of the search. Working with reports and settings 29

30 Report filters For some reports, it is possible to filter the report table (or list of results) by selecting the colored bars in the graphs above the table. If a meter highlights when you hover over it, it can be selected to filter. Filters are cumulative. You can apply a filter from one or more graphs at the same time. In the following example, the green bar was selected, and as a result, the table only shows resources that are Compliant. When a bar is selected, the bar becomes oversized. To remove all filters, click Reset at the top of the report table. To remove a specific filter, click Reset for that filter. 30 Working with reports and settings

31 Report sorting For reports that present information in a table, click a column title to sort the column. An up or down arrow appears indicating either a descending or ascending sort for the selected column. Example: This report is sorted in descending order on the Appliances column. You can also sort by multiple columns. The most recent column selected will be the primary sort key. Customize a report Click Manage Report Content to edit what columns the report shows. Select the check boxes of the columns you wish to see on the report. To keep your changes, save your custom report. a report Click the icon to send the report to other users or team members. Any current search, sort, filter, and customization settings applied to the report will be included in the results sent in the . To send reports via , an Infrastructure Administrator must configure sending s from Global Dashboard first. See Configuring settings. Working with reports and settings 31

32 Download a report Click the CSV icon customization settings. to download the report in CSV format with its current search, sort, filter, and Save a custom report Click the save report icon to save a copy of the report with its current search, sort, filter, and customization settings. Your saved report is accessible via the Reports page. Available Enclosure Bays report Use the Available Enclosure Bays report to see the available bays in enclosures for HPE OneView appliances, and to view more details about each enclosure and available bays. This report is helpful when determining where to add new blades. To filter the report for an enclosure type, click on a bar chart (top of the report). To access more detailed information about an enclosure within HPE OneView, click the link in the Enclosure Name column. The following information is provided for each enclosure in the report: Appliance Name Enclosure Name Enclosure Type Available Bay Count Converged Systems Available Capacity report Use the Converged Systems Available Capacity report to view the available CPU, memory and storage for converged systems. The following information is displayed: Summary: An availability overview for all converged systems, including the available CPU, Memory, and Storage. A table containing the details for each system, including the following: Name of system Model Version Available CPU Available Memory Available Storage Converged Systems Utilization report Use the Converged Systems Utilization report to view the usage of CPU, memory and storage within converged systems. The following information is displayed: 32 Available Enclosure Bays report

33 Summary: A usage overview for all converged systems, including the usage of CPU, Memory, and Storage. A table containing the details for each system, including the following: Name of system Model Version Used CPU/Total CPU Used Memory/Total Memory Used Storage/Total Storage Firmware Compliance report Use the Firmware Compliance report to see a list of the resources across your data centers that have compliant and noncompliant profiles based on the selected SPP baseline. To select the SPP bundle: Click the Search icon from the drop-down menu, and then click OK. The following information is displayed:, select the baseline SPP bundle you want to view Compliance graph: Shows the number of servers in each category: Compliant, Noncompliant, and Unknown. Click a bar in the Compliance Summary to filter the list of resources. A table showing detailed information for each server. The table title indicates how many servers are shown out of the total number of servers. By default, all servers are shown. If you specify a search or enable a filter, then the table will only display servers matching the selected criteria and the title will indicate how many matches were found. For example, if 11 servers were found out of a total of 250, then the title would be Resource Compliance - 11 of 250. The following information is shown for each server: Resource Name: Click the name to open the server profile page on the HPE OneView appliance. Resource Type State Installed SPP Appliance Remote Support Services Events report Use the Remote Support Services Events report to view the details of remote support events that have occurred. Click a bar in the Support State summary to filter the list of events. The following information is provided for each service event: Case ID State Firmware Compliance report 33

