Cisco Prime Infrastructure 2.1 Quick Start Guide
Cisco Prime Infrastructure 2.1 Quick Start Guide
Cisco Prime Infrastructure 2.1 Quick Start Guide
2 Product Overview
Cisco Prime Infrastructure provides a single integrated solution for comprehensive lifecycle management of the wired/wireless
access, campus, and branch networks, and rich visibility into end-user connectivity and application performance assurance
issues. Cisco Prime Infrastructure accelerates the rollout of new services, secure access and management of mobile devices,
making “Bring Your Own Device” (BYOD) a reality for corporate IT. Tightly coupling client awareness with application
performance visibility and network control, Cisco Prime Infrastructure helps ensure uncompromised end-user quality of
experience. Deep integration with the Cisco Identity Services Engine (ISE) further extends this visibility across security and
policy-related problems, presenting a complete view of client access issues with a clear path to solving them.
2
3 Key Features
For:
• An overview of Prime Infrastructure features and benefits, see the latest Cisco Prime Infrastructure Data Sheets.
• An overview of new features in Prime Infrastructure 2.1, see the Release Notes for Cisco Prime Infrastructure 2.1
• Detailed information about the most often used Prime Infrastructure features, see the Cisco Prime Infrastructure 2.1 User
Guide.
• Detailed information about Prime Infrastructure features intended for administrators, see the Cisco Prime Infrastructure
2.1 Administrator Guide.
3
5 Pre-Installation Tasks
Complete the tasks in the following sections before installing Prime Infrastructure.
System Requirements
Server Requirements
Prime Infrastructure is pre-packaged in three different system-size options. Table 1 summarizes the minimum server
requirements for each option.
You can install any of the three Prime Infrastructure options as an Open Virtual Appliance (OVA), running under VMWare ESXi
or ESX, on your own hardware. If you choose this implementation, the server you supply must meet or exceed the requirements
shown in the table for the option you select.
Prime Infrastructure is also available pre-installed on Cisco-supplied hardware as a physical appliance that meets or exceeds the
Standard option requirements.
Please note:
• The Express option replaces the Medium and Small options supplied in previous versions of Prime Infrastructure.
• The Standard option replaces the Large option supplied in previous versions of Prime Infrastructure.
• The Pro option replaces the Extra Large option supplied in previous versions of Prime Infrastructure.
If you install Prime Infrastructure as an OVA on a server that exceeds the minimum requirements for a selected option (or if you
increase CPU, memory or disk resources after installation) you can tune the OVA to use the additional resources and improve
product performance. See Improving Prime Infrastructure Performance in the Cisco Prime Infrastructure 2.1 Administrator
Guide.
For maximum management capacities for each option, see Scaling Prime Infrastructure, page 5.
4
Scaling Prime Infrastructure
Prime Infrastructure comes with a variety of server installation options (see System Requirements, page 4). You will want to
ensure that you have selected an option appropriate for the size and complexity of your network.
Table 2 gives the maximum number of devices, clients, events, Netflow data flows, and other scale parameters for each option.
Table 2 Supported Scale for Prime Infrastructure Installation Options (includes Assurance)
Scaling limits for the pre-installed Cisco-supplied hardware appliance match the Standard option.
Table 3 Maximum Number of Device Connections on the Plug and Play Gateway
5
Ports Used by Prime Infrastructure and Assurance
Table 4 lists the ports used by Prime Infrastructure and Assurance. These ports must be open in firewalls.
6
Table 4 Ports Used by Prime Infrastructure and Assurance (continued)
7
Setting Up Devices for Prime Infrastructure
Before installing, configure your devices to provide Prime Infrastructure with the data it requires, such as SNMP notifications.
Configuring SNMP
To ensure that Prime Infrastructure can query SNMP devices and receive traps and notifications from them, you must:
• Set SNMP credentials (community strings) on each device you want to manage using Prime Infrastructure.
• Configure these same devices to send SNMP notifications to the Prime Infrastructure server.
Use the following IOS configuration commands to set read/write and read-only community strings on an SNMP device:
admin(config)# snmp-server community private RW
admin(config)# snmp-server community public RW
where private and public are the community strings you want to set.
After you set the community strings, you can specify that device notifications be sent as traps to the Prime Infrastructure server
using the following IOS global configuration command on each SNMP device:
admin (config)# snmp-server host Host traps version community notification-type
where:
• Host is the IP address of the Prime Infrastructure server.
• version is the version of SNMP that is used to send the traps.
• community is the community string sent to the server with the notification operation.
• notification-type is the type of trap to send.
You may need to control bandwidth usage and the amount of trap information being sent to the Prime Infrastructure server
using additional commands.
For more information on configuring SNMP, see:
• The snmp-server community and snmp-server host sections of the IOS Command Reference.
