Operations Manager
User Guide
21.Q1 March 2021
Contents
Copyright © 6
Safety & FCC Statement 7
About This User Guide 9
Installation And Connection 10
Power Connection 11
Dual AC Supply 13
Device Status LEDs 15
Connecting to the Network 17
Serial Connection 18
Cellular Connectivity 19
Reset and Erase 20
Initial System Configuration 21
Default Settings 22
Management Console Connection via CLI 24
Change the Root Password 25
Disable a Root User 27
MONITOR Menu 31
System Log 32
LLDP CDP Neighbors 33
Triggered Playbooks 34
ACCESS Menu 35
Local Terminal 36
Access Serial Ports 37
CONFIGURE Menu 40
Serial Ports 41
Local Management Consoles 45
Lighthouse Enrollment 47
Playbooks 49
PDUs 52
SNMP Alerts 54
SNMP Alerts System - Temperature, Authentication, Configuration 55
SNMP Alerts Power 58
SNMP Alerts Networking (Connection Status) 60
Network Connections 62
Network Interfaces 63
Dual SIM 64
Dual SIM Automatic Failover 70
Network Aggregates - Bonds and Bridges 76
Spanning Tree Protocol 82
IPsec Tunnels 85
Network Resilience 89
OOB Failover 90
IP Passthrough 91
User Management 92
Groups 93
Local Users 96
Remote Authentication 101
RemoteLocal for AAA Server 107
Local Password Policy 110
Services 115
HTTPS Certificate 116
Network Discovery Protocols 118
Routing 119
SSH 120
Unauthenticated SSH to Console Ports 122
Syslog 128
Remote Syslog 130
Session Settings 135
Firewall 136
Firewall Management 137
Interzone Polices 144
Services - Firewall 147
Date & Time 149
Time Zone 150
Manual Settings 151
Automatic Settings 152
System 153
Administration 155
Factory Reset 156
Reboot 157
System Upgrade 158
SNMP 159
SNMP Service 160
SNMP Alert Managers 161
Multiple SNMP Alert Managers 163
Advanced Options 166
Communicating With The Cellular Modem 167
OGCLI Guide 169
Docker 184
Cron 185
Initial Provisioning via USB Key 187
EULA and GPL 189
UI Button Definitions 190
Copyright ©
Opengear Inc. 2020. All Rights Reserved.
Information in this document is subject to change without notice and does not rep-
resent a commitment on the part of Opengear. Opengear provides this document
“as is,” without warranty of any kind, expressed or implied, including, but not limited
to, the implied warranties of fitness or merchantability for a particular purpose.
Opengear may make improvements and/or changes in this manual or in the product
(s) and/or the program(s) described in this manual at any time. This product could
include technical inaccuracies or typographical errors. Changes are periodically
made to the information herein; these changes may be incorporated in new editions
of the publication.
COPYRIGHT © 6
Safety & FCC Statement
Safety Statement
Please take care to follow the safety precautions below when installing and oper-
ating the OPERATIONS MANAGER:
l Do not remove the metal covers. There are no operator serviceable com-
ponents inside. Opening or removing the cover may expose you to dangerous
voltage which may cause fire or electric shock. Refer all service to Opengear
qualified personnel.
l To avoid electric shock the power cord protective grounding conductor must
be connected through to ground.
l Always pull on the plug, not the cable, when disconnecting the power cord
from the socket.
Do not connect or disconnect the appliance during an electrical storm. Also use a
surge suppressor or UPS to protect the equipment from transients.
FCC Warning Statement
This device complies with Part 15 of the FCC rules. Operation of this device is sub-
ject to the following conditions: (1) This device may not cause harmful interference,
and (2) this device must accept any interference that may cause undesired oper-
ation.
Proper back-up systems and necessary safety devices should be utilized
to protect against injury, death or property damage due to system failure.
Such protection is the responsibility of the user.
SAFETY & FCC STATEMENT 7
This device is not approved for use as a life-support or medical system.
Any changes or modifications made to this device without the explicit
approval or consent of Opengear will void Opengear of any liability or
responsibility of injury or loss caused by any malfunction.
This equipment is for indoor use and all the communication wiring are lim-
ited to inside of the building.
SAFETY & FCC STATEMENT 8
About This User Guide
This user guide covers the Opengear Operation Manager products, including the
OM2200 family of rack-mountable appliances (available with combinations of up to
48 serial ports and 24 Ethernet ports) and the OM1200 family of small form-factor
appliances (available with combinations up to 8 serial and 8 Ethernet ports).
This manual is up to date for the 20.Q4 November 2020 firmware release. When
using a minor release there may or may not be a specific version of the user guide
for that release. The current Operations Manager user guide can always be found
here.
ABOUT THIS USER GUIDE 9
Installation And Connection
This section describes how to install the appliance hardware and connect it to con-
trolled devices.
INSTALLATION AND CONNECTION 10
Power Connection
OM2200 and some newer OM1200 have dual power inlets with auto failover built
in. These power supplies each accept AC input voltage between 100 and 240 VAC
with a frequency of 50 or 60 Hz. The OM2224-24E-10G-L draws a maximum of
48W, while non-24E are less than 30W.
Two IEC AC power sockets are located on the power side of the metal case, and
these IEC power inlets use conventional IEC AC power cords.
Note: Country specific IEC power cords are not included with OM2200s.