34 Resource Name Resource Type Opened (date the case was opened) Cleared (date the case was closed) Appliance Name Event Description Click a column title to sort the report based on that column. Server Inventory report Use the Server Inventory report to display a detailed list of the managed servers across your data centers that are monitored by Global Dashboard. Click one or more of the colored bars to filter the report. The filters are cumulative, so the results will include those servers that match all of the criteria you select. The following information is displayed: Server Status: Shows the number of servers in each status category: Critical, Warning, OK, and Disabled. Server Models: Shows the number of servers for each model type. ROM Versions: Shows the number of servers for each ROM version. ilo Versions: Shows the number of servers for each HPE ilo version. Processor Type: Shows the number of servers for each processor type. Installed Memory: Shows the number of servers for each amount of installed memory. Server Hardware: A table showing detailed information for each server. The table title indicates how many servers are shown in the table out of the total number of servers. By default, all servers are shown. If you specify a search, then the table will only display servers matching the search criteria and the title will indicate how many matches were found. For example, if 11 servers were found out of a total of 250, then the title would be Server Hardware - 11 of 250. The following information is shown for each server: Status (by color and shape) Server: IP address or another identifier for the appliance. Click the link to open the HPE OneView appliance to the server's hardware page. Server Name Model Processor Proc. Count Memory Serial Number Part Number ilo 34 Server Inventory report

35 ilo FW Firmware Appliance Name Server Firmware Details report Use the Server Firmware Details report to view the details of firmware within all instances of HPE OneView. NOTE: Firmware data is not updated in real time. A full refresh of all resources occurs approximately every 12 hours. The following information is provided in the report: Firmware components Name Versions Instances Click a column title to sort the report based on that column. Clicking on versions shows a report on firmware components and versions. Server Firmware Instances By Version The following information is provided in the report: Name Version Instances Clicking on instances of firmware from the Server Firmware Instances By Version page, shows a report on firmware details. Server Firmware Details for specific server The following information is provided in the report: Server Server Name Location Server Model Appliance Name Server Firmware Details report 35

36 Server Profile Template Utilization report Use the Server Profile Template (SPT) Utilization report to see the total number of available SPTs for all HPE OneView appliances, and sub-reports with more information about the SPTs. Many values in the table are links. Click a link to open a sub-report with more detailed information. The following information is provided for each appliance: Appliances: Name of the appliance. Available SPTs: All available Server Profile Templates with associated Server Profile compliance. Compliant SPs: SPs compliant with their corresponding SPTs. Noncompliant SPs: SPs not compliant with their SPTs. Unassociated SPs: SPs unassociated with any SPT. Compliance: Shows compliance information for all appliances in graphical form as follows : Grey: The number of unassociated SPs. Green: The number of compliant SPs. Yellow: The number of noncompliant SPs. Click a colored segment to view more information. SPP Bundles report Use the SPP Bundles report to view a list of available Service Packs for ProLiant (SPPs). This report displays all SPP bundles available across all appliances. Select one or more SPP bundles for which you want to view information and then click OK. Appliances that contain the selected SPP(s) are shown, as well as a list of appliances missing from the selected SPP(s). Storage Pool Utilization report Use the Storage Pool Utilization report to view the status of storage pools and their utilization. This report can help you optimize use of your storage pools and determine where you have storage availability. Click a bar in the Status summary to filter the list. The following information is provided for each storage pool: Status (by color and shape) Storage Pool name % Utilization Allocated Space Available Space Total Space Storage System name Device Type 36 Server Profile Template Utilization report