• The “Configuring SNMP Support” section and the list of notification-type values in the Cisco IOS Configuration
Fundamentals Configuration Guide, Release 12.2.
Configuring NTP
Network Time Protocol (NTP) synchronization must be configured on all devices in your network as well as on the Prime
Infrastructure server. You must specify the NTP servers during server installation (see Installing the Server, page 20).
Note that NTP must be configured and synchronized across all Prime Infrastructure-related servers, including any remote FTP
servers you use for backups, secondary Prime Infrastructure high-availability servers, the Plug and Play Gateway, VMware
vCenter and the ESX virtual machine, etc. Failure to organize time synchronization across your network can result in anomalous
results in Prime Infrastructure.
8
Configuring Data Sources for Prime Infrastructure With Assurance
If you are licensing Assurance, you must complete pre-installation tasks so that Assurance can monitor your network interfaces
and services. See Supported Assurance Data Sources for information about these tasks. These tasks are in addition to those
covered in Setting Up Devices for Prime Infrastructure, page 8.
Table 6 Prime Infrastructure Assurance: Supported Data Sources, Devices and Software Versions
9
Table 6 Prime Infrastructure Assurance: Supported Data Sources, Devices and Software Versions (continued)
10
flow record type performance-monitor PerfMonRecord
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
match transport rtp ssrc
collect application media bytes counter
collect application media bytes rate
collect application media packets counter
collect application media packets rate
collect application media event
collect interface input
collect interface output
collect counter bytes
collect counter packets
collect routing forwarding-status
collect transport packets expected counter
collect transport packets lost counter
collect transport packets lost rate
collect transport round-trip-time
collect transport event packet-loss counter
collect transport rtp jitter mean
collect transport rtp jitter minimum
collect transport rtp jitter maximum
collect timestamp interval
collect ipv4 dscp
collect ipv4 ttl
collect ipv4 source mask
collect ipv4 destination mask
collect monitor event
flow monitor type performance-monitor PerfMon
record PerfMonRecord
exporter PerfMonExporter
flow exporter PerfMonExporter
destination PrInIP
source Loopback0
transport udp PiInPort
policy-map type performance-monitor PerfMonPolicy
class class-default
! Enter flow monitor configuration mode.
flow monitor PerfMon
! Enter RTP monitor metric configuration mode.
monitor metric rtp
!Specifies the minimum number of sequential packets required to identify a stream as being an RTP flow.
min-sequential 2
! Specifies the maximum number of dropouts allowed when sampling RTP video-monitoring metrics.
max-dropout 2
! Specifies the maximum number of reorders allowed when sampling RTP video-monitoring metrics.
max-reorder 4
! Enter IP-CBR monitor metric configuration mode
monitor metric ip-cbr
! Rate for monitoring the metrics (1 packet per sec)
rate layer3 packet 1
interface interfacename
service-policy type performance-monitor input PerfMonPolicy
service-policy type performance-monitor output PerfMonPolicy
11
Enabling NetFlow and Flexible NetFlow
To ensure that Prime Infrastructure can make use of NetFlow data, your network devices must:
• Have NetFlow enabled on the interfaces you want to monitor.
• Export the NetFlow data to the Prime Infrastructure server and port.
As of version 2.1, Prime Infrastructure supports Flexible NetFlow versions 5 and 9. Note that you must enable NetFlow on each
physical interface for which you want Prime Infrastructure to collect data. These will normally be Ethernet or WAN interfaces.
This applies to physical interfaces only. You do not need to enable NetFlow on VLANs and Tunnels, as they are included
automatically whenever you enable NetFlow on a physical interface.
Use the commands below to enable NetFlow on Cisco IOS devices:
Device(config)# interface interfaceName
Device(config)# ip route-cache flow
where interfaceName is the name of the interface (such as fastethernet or fastethernet0/1) on which you want to
enable NetFlow.
Once NetFlow is enabled on your devices, you must configure exporters to export NetFlow data to Prime Infrastructure. You
can configure an exporter using these commands:
Device(config)# ip flow-export version 5
Device(config)# ip flow-export destination PrInIP PiInPort
Device(config)# ip flow-export source interfaceName
where:
• PrInIP is the IP address of the Prime Infrastructure server
• PiInPort is the UDP port on which the Prime Infrastructure server is listening for NetFlow data (the default is 9991)
• interfaceName is the name of the interface sending NetFlow data to the specified PrInIP. This will cause the source
interface’s IP address to be sent to Cisco Prime Infrastructure as part of NetFlow export datagrams.
If you configure multiple NetFlow exporters on the same router, make sure that only one of them exports to the the Prime
Infrastructure server. If you have more than one exporter on the same router exporting to the same destination, you risk data
corruption.