OM1200s are shipped with a 12VDC to universal AC (multi-country clips) wall
adapter.
See also "Dual AC Supply" on page13 and "SNMP Alerts Power" on page58.
Operations Manager Platform (OM1200) Environmental And Power
Power Draw < 25 Watts
Operating conditions Temperature 0~50C, Rel Humidity 5~90%
Cooling Passive
Environmental Sensors Smart Controller with multi-zone temperature
sensors.
Auto-shutdown/re-boot on severe thermal events
Power Draw Sensors Active multi-zone power draw monitoring
INSTALLATION AND CONNECTION 11
Operations Manager Platform (OM2200) Environmental And Power
Power Supply Dual AC or dual DC
Power Draw 48 Watts for -24E, others <30W
Operating conditions Temperature 0~50C, Rel Humidity 5~90%
Cooling Passive
Environmental Sensors Smart Controller with multi-zone temperature
sensors
Supervisory environmental controller with safety
power down.
Power Draw Sensors Active multi-zone power draw monitoring
INSTALLATION AND CONNECTION 12
Dual AC Supply
Dual AC Supply can provide power redundancy for devices, especially those that
may operate in harsher environments. A secondary power supply provides redund-
ancy for the device if one PSU is unplugged or in the event of a failure.
LED Power Status Indicator
The power LED indicator requires no configuration and will display the dual power
status on any Operations Manager device with a dual power supply.
On a device with a
power connected to
all times.
dual
If a
LED power status indicator is colored orange indicating that the unit has no redundancy in the event of a power failure.
PSU device has power connected to
single
two
PSU (power supply unit)or, a
PSUs, the LED power status indicator should be green at
one
PSU (power supply unit), the
dual
PSU device has
INSTALLATION AND CONNECTION 13
SNMP Alerts for Power-related Events
The System Voltage Range SNMP alert is triggered when there is a change in
power status such as a system reboot or when the voltage on either power supply
leaves or enters the configured range of the System Voltage alert.
SNMP Alert Configuration
The System Voltage Range SNMP alert is configured in the Configure > SNMP
Alerts page, see "SNMP Alerts Power" on page58.
INSTALLATION AND CONNECTION 14
Device Status LEDs
The LED states shown below are determined through infod status and config-
server data. The config server holds a configurable threshold value for the Cell
LED Amber / Green light, and modem enabled / disabled information.
Status LEDs
LED Condition
LED Off
Power Device is off. On a dual
Heartbeat Device has
halted.
Network No active net-
work connection
Amber
Flashing
Device is
booting.
Device is failover starting.
Amber Solid
power supply
system:
Only one PSU
is connected.
Device is in
failover.
Green
Flashing
Normal
operation.
Normal network connection is
stopping or normal network is
up and failover
is stopping.
Green Solid
On a single
power supply
system:
power is connected.
On a dual
power supply
system:
Redundant
power is connected.
Device is
halted.
Network is
connected.
INSTALLATION AND CONNECTION 15
Status LEDs (continued).
LED Condition
LED Off
Cellular
Interface
IOIO Any serial activ-
Cellular is not
in use.
Amber
Flashing
Cell is starting and signal is
below
threshold.
The LED
signal
threshold
config is set
to 50%.
Amber Solid
Cell is connected and
signal is
below
threshold. The
LED signal
threshold config is set to
50%.
Green
Flashing
Cell is starting
and signal is
above, or equal
to the
threshold.
ity is received,
on either console/usb console or device
serial ports.
Green Solid
Cell is connected and
signal is
above, or
equal to the
threshold.
Cloud /
Internet
Not implemented.
Note: The amber LED signal threshold config is set to 50%.of normal signal
strength.
For information on the setting of network and power alert thresholds, see:
"SNMP Alerts Networking (Connection Status)" on page60
"SNMP Alerts Power" on page58
INSTALLATION AND CONNECTION 16
Connecting to the Network
All Operations Manager products have two network connections labeled NET1 and
NET2. In the OM2200, there are options for copper wiring (on a standard RJ-45 con-
nector) and fiber (through a standard SFP module).
The network connections on the OM2200 are located on the serial port side of the
unit. Connect the provided shielded CAT5 cable to the NET1 to a computer or into
your network for initial configuration. By default NET1 and NET2 are enabled.
You can use either 10/100/1000BaseT over Cat5 or fiber-optical transceiver
(1Gbps) in the SFP slot for NET1 or NET2 on OM2200 (non-10G) and OM1208-8E.
INSTALLATION AND CONNECTION 17
Serial Connection
The serial connections feature RS-232 with software selectable pin outs (Cisco
straight –X2 or Cisco reversed –X1). Connect serial devices with the appropriate
STP cables.
INSTALLATION AND CONNECTION 18
Cellular Connectivity
The Operations Manager products offer an optional global cellular LTE interface
(models with -L suffix). The cellular interface is certified for global deployments with
most carriers and provides a CAT12 LTE interface supporting most frequencies in
use. To activate the cellular interface, you should contact your local cellular carrier
and activate a data plan associated to the SIM installed.
For -L models, attach the 4G cellular antennas to the unit’s SMA antenna sockets
on the power face (or to the extension RF cables) before powering on. Insert the
2FF SIM card on the power face with the contact facing up. Use the left SIM socket
first.