37 Click a column title to sort the report based on that column. Virtual ID Conflict report Use the Virtual ID Conflict report page to view any virtual ID conflicts that are present across your data centers. If virtual ID conflicts exist, the following information is displayed: VSN Conflicts VMAC Conflicts VWWN Conflicts IPV4 Conflicts The name of the conflicting appliance appears in the Conflicted Appliances column for each conflict type along with one of the following icons: : Designates a conflict in overlapping ID ranges between the entire first range and the beginning of the second range. : Designates a conflict in overlapping ID ranges between the beginning of the first range and the entire second range. : Designates a conflict in overlapping ID ranges between the entire first range and the middle of the second range. : Designates a conflict in overlapping ID ranges between the middle of the first range and the entire second range. : Designates a conflict in overlapping ID ranges between the first range and the second range. : Designates a conflict in overlapping ID ranges between the entire first range and the end of the second range. : Designates a conflict in overlapping ID ranges between the end of the first range and the entire second range. : Designates a conflict in overlapping ID ranges between the end of the first range and the beginning of the second range. : Designates a conflict in overlapping ID ranges between the beginning of the first range and the end of the second range. Clicking the appliance name in either column opens Global Dashboard Appliances page with the details pane open for the selected appliance. Settings page Click the software version link at the bottom of this page to see the following information about Global Dashboard: Product Version Release date Copyright Virtual ID Conflict report 37

38 Appliances page Use the Appliances page to view information for all the appliances added to Global Dashboard. Infrastructure administrators can also add and remove appliances, edit the appliance name, and reconnect to an appliance on which the password has been changed. Appliances table: Presents a list of appliances. All managed appliances appear in the table by default. Appliances details pane: When you select an appliance in the table, the following information is presented about the appliance in a new pane on the right side of the screen: Top banner: Indicates the status of the appliance. Open in OneView, Open in HC380, or Open in HPE SimpliVity: Click to go to the resource management page for the selected appliance. Group Info: Name of the Global Dashboard group to which the appliance belongs. If the appliance is not in a user defined group, this will be empty. Name: Click the edit icon to change the appliance name. Hostname Credentials Username Model Version Converged System Name (for HPE HC380 systems and HPE SimpliVity only) Resources Lists the number of each type of resource. Click a resource to see more detailed information. This field does not appear for HPE HC380 systems and HPE SimpliVity. Reconnect button: Reconnects Global Dashboard to an appliance and performs a complete refresh of resources. It also enables you to provide new credentials for the appliance connection. Remove button: Removes the appliance and all associated resources from Global Dashboard. Search: To see a list of specific appliances, click Search or the search icon and specify a search term. Add: Click the icon to open the Add appliance pane which enables you to add a new appliance to Global Dashboard. Actions pane: Click the icon to open the Actions pane which enables you to add appliances to a group or remove appliances from a group. Filter: To see a subset of appliances based on status condition, click the filter icon or more status conditions from the list that opens: and select one 38 Appliances page

39 When filter status is All, the filter is disabled and the total number of available appliances is shown above the filter icon. When the filter is active, the icon turns green and displays the number of filtered appliances below the icon. For example, the following icon indicates that 28 resources out of a total of 356 match the currently selected status conditions: The following conditions can cause an appliance to display an Offline state: Global Dashboard has lost its connection with the appliance. Losing connection with the appliance can be caused by the following: The appliance has been powered off. A network connection error has occurred between the appliance and Global Dashboard. The IP address of the appliance has been changed. The appliance's server certificate is no longer trusted by Global Dashboard. The password on the appliance has been changed. The appliance state returns to Online when Global Dashboard is reconnected to the appliance. The appliance is restarting. The appliance state changes to Offline and then back to Online when an appliance is restarting. Adding an appliance Perform this task from the Settings > Appliances page. Prerequisites Only Global Dashboard users who have the Infrastructure Administrator role can add appliances to Global Dashboard. If an appliance certificate is issued by a certificate authority (CA), the full chain of CA certificates need to be added to the Global Dashboard trust store before adding an appliance. Adding an appliance 39