Use the following commands to verify that NetFlow is working on a device:
Device# show ip flow export
Device# show ip cache flow
Device# show ip cache verbose flow
For more information on NetFlow configuration, see:
• Cisco IOS Switching Services Configuration Guide, Release 12.1
• Flexible NetFlow Configuration Guide, Cisco IOS Release 15.1M&T
• Cisco Nexus 7000 Series NX-OS System Management Configuration Guide, Release 5.x
• Catalyst 6500/6000 Switches NetFlow Configuration and Troubleshooting
12
Prime Infrastructure uses a more efficient REST interface to query NAMs. For this reason, it does not support the direct export
of NetFlow data from NAMs. Any device exporting NetFlow data must export that NetFlow data directly to Prime
Infrastructure, not via a NAM. Exporting NetFlow data from any NAM to Cisco Prime Infrastructure will result in data
duplication.
Use commands like the following to configure flow records for applications with flows across the router:
Router (config)# flow record type mace mace-record
Router (config)# collect application name
Router (config)# collect art all
where application name is the name of the application whose flow data you want to collect.
To configure the PA flow monitor type:
Router (config)# flow monitor type mace mace-monitor
Router (config)# record mace-record
Router (config)# exporter mace-export
To collect traffic of interest, use commands like the following:
Router (config)# access-list 100 permit tcp any host 10.0.0.1 eq 80
Router (config)# class-map match-any mace-traffic
Router (config)# match access-group 100
To configure a PA policy map and forward the PA traffic to the correct monitor:
Router (config)# policy-map type mace mace_global
Router (config)# class mace-traffic
Router (config)# flow monitor mace-monitor
Finally, enable PA on the WAN interface:
Router (config)# interface Serial0/0/0
Router (config)# mace enable
For more information on configuring Performance Agent, see the Cisco Performance Agent Deployment Guide.
13
6 Upgrading Cisco Prime Infrastructure
You can upgrade the following Cisco Prime Infrastructure (and predecessor) products to Cisco Prime Infrastructure 2.1:
• Cisco Prime Infrastructure 2.0.0.0.294
• Cisco Prime Infrastructure 1.3.0.20
If you are using a version earlier than 1.3.0.20, see the instructions for upgrading your software to version 2.0 provided in the
Cisco Prime Infrastructure 2.0 Quick Start Guide. There is no upgrade path from version 1.4.x to version 2.1 at present.
Before attempting to upgrade to 2.1, make sure that you download the appropriate patch listed in Table 7. and then install it
using the instructions in Installing Patches, page 15. Once you have installed the appropriate patches, you will also need to take
a new application backup before performing a system migration or inline upgrade.
Once patched, you can upgrade these versions to 2.1 using either of the following methods:
1. System Migration—Install Cisco Prime Infrastructure 2.1 as a new system on a new host, and restore the existing system’s
data to the new host. You can then decommission the old host. This option is preferred if you want to migrate to a larger
OVA, have a large network, or cannot afford service downtime. For details, see Migrating to a New System, page 16.
2. Inline Upgrade—Upgrades your existing system to version 2.1. All existing data is retained and you will be using the same
size OVA when the upgrade is complete. The existing product will not be operational until the upgrade is complete. This
option is preferred when you want to keep the same size OVA and service downtime during the upgrade is acceptable. For
details, see Performing an Inline Upgrade, page 17.
Prime Infrastructure application backups include license data. Reinstalling on a new system or virtual machine does not require
you to rehost your licenses, so long as you use a recent application backup to restore your license data from the old system to
the upgraded system. In any other case, you must email a request to [email protected] to rehost your licenses. You will need
to Include your VUDI details and existing license details, including the number of licenses in your request.
14
Installing Patches
You may need to install patches to get your version of Prime Infrastructure to the level at which upgrade is supported. For
example: If you are currently running Cisco Prime Infrastructure version 1.3.0, you must install the PI_1_3_0_20-Update.4-16
patch before attempting to upgrade. You can check the Prime Infrastructure version and patch version you are running by using
the CLI commands show version and show application.
Different patch files are provided for each version of Prime Infrastructure and its predecessor products. Download and install
only the patch files that match the version of your existing system and that are required before you upgrade to a higher version.
You can find the appropriate patches by pointing your browser to the Cisco Download Software navigator.
Before installing a patch, you will need to copy the patch file to your Prime Infrastructure server’s default repository. Many users
find it easy to do this by first downloading the patch file to a local FTP server, then copying it to the repository. You can also
copy the patch file to the default repository using any of the following methods:
• cdrom—Local CD-ROM drive (read only)
• disk—Local hard disk storage
• ftp—URL using an FTP server.