Installing A New SIM Card
Before installing a new SIM card, the OM device must first be powered down. This
can be done by switching off the power supply and waiting until the device has
shut-down. Install the new SIM card into its slot, then restart the device
Note: The device will not recognize the new SIM card unless a shut-down and
restart is performed. The new SIM card will be read during start-up.
INSTALLATION AND CONNECTION 19
Reset and Erase
CONFIGURE > System > Reboot
The OPERATIONS MANAGER reboots with all settings (e.g. the assigned network
IP address) preserved.
To reboot the unit:
Select CONFIGURE > System > Reboot.
To erase the unit:
Push the Erase button on the port-side panel twice with a bent paper clip while the
unit is powered on.
This resets the appliance to its factory default settings. Any modified configuration
information is erased. You will be prompted to log in and must enter the default
administration username and administration password (Username: root Password:
default). You will be required to change this password during the first log in.
INSTALLATION AND CONNECTION 20
Initial System Configuration
This section provides step-by-step instructions for the initial configuration of your
OPERATIONS MANAGER.
By default, all interfaces are enabled. The unit can be managed via WebGUI or by
command line interface (CLI).
l "Default Settings" on the next page
l "Management Console Connection via CLI" on page24
l "Change the Root Password" on page25
l "Disable a Root User" on page27
l "Change Network Settings" on page27
l For Configure Serial Ports (see "Serial Ports" on page41)
INITIAL SYSTEM CONFIGURATION 21
Default Settings
The OPERATIONS MANAGER comes configured with a default static IP Address
of 192.168.0.1 Subnet Mask 255.255.255.0.
The OM offers a WebGUI via web browser that supports HTML5.
1. Type https://192.168.0.1 in the address bar. HTTPS is enabled by default.
2. Enter the default username and password
Username: root
Password: default
3. After the first successful log-in you will be required to change the root pass-
word.
4. After log-in, the WebGUI is available. Check system details
5. After log-in the WebGUI is available. Check system details in the top right-
hand side of the WebGUI.
6. In the Navigation Bar on the left side, navigate to the ACCESS > Serial Ports
page. The Serial Ports page displays a list of all the serial devices, including
the links to a Web Terminal or SSH connection for each.
INITIAL SYSTEM CONFIGURATION 22
Using the WebUI
The WebUI can switched between Light or Dark mode by adjusting the toggle on
the bottom left.
Light mode changes the user interface to display mostly light colors. This is the
default UI setting. Dark mode changes the user interface to display mostly dark col-
ors, reducing the light emitted by device screens.
The WebUI has three menu options on the upper right: Help, System, and Log
out.
The Help menu contains a link to generate a Technical Support Reportt that can
be used by Opengear Support for troubleshooting. It also contains a link to the
latest Operations Manager User Manual.
The System menu presents the Current version, REST API version, Hostname,
Serial Number, Model, and Current user.
INITIAL SYSTEM CONFIGURATION 23
Management Console Connection via CLI
The Command Line Interface (CLI) is accessible using your preferred application to
establish an SSH session. Open a CLI terminal on your desktop, then:
1. Input the default IP Address of 192.168.0.1. SSH port 22 is enabled by
default.
2. When prompted, enter the log in and password in the CLI.
3. After a successful log in, you’ll see a command line prompt.
Accessing the WebGUI CLI Terminal
An alternative CLI terminal is provided within the WebGUI. To access this terminal,
in the left-hand side Navigation Bar, navigate to the ACCESS > Local Terminal
page. You will be required to submit your log-in credentials.
INITIAL SYSTEM CONFIGURATION 24
Change the Root Password
CONFIGURE > User Management > Local Users > Edit User
For security reasons, only the root user can initially log into the appliance. Upon ini-
tial log in the default password must be changed.
Tip: Other Users' passwords may be changed using the same procedure by
selecting the User's account name under the Username heading.
To change the password at any time:
1. Navigate to CONFIGURE > User Management > Local Users
2. Click the Root user's Edit User icon below the Actions heading.
INITIAL SYSTEM CONFIGURATION 25
3. In the Edit User page, if required, enter an optional description in the Descrip-
tion field. Enter a new password in the Password field and re-enter the pass-
word in the Confirm Password field.
4. Click Save User. A green banner confirms the password change has been
saved.
INITIAL SYSTEM CONFIGURATION 26
Disable a Root User
CONFIGURE > User management > Local Users
To disable a root user:
Note: Before proceeding, make sure that another user exists that has the
Administrator role or is in a group with the Administrator role. For information
on creating, editing, and deleting users, see "Local Users" on page96
1. Navigate to CONFIGURE > User management > Local Users
2. Click the Disable User button in the Actions section next to the root user.
3. Click Yes in the Confirmation dialog.
To enable root user, log in with another user that has the Administrator role and
click the Enable User button in the Actions section next to the root user.
.
Change Network Settings
CONFIGURE > Network Connections > Network Interfaces
The interface supports both IPv4 and IPv6 networks. The IP address of the unit can
be setup for Static or DHCP. The following settings can be configured for network
ports:
l IPv4, IPv6
l Static and/or DHCP
l Enabling or disabling network interfaces
l Ethernet Media types
To add a new connection:
INITIAL SYSTEM CONFIGURATION 27
1. Click CONFIGURE > Network Connections > Network Interfaces
2. Click the expand arrow to the right of the desired interface to view its details.
3. Click the plus icon to open the New Connection page.
INITIAL SYSTEM CONFIGURATION 28
4. Select the Interface and Connection Type for your new connection.
5. The form on the bottom part of the page will change based on the Con-
nection Type you choose. Enter the necessary information and click Apply.