40 Procedure 1. On the Appliances page, click the Add icon. 2. Specify the following: Hostname or IP address: Specify the IP address of the remote appliance. When adding an HPE HC380 or HPE SimpliVity, specify the address of the management UI and not the HPE OneView instance on the HPE HC380 or any one of the virtual controller nodes in the cluster for HPE SimpliVity. Username: Specify a valid username on the remote appliance. When adding an HPE OneView appliance, real-time updates and single sign-on (SSO) do not work if a user with role of Backup Administrator is specified. When adding an HPE HC380 using Directory authentication, you must use an Infrastructure Administrator or Read Only account. You cannot use a Virtualization Administrator or Virtualization User account. Password: Specify the password associated with the username. Login domain. For users that are defined in Global Dashboard, the login domain is LOCAL. The domain can be a directory name configured in Global Dashboard when the authenticate is against a directory server. Name: (Optional) Enter a name for the remote appliance. The field is automatically populated with the hostname if left blank. 3. Click Add. 4. Verify the contents of the dialog and then click Trust to add appliance. NOTE: For a HPE SimpliVity appliance, server certificate will not be verified during connecting. Editing an appliance name Perform this task from the Settings > Appliances page. Prerequisites Only Global Dashboard users who have the Infrastructure Administrator role can edit appliance names. Procedure 1. On the Appliances page, click the appliance name to open the detailed information pane on the right side of the screen. 2. Click the edit icon to the right of the name. 3. Enter a new name. 4. Click OK. 40 Editing an appliance name

41 Removing an appliance Perform this task from the Settings > Appliances page. NOTE: All resources associated with the appliance being removed are also removed. Prerequisites Only Global Dashboard users who have the Infrastructure Administrator role can remove appliances. If the appliance is using a self-signed certificate, the certificate is removed from Global Dashboard trust store when you remove the appliance. Procedure 1. On the Appliances page, click the appliance name to open the detailed information pane on the right side of the screen. 2. Click Remove. 3. In the dialog box that appears, click Remove, or close the dialog box without removing the appliance. Dashboard Customization page Use the Dashboard Customization page to show or hide resources in Global Dashboard main page and the navigation pane. These settings apply individually to each user. They are not global settings that apply to all users. Customizing Global Dashboard Perform this task from the Settings > Dashboard Customization page. Procedure 1. On the Dashboard Customization page, select or clear the items you want to show or hide. Cleared items are removed from the left navigation menu and the Dashboard page. 2. Click OK. Network Settings page Use the Network Settings page to configure network settings for Global Dashboard. Configuring network settings Perform this task from the Settings > Network Settings page. Prerequisites Only Global Dashboard users who have the Infrastructure Administrator role can configure network settings. Removing an appliance 41

42 Procedure 1. On the Network Settings page, under Actions, click Edit Network Settings. 2. Under General, specify a Host Name for Global Dashboard. 3. Under IPv4, select either DHCP or Static. a. If you select DHCP: Under DNS, select either From DHCP or Manually. If you select Manually, you can optionally specify the IP addresses of the Preferred DNS server and the Alternate DNS server. b. If you select Static: Specify the IPv4 address, IPv4 Subnet, and IPv4 Gateway address Under DNS, specify the Preferred DNS server and the Alternate DNS server. 4. Click OK. Appliance Certificate page Use the Appliance certificate page to see certificate information, create a certificate request, or import a certificate. Creating a certificate signing request Perform this task from the Settings > Appliances Certificate page. Prerequisites Only Global Dashboard users who have the Infrastructure Administrator role can create a certificate signing request. Procedure 1. On the Appliances Certificate page, under Actions, select Certificate signing request. 2. Under Required Information, specify certificate information. 3. Under Optional Information, specify optional certificate information. 4. Click OK. Importing a certificate Perform this task from the Settings > Appliance certificate page. Prerequisites Only Global Dashboard users who have the Infrastructure Administrator role can import a certificate. A certificate authority (CA) must be added to Global Dashboard trust store before importing the signed appliance certificate. 42 Appliance Certificate page