• http—URL using an HTTP server (read only)
• https—URL using an HTTPS server (read only)
• nfs—URL using an NFS server
• sftp—URL using an SFTP server
• tftp—URL using a TFTP server
Step 1 Download the appropriate point patch to a local resource in your environment:
a. With the Cisco Download Software navigator displayed in your browser, select Products > Cloud and Systems
Management > Routing and Switching Management > Network Management Solutions > Cisco Prime Infrastructure.
b. Select the version of Cisco Prime Infrastructure that most closely matches the one you are currently using (e.g., Cisco
Prime Infrastructure 1.2).
c. Click Prime Infrastructure Patches to see the list of available patches for that version of the product.
d. Next to each patch that is required, click Download, then follow the prompts to download the file.
Step 2 Open a command-line interface session with the Prime Infrastructure server (see Connecting Via CLI in the Cisco Prime
Infrastructure 2.1 Administrator Guide).
Step 3 Copy the downloaded patch file to the default local repository. For example:
admin# copy source path/defaultRepo
Where:
• source is the downloaded patch file’s location and name (for example:
ftp://MyFTPServer/pi_9.3.1.0_update.tar.gz).
• path is the complete path to the default local backup repository, defaultRepo.
Step 4 Install the patch:
admin# patch install patchFile defaultRepo
Where patchFile is the name of the patch file you copied to defaultRepo.
15
Installing the Plug and Play Gateway Patch
The Plug and Play Gateway standalone server patch is available in the pnp-gateway-patch-2.0.0.28.tar.gz file.
The patch upgrade procedure requires an FTP or TFTP server containing the patch file. You can access the server from the Cisco
Prime Infrastructure 1.2 Plug and Play Gateway standalone server.
Step 1 Log in to the Plug and Play Gateway standalone server as admin user.
Step 2 Create a repository in the configuration mode and execute the repository command by providing the repository name
and other details.
Step 3 Use the patch install command to install the pnp-gateway-patch-2.0.0.28.tar.gz Plug and Play Gateway standalone
patch.
Step 4 Execute the pnp setup command to reconfigure the Plug and Play standalone server and start the plug and play
processes. For example:
pnp-server login: admin
Password:
pnp-server/admin# configure
Enter configuration commands, one per line. End with CNTL/Z.
pnp-server/admin(config)# repository <repository_name>
pnp-server/admin(config-Repository)# url ftp://<SERVER_HOST_NAME>/<FOLDER_LOCATION>
pnp-server/admin(config-Repository)# user <USER_ID> password <OPTION> <PASSWORD>
pnp-server/admin(config-Repository)# exit
pnp-server/admin(config)# exit
pnp-server/admin#
pnp-server/admin# patch install pnp-gateway-patch-2.0.0.28.tar.gz
pnp-patching-<VERSION>.tar.gz <repository_name>
Save the current ADE-OS running configuration? (yes/no) [yes] ?
Generating configuration...
Saved the ADE-OS running configuration to startup successfully
Initiating Application Patch installation...
Patch successfully installed
pnp-server/admin#
pnp-server/admin# pnp setup
Step 1 Before you begin, remove any existing High Availability configuration from your primary and secondary Prime
Infrastructure servers. You can do this using either of the following options:
• Launch Prime Infrastructure, choose Administration > High Availability > HA Configuration, and click Remove.
• Open a command-line interface session with the Prime Infrastructure server (see Connecting Via CLI in theCisco
Prime Infrastructure 2.1 Administrator Guide and run the ncs ha remove command.
Step 2 If you have not already done so: Set up a remote backup repository for the old host. For details, see Using Remote
Backup Repositories in the Cisco Prime Infrastructure 2.1 Administrator Guide.
Step 3 Take an application backup of the old host on the remote repository. For details, see Taking Application Backups in
the Cisco Prime Infrastructure 2.1 Administrator Guide
Step 4 Install the new host as explained in Installing Cisco Prime Infrastructure, page 19.
Step 5 Configure the new host to use the same remote backup repository as the old host.
Step 6 Restore the application backup on the remote repository to the new host, as explained in Restoring From Application
Backups in the Cisco Prime Infrastructure 2.1 Administrator Guide.
16
Step 7 When the upgrade is complete:
• Instruct users to clear the browser cache on all client machines that accessed an older version of Prime
Infrastructure before they try to connect to the upgraded Prime Infrastructure server.
• If you run into problems creating a backup after you have upgraded to this release, see Managing Disk Space Issues
on Prime Infrastructure Servers, page 18
• If you were using external AAA (RADIUS or TACACS) before the upgrade, see Renewing AAA Settings, page 18.
• If you are using Prime Infrastructure to manage Cisco Wireless LAN Controllers, see Re-synchronizing WLC
Configurations, page 18.
Step 1 Before you begin, remove any existing High Availability configuration from your primary and secondary Prime
Infrastructure servers. You can do this using either of the following options:
• Launch Prime Infrastructure, choose Administration > High Availability > HA Configuration, and click Remove.