To disable or delete interfaces, use the controls on the expanded section on
the CONFIGURE > Network Connections > Network Interfaces page.
Note: If you experience packet loss or poor network performance with the
default auto-negotiation setting, try changing the Ethernet Media settings on
the OPERATIONS MANAGER and the device it is connected to. In most cases,
select 100 megabits, full duplex. Make sure both sides are set identically.
To change the Ethernet Media Type:
1. Click CONFIGURE > Network Connections > Network Interfaces
2. Click the expand arrow to the right of the interface you wish to modify.
INITIAL SYSTEM CONFIGURATION 29
3. Click Enabled Automatic.
4. Change the Media Setting as needed and click Apply.
INITIAL SYSTEM CONFIGURATION 30
MONITOR Menu
The MONITORMenu is a relatively short section comprising only three topics.
System Log
l
Details of the system activity log, access and communications events
l
with the server and with attached serial, network and power devices.
LLDP/CDP Neighbors
l
Details of the LLDP/CDP Neighbors that are displayed when enabled
l
for a connection.
Triggered Playbooks
l
Monitoring current Playbooks, and applying filters to view any Play-
l
books that have been triggered.
MONITOR MENU 31
System Log
MONITOR > System Log
The OPERATIONS MANAGER maintains a log of system activity, access and com-
munications events with the server and with attached serial, network and power
devices.
To view the System Log, click MONITOR > System Log.
The System Log page lets you change the Number of Log Lines displayed on the
screen. The newest items appear on the bottom of the list. Click the Refresh button
on the bottom right to see the latest entries.
MONITOR MENU 32
LLDP CDP Neighbors
MONITOR > LLDP/CDP Neighbors
The OPERATIONS MANAGER displays LLDP/CDP Neighbors when enabled for a
connection. See CONFIGURE > SERVICES > Network Discovery Protocols to
enable/disable.
MONITOR MENU 33
Triggered Playbooks
MONITOR > Triggered Playbooks
For information on creating Playbooks, see Playbooks.
To monitor current Playbooks, click on Monitor > Playbooks. Choose the time
period if desired, and filter by Name of Playlist to view any that have been
triggered.
MONITOR MENU 34
ACCESS Menu
The ACCESS menu lets you access the OPERATIONS MANAGER via a built-in
Web Terminal. It also provides SSH and Web Terminal access to specific ports.
ACCESS MENU 35
Local Terminal
ACCESS > Local Terminal
The OPERATIONS MANAGER includes a web-based terminal. To access this
bash shell instance:
1. Select ACCESS > Local Terminal.
2. At the log in prompt, enter a username and press Return.
3. At the password prompt, enter a password and press Return.
4. A bash shell prompt appears.
This shell supports most standard bash commands and also supports copy-and-
paste to and from the terminal.
To close a terminal session, close the tab, or type exit in the Web Terminal window.
The session will timeout after 60 seconds.
ACCESS MENU 36
Access Serial Ports
ACCESS > Serial Ports
The ACCESS > Serial Ports page allows you to quickly locate and access specific
ports via Web Terminal or SSH. Click the expand arrow to the right of the port to
see these options.
Quick Search
To find a specific port by its port label, use the Quick Search form on the top of the
ACCESS > Serial Ports page. Ports are given default numbered labels. You can
set the port label for a given serial port under CONFIGURE > Serial Ports. Click
the edit button under Actions to open the EDIT SERIAL PORT page.
Access Using Web Terminal or SSH
To access the console port via the Web Terminal or SSH:
ACCESS MENU 37
1. Locate the particular port on the ACCESS > Serial Ports page and click the
expand arrow.
2. Click the Web Terminal or SSH link for the particular port.
l Choosing Web Terminal opens a new browser tab with the terminal.
l Choosing SSH opens an application you have previously associated with
SSH connections from your browser.
Note: Serial port logging is disabled by default. Control the logging level for
each serial port by changing Logging Settings in Configure > Serial Ports >
Edit page.
The log will appear via the Port Log link on the Serial Ports expanded page.
ACCESS MENU 38
ACCESS MENU 39
CONFIGURE Menu
This section provides step-by-step instructions for the menu items under the
CONFIGURE menu.
CONFIGURE MENU 40
Serial Ports
CONFIGURE > Serial Ports
Click CONFIGURE > Serial Ports. A list of serial ports appears.
This page lets you select serial ports and Autodiscover Selected ports.
You can Schedule Autodiscover by clicking the button. This opens a page that
allows you to select the ports and specify a time and period for port detection to
occur.
CONFIGURE MENU 41
From the Configure > Serial Ports page, click theEdit Serial Port button under
Actions next to the Serial Port you wish to configure. The Edit Serial Port page
opens.
CONFIGURE MENU 42
The Edit Serial Port page lets you configure the serial port’s:
l Label: This can be used to locate this port using the Quick Search form on
the ACCESS > Serial Ports page.
l Mode: Disabled or Console Server
l Pin out: X1 Cisco Rolled or X2 Cisco Straight
l Baud Rate: 50 to 230,400 bps
l Data Bits: 5, 6, 7, 8
l Parity: None, Odd, Even, Mark, Space
l Stop Bits: 1, 1.5, 2
CONFIGURE MENU 43
l Logging Levels
l Serial Port Aliases
CONFIGURE MENU 44
Local Management Consoles
CONFIGURE > Local Management Consoles
You can edit settings or disable the local RJ45 serial console (Cisco straight -X2
pinout) and the USB serial console (needs user supplied micro-USB to USB-A
cable).