43 Procedure 1. On the Appliance certificate page, under Actions, select Import certificate. 2. Paste the certificate into the box. 3. Click OK. Directories page Use the Directories page to set up an external authentication directory service, also called an enterprise directory or authentication login domain, to provide single sign-on (SSO) for groups of users instead of maintaining individual local user accounts. For SSO to work with an authentication directory service, Global Dashboard and the remote HPE OneView instance must be configured to use the same authentication directory service. SSO is not supported for HPE HC380 systems or HPE SimpliVity. The Directories page displays the directory name and directory type. Click on the directory name to display details about the directory. Adding an authentication directory service Perform this task from the Settings > Directories page. Prerequisites Only Global Dashboard users who have the Infrastructure Administrator role can add a directory service. If you have not configured a directory service in HPE OneView, or are not familiar with the Active Directory or OpenLDAP configuration, the following information can help you configure and verify the directory service before adding it in Global Dashboard. OpenLDAP configuration (configuration example and LDAP schema classes) Microsoft Active Directory configuration (configuration examples and built-in groups) Validate the directory server configuration If a directory certificate is issued by a certificate authority (CA) and the directory does not have the full chain of CA certificates, the full chain of CA certificates need to be added to the Global Dashboard trust store before adding a directory. Procedure 1. On the Directories page, click the add icon. 2. Enter a Directory Name of your choice. This value can be an arbitrary name. It is used to reference this directory server in other places within the Global Dashboard interface. 3. Select Active Directory or OpenLDAP. a. If you select OpenLDAP, complete the fields for User Naming Attribute and Organizational Unit. 4. Enter the Base DN. For example: dc=mydomain,dc=myorg Directories page 43

44 5. To add a server that hosts the authentication directory service, click the add icon, and complete the following: a. Enter the IP address or directory server host name. b. Confirm the directory server port or enter a new one. IMPORTANT: The decision whether to search Global Catalog or the domain is based on the scope of the search. When the scope of a search is the domain or an organizational unit, use the SSL port. The default is 636. When the scope of a search is the forest, use the SSL Global Catalog port. The default is c. Click OK. 6. In the case the entire CA chain is not in the Global Dashboard trust store or a directory with selfsigned certificate, you will be redirected. Click Yes, trust to add the listed CAs/certificate to appliance trust store. 7. To set the current domain as the default login domain, select Set as default login domain. If this check box remains cleared, the default login domain remains the same as before. 8. Click OK. Once you have configured an authentication directory service, add a directory group. OpenLDAP configuration Example: OpenLDAP directory configuration In this example, user accounts are located under the People OU and groups are located under the Groups OU: 44 OpenLDAP configuration

45 For this example, to authenticate users, but not groups, you would make these entries in the Add Directory screen: Directory type Base DN User naming attribute Organizational unit Organizational unit OpenLDAP DC=example,DC=com CN OU=people OU=groups LDAP schema object classes The following illustrates groups, by directory type, created with object classes. Such LDAP groups need to be added to HPE OneView and assigned roles. OpenLDAP Under OpenLDAP, a group can be created with either of these LDAP Schema object classes: groupofuniquenames groupofnames A group created with the objectclass as groupofuniquenames has its members under uniquemember as in this example. A group created with the objectclass as groupofnames or groups has its members under member as shown here. Working with reports and settings 45

46 Microsoft Active Directory Under Active Directory, a group can be created with any of these LDAP schema object classes: groupofnames groups groupofuniquenames View group members by examining the properties of the group name as in this example: 46 Working with reports and settings

47 Validate the directory server configuration Use the following procedure to verify a proper directory server configuration. Prerequisites To do this task, you must have an Infrastructure Administrator role. The server that hosts the authentication directory service must: Communicate through SSL. Agree on the SSL port for LDAP. Be accessible through a fully qualified domain name or IP address. Have an available SSL certificate, based on an RSA algorithm. There must be valid search contexts so that the group or groups can be identified and accessed. Procedure 1. Determine if there is a connection to the directory server with the ping command: Validate the directory server configuration 47