• Open a command-line interface session with the Prime Infrastructure server (see Connecting Via CLI in the Cisco
Prime Infrastructure 2.1 Administrator Guide and run the ncs ha remove command.
Step 2 If you have not already done so, open a CLI session with the server and copy the upgrade file downloaded from
cisco.com to the default backup repository:
admin# copy source path:/defaultRepo
Where:
• source is the application upgrade file’s URL, path and filename (for example:
FTP://<YourFTPServer>/PI-upgrade-bundle-#.#.tar.gz).
• path is the complete path to the default local backup repository, defaultRepo.
Step 3 Stop the Prime Infrastructure server by entering the command ncs stop.
Step 4 Run the application upgrade:
admin# application upgrade PI-upgrade-bundle-2.1.0.0.87.tar.gz defaultRepo
This step can take 30 minutes or more to complete, depending on the size of the application database.
Step 5 When the upgrade is complete:
• Verify that the application is running by opening a CLI session and entering the command ncs status.
• Instruct users to clear the browser cache on all client machines that accessed an older version of Prime
Infrastructure before they try to connect to the upgraded Prime Infrastructure server.
• If you run into problems creating a backup after you have upgraded to version 2.1, see Managing Disk Space Issues
on Prime Infrastructure Servers, page 18
• If you were using external AAA (RADIUS or TACACS) before the upgrade, see Renewing AAA Settings, page 18.
• If you are using Prime Infrastructure to manage Cisco Wireless LAN Controllers, see Re-synchronizing WLC
Configurations, page 18.
17
Managing Disk Space Issues on Prime Infrastructure Servers
If you are experiencing issues with disk space during an upgrade, we suggest you either:
• Use the VMware Edit Settings feature to increase the amount of disk space allocated to the OVA.
• Use the upgrade method explained in Migrating to a New System, page 16 to move your installation to a server with
adequate disk space.
If you are unable to create a backup after upgrading your existing system, follow the steps below to free disk space and create
a successful backup. If you are still unable to create a backup after using the ncs cleanup command, set up and use a remote
FTP repository for your backups, as explained in Using Remote Backup Repositories in the Cisco Prime Infrastructure 2.1
Administrator Guide.
Step 1 Open a command-line interface session with the Prime Infrastructure server (see Connecting Via CLI) and log in to the
server using an administrator ID.
Step 2 At the command line, enter the following command to compact the application database:
admin# ncs cleanup
Step 3 When prompted, answer Yes to the deep cleanup option. When the operation is complete, you should be able to perform
another backup.
18
7 Installing Cisco Prime Infrastructure
If you are currently running any previous version of Cisco Prime Network Control System (NCS), NCS (WAN), or Prime
Assurance Manager, you must upgrade instead of installing. See Upgrading Cisco Prime Infrastructure, page 14.
19
Installing the Server
After you deploy the Prime Infrastructure OVA, you must configure the virtual appliance to install and start Prime
Infrastructure.
Step 1 In the VMware vSphere client, right-click the deployed virtual appliance and choose Power > Power On.
Step 2 Click the Console tab. At the localhost login prompt, enter setup.
Step 3 The console prompts you for the following parameters:
• hostname—The host name of the virtual appliance.
• IP Address—The IP address of the virtual appliance.
• IP default netmask—The default subnet mask for the IP address.
• IP default gateway—The IP address of the default gateway.
• Default DNS domain—The default domain name.
• Primary nameserver—The IP address of the primary name server.
• Secondary nameservers—The IP address if the secondary name server used in case the primary cannot be contacted.
You may have up to three secondary nameservers.
• Primary NTP server—The IP address or host name of the primary Network Time Protocol server you want to use.
(time.nist.gov is the default).
• Secondary NTP servers—The IP address of the secondary NTP server.
• System Time Zone—The time zone code you want to use (see the list of time zones in System Time Zones).
• Clock time—The clock time based on the server’s time zone.
• Username—The name of the first administrative user (known as “admin”). This is the administrator account used
to log in to the server via SSH or Telnet. You can accept the default, which is admin.
• Password—Enter the admin user password and then confirm it. The default is admin.
Step 4 When you are done entering these values, the installer application tests the network configuration parameters you
entered. If the tests are successful, it begins installing Prime Infrastructure.
Step 5 When the application installation is complete, you will be prompted for the following post-installation parameters:
• High Availability Role Selection—Enter yes at the prompt if you want this installed server to serve as the fallback
secondary server in a high-availability implementation. You will be prompted to provide a High Availability
registration key. If you enter no at the prompt, the server will act as the primary server (standalone) and the
installation will process with the following prompts:
• Root Password—Enter the password to be used for the default root administrator, and then confirm it. This is the
root account used to log in to the Prime Infrastructure user interface for the first time and set up other user
accounts.