To edit the settings of a local management console:
1. Click CONFIGURE > Local Management Consoles.
2. Click on the Edit Management Console Port button under Actions next to
the console you wish to disable.
CONFIGURE MENU 45
3. The Edit Local Management Console page lets you control:
l Baud Rate
l Data Bits
l Parity
l Stop Bits
l Terminal Emulation
l Enable or disable Kernel Debug Messages
l Enable or disable the selected Management Console
Note: Enabling Kernel Debug Messages can only be applied to a single
serial management console.
To disable a local management console, click CONFIGURE > Local Management
Consoles. Click on the Disable Management Console Port button under Actions
next to the console you wish to disable.
CONFIGURE MENU 46
Lighthouse Enrollment
CONFIGURE > Lighthouse Enrollment
Opengear appliances can be enrolled into a Lighthouse instance, providing cent-
ralized access to console ports, NetOps Automation, and central configuration of
Opengear devices.
To enroll your OPERATIONS MANAGER to a Lighthouse instance, you must have
Lighthouse installed and have an enrollment token set in Lighthouse.
To set an enrollment token in Lighthouse, click on CONFIGURE >
NODEENROLLMENT > Enrollment Settings page, and enter an Enrollment
Token.
To enroll your OPERATIONS MANAGER in this Lighthouse instance:
1. Click CONFIGURE > Lighthouse Enrollment.
CONFIGURE MENU 47
2. Click on the Add Lighthouse Enrollment button on the bottom right. The
New Lighthouse Enrollment page opens.
3. Enter the IP address or fully qualified domain name of the Lighthouse
instance and the Enrollment Token you created in Lighthouse. Optionally
enter a Port and an Enrollment Bundle (see the Lighthouse User Guide for
more information).
4. Click Apply.
Note: Enrollment can also be done directly via Lighthouse using the Add Node
function. See the Lighthouse User Guide for more instructions on enrolling
Opengear devices into Lighthouse.
CONFIGURE MENU 48
Playbooks
CONFIGURE > Playbooks
Playbooks are configurable systems that periodically check if a Trigger condition
has been met. They can be configured to perform a one or more specified
Reaction. To create a new Playbook, select Configure > Playbooks.
Click the Plus button to create a new Playbook.
CONFIGURE MENU 49
1. Enter a Name for the Playbook.
2. Add a Description.
3. Select Enabled to activate the Playbook after you have created it.
4. Enter an Interval in seconds to control the frequency that the Trigger will be checked.
5. Choose the type of Trigger to use from the Trigger Type drop down.
6. In the Reaction section, click the Plus and click on specific Reactions for this Play-
book.
CONFIGURE MENU 50
Clicking on each Reaction opens a custom screen to provide necessary inform-
ation. When you are finished, click Apply.
After you have created Playbooks, you can Edit orDelete them from the Configure
> Playbooks page.
To monitor current Playbooks, click on Monitor > Playbooks. Choose the time
period if desired and filter by Name of Playlist to view any that have been
triggered.
CONFIGURE MENU 51
PDUs
CONFIGURE > PDUs
One or more Power Distribution Units (PDUs), both Local and Remote can be mon-
itored. To add information for a PDU, select Configure > PDUs.
Click the Plus button to configure a new PDU.
CONFIGURE MENU 52
1. Enter a Label for this PDU.
2. Select the Monitor checkbox.
3. Choose Local or Remote.
4. Select the appropriate Driver from the drop-down list.
5. Select the Port.
6. Add a Description.
7. Under Access Settings, enter a Username and Password to use when connecting to
the device.
8. When you are finished, click Apply.
After you have created PDUs, you can Edit orDelete them from the Configure >
PDUs page.
CONFIGURE MENU 53
SNMP Alerts
CONFIGURE > SNMP Alerts > System/Power/Networking
Tip: For more detailed information about configuring SNMP Alerts see the indi-
vidual topic pages that follow.
On the CONFIGURE > SNMP Alerts page; SNMP Alert Managers can be added or
deleted under SNMP > SNMP Alert Managers, for the following:
l System: Covers notification for the following causes.
l Authentication: Notifies when a user attempts to log in via SSH, REST
API, Web UI, or the device's serial ports. An alert is sent regardless of
whether the log in has succeeded or failed.
l Configuration: For changes that occur to the system configuration.
l System Temperature: When temperature SNMP alerts are enabled, net-
work operators are immediately notified should the system begin oper-
ating outside user-defined tolerances.
l Power: When voltage SNMP alerts are enabled, network operators are imme-
diately notified should the PSU begin operating outside design tolerances.
See "SNMP Alerts Power" on page58 for further information.
l Networking (Cell Signal Strength): Be notified when cell signal strength
leaves or re-enters the selected range, or when the network link state
changes. A slider adjusts the upper and lower signal strength.
Tip: Manage the SNMP settings on the CONFIGURE > SNMP > SNMP Alert
Managers page.
CONFIGURE MENU 54
SNMP Alerts System - Temperature, Authentication, Configuration
Temperature
CONFIGURE > SNMP Alerts > System > System Temperature
It is essential to ensure that the system is operating within its design temperature
as premature aging of the component can occur if the device is excessively hot dur-
ing operation. This can lead to component failure and ultimately result in RMA.