48 ping directory_server_host_name 2. Verify that the public key for the directory server certificate is based on an RSA algorithm. If the directory server is actually a number of domain controller servers that are running as a round robin server, each server has a unique certificate. NOTE: When you add the directory server in Global Dashboard: First import the common CA certificate which authenticates each domain controller server from Settings > Certificate, then input the round robin server FQDN to add directory on the Add Directory Server screen. Verify that the certificate specifies the public key as RSA (n bits). The default option for Microsoft Active Directory is RSA 2048 bits. 3. Ensure that the certificate s timestamp is older than the appliance time. This can be a concern if the appliance and the directory are synchronized to different time servers or if they are running in different time zones. 4. Validate the search contexts by running ldapsearch command from a Linux terminal in the same network as the Global Dashboard appliance. Search context CN CN=Users DC=example,DC=com Username: server_admin For this example, the ldapsearch command, using TLS/SSL, would resemble the following: LDAPTLS_CACERT=location_of_certificate ldapsearch -LLL Z -H ldaps://host_name:port -b "base-dn" -D "bind-dn" W [cn/uid/ssamaccountname/userprincipalname] For this example, ldapsearch, not using TLS/SSL, would resemble the following: ldapsearch -LLL -H ldap://ip_address:389 -b "cn=users,dc=example,dc=com" -D "cn=server_admin,cn=users,dc=example,dc=com" W CN Once you have validated the directory service configuration, proceed to Adding an authentication directory service in Global Dashboard. Microsoft Active Directory configuration Example: Users and groups in same OU Microsoft Active Directory In this example, the domain is example.com, and users and groups are located under the Users container, the default organizational unit. 48 Microsoft Active Directory configuration

49 For this example, to authenticate the user with the login name server_admin, you would make these entries in the Add Directory screen: Directory type Base DN Active Directory DC=example,DC=com Example: Users and groups in different OUs, under same parent Microsoft Active Directory In this example, there is a parent OU named Accounts with two children, Users and Groups. The domain is example.com. Working with reports and settings 49

50 For this example, to authenticate a user in the Users OU, you would make these entries in the Add Directory screen: Directory type Base DN Active Directory DC=example,DC=com Example: Users and groups in different OUs, under different parents Microsoft Active Directory In this example, there are two separate OUs, User Accounts and Group Accounts in the domain example.com. 50 Working with reports and settings

51 Specifying the OU takes the form: OU= child_ou,ou= parent_ou In the example, there are four different accounts: OU=Admin Users,OU=User Accounts,DC=example,DC=com OU=Finance Users,OU=User Accounts,DC=example,DC=com OU=Admin,OU=Group Accounts,DC=example,DC=com OU=Others,OU=Group Accounts,DC=example,DC=com For this example, to authenticate users and groups, you would make these entries in the Add Directory screen: Directory type Base DN Active Directory DC=example,DC=com Built-in groups Microsoft Active Directory Microsoft Active Directory features built-in groups, in which certain groups are automatically located in predefined containers. These built-in groups include: Domain Users Domain Admins Enterprise Admins The Microsoft Active Directory Domain Users group contains all users that were created in the domain. In this example, all the user accounts under Users are included in Domain Users: Working with reports and settings 51

52 By default, Microsoft Active Directory defines some of the groups (such as Domain Users) in the Users container. These groups are also listed in the group names field in the Add Users and Directory Groups screen if the Users container is specified as a search context input. But a group like Domain Users will not behave the same as the other manually configured groups. For example, the Domain Users group does not have access to the appliance. You must specify the organizational unit or units to be different than Domain Users, because user accounts in the Domain Users group will not be authenticated. For more information on built-in groups and their behavior, see the Microsoft Active Directory documentation. Users and directory groups page For information on the Users and directory groups page, see Managing users and directory groups. Groups page Use the Groups page to manage groups in Global Dashboard. Group management (create/edit/modify/delete) can only be performed by Infrastructure Administrators. However, all users can make use of groups. Adding a group Perform this task from the Settings > Groups page. Prerequisites Only Global Dashboard users who have the Infrastructure Administrator role can add a group. 52 Users and directory groups page