• FTP password—Enter the FTP password and confirm it.
Step 6 When the installation is complete, the virtual appliance reboots and you are presented with a login prompt.
Step 7 Log in to the virtual appliance using the “admin” username and password you specified in step 3.
20
Logging into the Prime Infrastructure User Interface
Follow these steps to log into the Prime Infrastructure user interface through a web browser:
Step 1 Launch one of the Supported Browsers (see System Requirements, page 4) on a different computer from the one on
which you installed and started Prime Infrastructure.
Step 2 In the browser’s address line, enter https://ipaddress, where ipaddress is the IP address of the server on which you
installed Prime Infrastructure. The Prime Infrastructure user interface displays the Login window.
When you access Prime Infrastructure for the first time, some browsers will display a warning that the site is untrusted.
When this happens, follow the prompts to add a security exception and download the self-signed certificate from the
Prime Infrastructure server. After you complete this procedure, the browser will accept the Prime Infrastructure server
as a trusted site in all future login attempts.
Step 3 Enter the root administrator username and password, as specified when Installing the Server, page 20.
If any licensing problems occur, a message appears in an alert box. If you have an evaluation license, the number of
days until the license expires is shown. You are also alerted to any expired licenses. You have the option to go directly
to the Administration > Licenses page to address these problems.
Step 4 Click Login to log into Prime Infrastructure. The user interface is now active and available for use. The home page
appears.
To ensure system security, select Administration > Users, Roles & AAA > Change Password to change the password for
the root administrator.
To exit the user interface, close the browser page or click Logout in the upper right corner of the page. Exiting a Prime
Infrastructure user interface session does not shut down Prime Infrastructure on the server.
If a system administrator stops the Prime Infrastructure server during your Prime Infrastructure session, your session
ends, and the browser displays this message: “The page cannot be displayed.” Your session does not re-associate to
Prime Infrastructure when the server restarts. You must start a new Prime Infrastructure session.
8 Getting Started
After you install Prime Infrastructure, you must perform additional tasks to begin managing your network. These tasks are all
listed in the “Getting Started” chapter of the Cisco Prime Infrastructure 2.1 User Guide. After you complete these tasks, you
are ready to start monitoring and configuring your network.
21
Deploying the Prime Infrastructure Plug and Play Gateway OVA
Make sure that all of the system requirements are met before you deploy the OVA. Review the Prime Infrastructure Plug and
Play Gateway Server Requirements, page 21 and Before You Begin, page 19 sections.
Installing the Cisco Prime Infrastructure Plug and Play Gateway as a Standalone
After you deploy the Cisco Prime Infrastructure Plug and Play Gateway OVA, you must configure the virtual appliance to install
and start the Cisco Prime Infrastructure Plug and Play Gateway.
Step 1 In the VMware vSphere client, right-click the deployed virtual appliance and choose Power > Power On.
Step 2 Repeat Step 2 and Step 3 in Installing the Server, page 20.
Step 3 After you enter the values, the installer tests the network configuration parameters. If the tests are successful, the
installer begins the Cisco Prime Infrastructure Plug and Play Gateway installation.
Step 4 When the installation is complete, the virtual appliance reboots and displays a login prompt.
Step 5 Log in to the virtual appliance using an administrator username and password.
22
Generating a CA-Signed Certificate for the Plug and Play Gateway
By default, the Plug and Play Gateway can be set up to generate a self-signed certificate. The certificate can be used to create a
trustpoint on the device for SSL communication. We recommend that you use SSL certificates signed by a single CA for both
the Plug and Play Gateway and the device.
You should generate the certificate only if you require SSL communication with a CA- signed certificate between the Plug and
Play Gateway and the device.
Step 1 Log in to the CNS supported K9 device and check the version of the software image using the show version command.
The image that is loaded on the CNS supported K9 device should be a crypto image.
Step 2 Obtain the server certificate from the CA using the following commands.
Generate RSA keys and certificate signing request:
$cd /root
$openssl genrsa -out server.key 1024 // generate an RSA Keypair and a Certificate Signing Request:
$chown root:root server.key
$chmod 400 server.key
$openssl req -new -key server.key -out server.csr
You can enter a period (.) in case you do not want to enter any information. But remember to enter CE
server name as
(Ex: myCEserver.example.com) when asked for Common Name (e.g., YOUR name) []:
The server.key and the server.csr files are now in the root directory.
Note Ensure that you to obtain a signed CA certificate using the .csr file. You should receive three .crt files from your CA.
Step 3 Run the Plug and Play setup and copy the CA certificate. For more information on the Plug and Play setup, see the
“Setting Up the Prime Infrastructure Plug and Play Gateway” section on page 26.