When temperature SNMP alerts are enabled (Alerting), network operators are imme-
diately notified (subject to network connectivity and latency) should the PSU begin
operating outside user-defined temperature tolerances.
System generated SNMP Alerts send SNMP traps to a remote SNMP manager
which alerts the user of temperature events.
Tip: The OM device can send network, power and system events to the remote
SNMP manager.
Configure SNMP System Temperature Alerts
Configure > SNMP Alerts > System > System Temperature
The System Temperature Range alert reports the system temperature (measured at
System Temperature 1 and System Temperature 2 sensors) and sends an alert
when the system temperature leaves or enters the user-configured temperature
range.
CONFIGURE MENU 55
Navigate to Configure > SNMP Alerts > System > System Temperature.
1.
Click on the Alerting button to activate the function, this also activates the
2.
user-defined range sliders.
Note: The Not Alerting button de-activates the function and temperature
alerts will be stopped until activated again.
Click+Drag the temperature range limiters to the required upper and lower lim-
3.
its.
Click Apply. The Details Saved banner confirms your settings.
4.
In this image, if any temperature sensor reports the system temperature (measured
at System Temperature 1 and System Temperature 2 sensors) to be less than 50
degrees C or greater than 99 degrees C, an SNMP alert will be triggered.
Tip: The temperature display is automatically converted to Fahrenheit.
CONFIGURE MENU 56
Authentication
CONFIGURE > SNMP Alerts > System > Authentication
Notifies when a user attempts to log in via SSH, REST API, or the device's serial
ports. An alert is sent regardless of whether the log in has succeeded or failed.
Navigate to Configure > SNMP Alerts > System > Authentication.
1.
Click on the Alerting button to activate the function.
2.
Click Apply. The Details Saved banner confirms your settings.
3.
Configuration
CONFIGURE > SNMP Alerts > System > Configuration
Notifies of changes that occur to the system configuration.
Navigate to Configure > SNMP Alerts > System > Configuration.
1.
Click on the Alerting button to activate the function.
2.
Click Apply. The Details Saved banner confirms your settings.
3.
CONFIGURE MENU 57
SNMP Alerts Power
Configure > SNMP Alerts > Power > Voltage
The PSU is one of the most critical part of the OM device so it is essential to ensure
that the PSU is operating within its design tolerances.
When voltage SNMP alerts are enabled, network operators are immediately noti-
fied of PSU failures (subject to network connectivity and latency). Should the PSU
begin operating outside design tolerances, PSU-related SNMP Alerts will trigger an
alert for the following conditions:
Output DC voltage of both PSUs
l
If the voltage drops too low, it risks the device going into brown-out state. If it
gets too high, it can damage components.
System generated SNMP Alerts send SNMP traps to a remote SNMP manager
which alerts the user of system events. The OM device can send network, power
and system events to the remote SNMP manager.
Tip: The OM device can send network, power and system events to the remote
SNMP manager.
Configure Power Alerts
Configure > SNMP Alerts > Power > Voltage
The alert related to this functionality is the System Voltage Range alert which
sends an alert when the system reboots or the voltage on either power supply
leaves or enters the user-configured voltage range.
CONFIGURE MENU 58
Navigate to Configure > SNMP Alerts > Power > Voltage.
1.
Click on the Alerting button to activate the function, this also activates the
2.
user-defined range sliders.
Note: The Not Alerting button de-activates the function and power alerts
will be stopped until activated again
Click+Drag the voltage range limiters to the required upper and lower limits.
3.
Click Apply. The Details Saved banner confirms your settings.
4.
In the above image, if any power supply fails, is disconnected or some other power
anomaly occurs which causes the voltage to drop below 11V or above 13V, an
SNMP alert will be triggered.
Warning: The recommended safety settings are 11.4 ~ 12.6 volts.
When an event occurs that causes the voltage range on any power supply to re-
enter the configured voltage range, it will cause an SNMP alert to be triggered.
CONFIGURE MENU 59
SNMP Alerts Networking (Connection Status)
Configure > SNMP Alerts > Networking > Network Connection Status
The alert related to this functionality is the Network Connection Status which sends
an alert when cell signal strength leaves or re-enters a user-defined range, or,
when the network link state changes. A slider adjusts the upper and lower signal
strength limits.
Configure Signal Strength Alerts
Configure > SNMP Alerts > Networking > Network Connection Status
To set the Network Connection Status signal strength boundaries:
Navigate to Configure > SNMP Alerts > Network Connection Status > Signal
1.
Strength page.
Click on the Alerting button to activate the function, this also activates the
2.
user-defined range sliders.
Click+Drag the signal strength range limiters to the required upper and lower
3.
limits.
Note: The Not Alerting button de-activates the function and signal
strength alerts will be stopped until activated again.
CONFIGURE MENU 60
Click Apply. The Details Saved banner confirms your settings.
4.
In the above image, if any anomaly occurs that causes the signal strength to drop
below 33 or above 66, an SNMP alert will be triggered.
When an event occurs that causes the signal strength to re-enter the user-defined
range, an SNMP alert will be triggered.
CONFIGURE MENU 61
Network Connections
CONFIGURE > NETWORK CONNECTIONS
The Network Connections menu contains the Network Interfaces and IPsec Tun-
nels settings.
CONFIGURE MENU 62
Network Interfaces
CONFIGURE > NETWORK CONNECTIONS > Network Interfaces
The interface supports both IPv4 and IPv6 networks. The IP address of the unit can
be setup for Static or DHCP. The following settings can be configured for network
ports:
l IPv4, IPv6
l Static and/or DHCP
l Enabling or disabling network interfaces
l Ethernet Media types
For detailed information about Network Interface configuration and adding a new
connection, see "Change Network Settings" on page27.
CONFIGURE MENU 63
Dual SIM
CONFIGURE > NETWORK CONNECTIONS> Network Interfaces > Cellular Inter-
face (LTE)
Operations Manager has been available for some time with support for two SIM
cards/slots, whereby, it is possible designate which SIM slot is the Active SIM that
is normally used by the device for OOB communications (in Automatic failover
mode this SIM is termed the Primary SIM). The secondary SIM is used as a failover
SIM. This feature increases the reliability of the OOB solution by providing redund-
ant Out-Of-Band access over a cellular connection.
Note: The terminology changes when SIM Failover policy is switched from
Manual to Automatic. In Manual failover mode the active SIM is designated
ACTIVE, whereas in Automatic failover mode the active SIM is designated
PRIMARY.
With the Dual SIM feature activated, in the event of a failure of OOB com-
munications through the Active SIM, it is possible to manually de-select the failed
SIM and activate the secondary SIM by making it the Active SIM. This changeover
allows OOB communications to resume through the newly designated Active SIM.
Display SIM Status and Signal Strength
Note: For information about configuring the Signal Strength Thresholds see:
"SNMP Alerts" on page54
1. Navigate to Configure > Network Connections > Network Interfaces.
2. Click on the Cellular Interface (LTE) row.
CONFIGURE MENU 64
3.
.
The information bar expands, and the page shows the current status of the active and
inactive SIM cards.
Note: If the unit does not have a cell modem (-L) then the cellular inter-
face will not be visible.
4. The active SIM indicates the color of the signal strength based upon the selected
thresholds in Configure → SNMP Alerts under the Networking Signal Strength
Alert.
The signal bar color (not the number of bars) indicates signal strength:
l Green if signal is above the higher threshold.
l Orange if signal is between lower and higher threshold.
l Red if signal is below the lower threshold,
l Grey for 0 or not active,
CONFIGURE MENU 65
5. Click the Refresh button to display the current signal strength of the active SIM.
Note: When the Refresh button is clicked the signal strength is only updated
for the active SIM. If you would like to know what the other SIM Signal Strength
is, you need to activate it, let the modem come back online, which may take 3
minutes or more.
Installing A New SIM Card
Before installing a new SIM card, the OM device must first be powered down. This
can be done by switching off the power supply and waiting until the device has
shut-down. Install the new SIM card into its slot, then restart the device
Note: The device will not recognize the new SIM card unless a shut-down and
restart is performed. The new SIM card will be read during start-up.
CONFIGURE MENU 66
Select The Active SIM (Manual Failover Mode)
Switching the active SIM must be done manually. To switch the Active SIM:
1. Navigate to CONFIGURE > NETWORKCONNECTIONS > Network Interfaces >
Cellular Interface (LTE.
2. Click the Settings cog , this will display the MANAGE CELLULAR INTERFACE
(LTE) page and the current status of both SIM slots, including the current carrier name.
3. On the right, select the Make Active button of the new, active SIM and apply the
change by selecting Confirm.
4. A pop-up alert states that this operation will take a few minutes to complete. Click Yes
to confirm the change.
Note: During the change-over the current IP address is hidden and then
returned when the modem re-connects.
5. If you require, you can monitor the interface during the changeover via the CLI with the
command:.
watch ip address show dev wwan0
CONFIGURE MENU 67
You can also set the SIM settings by expanding the menu for each SIM to set the
APN.
If no SIM is inserted you can still select a SIM slot. If you insert a SIM it will not
force it to become the active SIM.
Select The Primary SIM (Automatic Failover Mode)
Switching the primary SIM must be done manually. To switch the Primary SIM:
1. Navigate to CONFIGURE > NETWORKCONNECTIONS > Network Interfaces >
Cellular Interface (LTE.
2. Click the Editicon, this will display the MANAGE CELLULAR INTERFACE (LTE)
page and the current status of both SIM slots.
3. Ensure the cellular interface is enabled by clicking the Enabled button.
CONFIGURE MENU 68
4. Under Cellular SIM Failover click the Automatic button, this will display the Primary
selection buttons.
5. Click the Primary button of the SIM selected to be the primary SIM.
6. Click the Confirm button at the bottom of the page. A green banner will appear to con-
firm that the new settings have been saved.
CONFIGURE MENU 69
Dual SIM Automatic Failover
CONFIGURE > NETWORK CONNECTIONS> Network Interfaces > Cellular Inter-
face (LTE)
Devices that carry two SIM cards can be configured so that either SIM card slot may
be activated. In Automatic failover mode, either of the two SIM cards may be des-
ignated as the Primary SIM. (see "Dual SIM" on page64).
Dual SIM Automatic Failover works seamlessly with the existing failover solution to
provide another layer of redundancy. This feature allows the software to detect a
failure in OOB communications via the Primary SIM and will automatically failover
to the Secondary SIM without the need for manual operator intervention.