23
Activating the CA Certificate on an Endpoint Device
To activate the server certificate on the CNS supported K9 Device, follow these steps:
Step 1 Log in to the CNS supported K9 device and check the clock timings. The endpoint device and the Plug and Play gateway
server should have the same timestamp.
Router#show clock
02:04:40.065 PST Fri Feb 20 2009
The certificate begins to be valid starting at 19:30 GMT,
which is 3:30pm Eastern Time, which is 12:30 Pacific Time.
Hence make sure the clock on router is set correctly.
Step 2 Check if a certificate is already installed for the required trustpoint. If so, use the following configuration command to
revoke the old certificate:
Router# conf terminal
Router(config)# no crypto ca trustpoint example.com
Respond with Yes when prompted to destroy certificates. For example:
% Removing an enrolled trustpoint will destroy all certificates
received from the related Certificate Authority.
Are you sure you want to do this? [yes/no]: yes
-----BEGIN CERTIFICATE-----
MIIDFTCCAf2gAwIBAgIKMt87mwABAAABrjANBgkqhkiG9w0BAQUFADAuMRYwFAYD
VQQKEw1DaXNjbyBTeXN0ZW1zMRQwEgYDVQQDEwtURVNULVNTTC1DQTAeFw0wOTAx
MTYxMDU0NDJaFw0xMDAxMTYxMTA0NDJaMDAxDjAMBgNVBAoTBUNpc2NvMR4wHAYD
VQQDExVpbWd3LXRlc3QxMC5jaXNjby5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0A
MIGJAoGBAPAdsaSPKMpGOny05TDuZG3t9Dwlc1VGk2ZfPpp7oX1eQNK4ub3Lr3o5
fb83nmwzzb6hXgDvO3ElX+Xjh+j4LZDDWb30db5jxJvYVz9MyrnChBD7kyLuUaOc
uxLNxPUwnWTzd28n+Wg5uSptH8b/ofxx5WBessCY20448hjTROq5AgMBAAGjgbYw
gbMwHQYDVR0OBBYEFClHMwLRjIfWNvv3FrMLNO/ILJz5MB8GA1UdIwQYMBaAFI7J
Ti5oRslwv2B3MmERGbPKKUsSMFwGA1UdIARVMFMwUQYKKwYBBAEJFQEBADBDMEEG
CCsGAQUFBwIBFjVodHRwOi8vd3d3LmNpc2NvLmNvbS9zZWN1cml0eS9wa2kvcG9s
aWNpZXMvaW5kZXguaHRtbDATBgNVHSUEDDAKBggrBgEFBQcDATANBgkqhkiG9w0B
24
AQUFAAOCAQEAXP9iMHWVGRucbda++UUR8PFSzaSChmQyWti5+oWe+WCUBU/HtonM
XACZBxwA4HTT7eqhPfs4HhNUUHT/l/ChZLksaWJNTO7Wa2X80vvJJUoWHVZod1Pm
vUJFgvZCBVBj54wvFaH+ijADzJ3ASVPOMxxdKdJzpYspNE4W0s0ghyIQxXF1Ht/B
n+DBipuG4hx5dK9px5f/nzCYNh5zxPnriaFe7WYiWUxg47WWT1nBMiVED8Z48WwB
gSX2K9+87Jg+lJ8EpQ1Avkf2X7vWsCW1vx9YicLw+RFS6o+4Za+NrwSmF/Y0pGJg
rCJlwLn2n0ZI64atJFa/FdAujr9W9KWrmw==
-----END CERTIFICATE-----quit
Step 5 Perform the following CNS configuration on the CNS supported K9 device:
Router#sh run | i cns
cns trusted-server all-agents myCEServer
cns trusted-server all-agents myCEServer.example.com
cns id string Router
cns id string Router event
cns id string Router image
cns event myCEServer.example.com encrypt 11012 keepalive 60 3
cns config partial myCEServer.example.com encrypt 443
cns image server https://imgw-test35:443/cns/HttpMsgDispatcher status
https://imgw-test35:443/cns/HttpMsgDispatcher
cns inventory
cns exec encrypt 443
Step 6 Check if the connection has been established between the CNS supported K9 device and Prime Infrastructure:
Router# sh cns event conn
If the connection is established, you should see output like the following
The currently configured primary event gateway:
hostname is imgw-test10.example.com.
port number is 11012.
encryption is enabled.
Event-Id is Router
Keepalive setting:
keepalive timeout is 60.
keepalive retry count is 3.
Connection status:
Connection Established.
The currently configured backup event gateway:
none.
The currently connected event gateway:
hostname is imgw-test10.example.com.
port number is 11012.
encryption is enabled.
25
Setting Up the Prime Infrastructure Plug and Play Gateway
To set up the Cisco Prime Plug and Play Gateway OVA, follow these steps.
Step 1 Log in to the Cisco Prime Plug and Play gateway server by using the administrative username and password.
Step 2 In the command prompt, enter the pnp setup command and press Enter.
Step 3 The console prompts for the following parameters:
• IP Address —The IP address to be used by the Plug and Play gateway server.
• SSL Server Certificate — The self/CA signed server certificate for Plug and Play gateway.
• CNS Event — The CNS event configuration that will be deployed on the device for dynamic location.
Step 4 The console displays the following:
bgl-pnp-dev1-ovf/admin# pnp setup
######################################################################
Enter Plug and Play Gateway Setup (setup log /var/KickStart/install/setup.log)
For detail information about the parameters in this setup,
refer to Plug and Play Gateway Admin Guide.
######################################################################
The maximum number of Event Gateways allowed is '10' for both plain text
and ssl combined. The Event Gateway ports 11011 and 11012 are reserved for port
automatic allocation.These ports are not counted while taking the maximum number of ports.
Enter number of Event Gateways that will be started with crypto operation: [5] 10
All the ports are configured for crypto operation. No plain text port is available. Is it the right
configuration y/n: [y]
The CNS Event command configures how the managed devices should
connect to this particular Plug and Play Gateway. The command entered in the following
line should match what's configured on the devices WITHOUT the port
number and keyword 'encrypt' if cryptographic is enabled.
Another example, if this is a backup Plug and Play Gateway and the following CLI is
configured on devices
"cns event bgl-pnp-dev1-ovf 11011 source Vlan1 backup", then `11011`
should be removed and the below line should be entered :
"cns event bgl-pnp-dev1-ovf source Vlan1 backup"
Unable to enter a correct CLI could cause the managed devices not
be able to connect to this Plug and Play Gateway. For details, please refer to
Installation and Configuration Guide.
Enter CNS Event command: [cns event bgl-pnp-dev1-ovf keepalive 120 2 reconnect 10]
26
Commit changes (y/n): y
Note For advance setup, use the pnp setup advanced command. For details, see the Command Reference Guide for Cisco
Prime Infrastructure 2.1.
######################################################################
Enter Plug and Play Gateway Setup (setup log /var/KickStart/install/setup.log)
For detail information about the parameters in this setup,
refer to Plug and Play Gateway Admin Guide.
######################################################################
Step 5 To check the status of the Prime Infrastructure Plug and Play gateway server, log in to the gateway server and execute
the pnp status command, or enter the following URL on the browser https://<IP address or
hostname>/cns/ResourceInit?name=port. The gateway server status will be displayed.
bgl-pnp-dev1-ovf/admin# pnp status
bgl-pnp-dev1-ovf/admin#
27
10 Removing the Prime Infrastructure Virtual Appliance
Removing Prime Infrastructure using the following method will permanently delete all data on the server, including server
settings and local backups. You will be unable to restore your data unless you have a remote backup. For other methods of
removal, see Removing Prime Infrastructure in the Cisco Prime Infrastructure 2.1 Administrator Guide.
Step 1 In the VMware vSphere client, right-click the Prime Infrastructure virtual appliance.
Step 2 Power off the virtual appliance.
Step 3 Click Delete from Disk to remove the Prime Infrastructure virtual appliance.
28
12 Reinstalling Cisco Prime Infrastructure on a Physical Appliance
You must have root privileges to install Prime Infrastructure on a physical appliance. Make sure you have performed a recent
backup before reinstalling Prime Infrastructure. After reinstalling, you can restore your data using the backup.
To reinstall Prime Infrastructure on a physical appliance, follow these steps:
Step 1 Insert the provided Prime Infrastructure software Image DVD. The system boots up and the following console appears:
ISOLINUX 3.11 2005-09-02 Copyright (C) 1994-2005 H. Peter Anvin
boot:
Step 2 Select option 1 to reinstall Prime Infrastructure software image. The system reboots and the configure appliance screen
appears.
Step 3 Enter the initial setup parameters and the system reboots again. Remove the DVD and follow the steps to start the Prime
Infrastructure server.
13 Related Documentation
TheCisco Prime Infrastructure 2.1 Documentation Overview lists all documentation available for Prime Infrastructure:
Note We sometimes update the documentation after original publication. Therefore, you should also review the
documentation on Cisco.com for any updates.
Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at
www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership
relationship between Cisco and any other company. (1110R)
Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the
document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.
© 2012-2014 Cisco Systems, Inc. All rights reserved.
29
Americas Headquarters Asia Pacific Headquarters Europe Headquarters
Cisco Systems, Inc. Cisco Systems (USA) Pte. Ltd. Cisco Systems International BV Amsterdam,
San Jose, CA Singapore The Netherlands
Cisco has more than 200 offices worldwide. Addresses, phone numbers, and fax numbers are listed on the Cisco Website at www.cisco.com/go/offices.
OL-30962-01.