Options within the configuration also allow you to configure the failback settings
from Secondary SIM, back to the previous Primary SIM when OOB communications
have been restored. See "Cellular Interface Policy Settings" on page74.
Note: The terminology changes when SIM Failover policy is switched from
Manual to Automatic. In Manual mode the active SIM is designated ACTIVE,
whereas in Automatic failover mode the active SIM is designated PRIMARY.
See the image on the following page for a depiction of Primary and Secondary SIM
card slots.
CONFIGURE MENU 70
Either of the SIM card slots can be designated as the Primary SIM. In the following
image, SIM card 1 has been designated as the Primary SIM and is currently the act-
ive SIM, while SIM card 2 is designated as the Secondary SIM which, (in the scen-
ario below), is only activated in the event of an automatic failover such as occurs
during an OOB communications failure on the Primary SIM.
CONFIGURE MENU 71
Failover Modes
Features of Automatic Failover include:
Select either Manual or Automatic SIM failover.
l
Specify SIM failback policy (applicable when the Ethernet connection and
l
primary SIM are both down):
Upon disconnect - See the table "Cellular Interface Policy Settings" on
l
page74 for an explanation of the policy.
After a Delay (specified in minutes) - The device switches back to
l
primary after a pre-defined time has elapsed.
Never - The device never switches back to the Primary.
l
SIM failover settings allow you to configure the parameters that affect cellular
l
data usage, for example, quicker failover (consumes more data) vs less fre-
quent tests (consumes less data). The configuration preferences include
Ping test for failover from Primary to Secondary and failback from Sec-
l
ondary to Primary.
Failover settings are per SIM slot and consist of a failover and failback
l
ping test.
Automatic Failover functions in both dormant and non-dormant mode.
l
CONFIGURE MENU 72
Activate or Configure Automatic Failover
CONFIGURE > NETWORK CONNECTIONS> Network Interfaces > Cellular Inter-
face (LTE) > Manage Cellular Interface (LTE)
Navigate to the Cellular Interface page at: CONFIGURE > NETWORK
1.
CONNECTIONS> Network Interfaces > Cellular Interface (LTE).
Click the Edit link next to the Cellular Interface Enabled/Disabled switch.
2.
In the Manage Cellular Interface page, select the Automatic failover option.
3.
Ensure the correct SIM card is selected as the Primary SIM (see 'Set Primary
4.
SIM' in "Dual SIM" on page64).
Complete the Cellular Interface options in accordance with the table below.
5.
Click Confirm to activate the failover policy settings, a green banner will con-
6.
firm the settings are enabled.
CONFIGURE MENU 73
Cellular Interface Policy Settings
MANAGE CELLULAR INTERFACE (LTE) Properties
Field Definition
CELLULAR SIM FAILOVER
Manual/Automatic.
-
Primary SIM Failover
Failover Probe Address. Network address to probe in order to determine if
Test interval (seconds). The number of seconds between connectivity
Pings per test. The maximum number of times a single ping
Consecutive test failures
before failover.
Automatically switch between the Primary SIM
Card and the secondary SIM Card on disconnection.
connection is active.
Note:
addresses and hostnames.
probe tests.
packet is sent per probe before considering the
probe failed.
The number of times a probe must fail before the
connection is considered failed.
The probe address accepts IPv4, IPv6
Failback Policy
Never / Delayed / On Disconnect.
Never No Failback recovery is attempted.
Delayed Attempted failback afternminutes. The number of
CONFIGURE MENU 74
Select the policy to be used to determine Failback
recovery from the Secondary SIM Card back to the
Primary SIM Card.
minutes after failover to the secondary SIM Card
that the connection should failback to the Primary
SIM Card.
On Disconnect Secondary SIM Failback
Failback Probe Address
ie. The Network address to probe in order to
determine if the connection is active.
Test Interval
The number of seconds between connectivity
probe tests (this not the same thing as Attempted
Failback).
Pings per Test
The maximum number of times a single ping
packet is sent per probe before considering the
probe failed.
Consecutive Test Failures (before failover)
The number of times a probe must fail before the
connection is considered failed.
CONFIGURE MENU 75
Network Aggregates - Bonds and Bridges
CONFIGURE > NETWORK CONNECTIONS > Network Interfaces > Select the tar-
get interface
The Network Aggregates feature allows you to create or edit bridges that contain
any type of interface or other config options which are included in a bridge or bond
after it is created, without having to delete the bridge or bond and start over. Such
changes can be made remotely without organizing a site visit.. The supported con-
figuration options for bonds and bridges are discussed in the Bridge and Bond
Definitions tables later in this topic.
This also includes other settings on bonds, such as the mode or poll interval.
Note: Editing the primary interface will not update its connections.
Operations Manager models with an integrated switch (OM1204-4E, OM1208-8E
and OM2224-24E) have a bridge configured by default that includes all of the
switch ports, which can be edited or deleted as required.
Definitions of the bridge details as in the Bridge Form Definitions table below.
Create A New Bridge
Note: Whether creating a new bridge or editing an existing bridge the page is
very similar.
To create a new bridge:
1. Navigate to the Configure > Network Connections > Network Interfaces page on
the Web UI.
2. Click on the New Bridge button that is located at the top-right of the window.
CONFIGURE MENU 76
3. Select which interface will serve as the primary interface for the new bridge.
Note: When the primary interface is selected, its MAC address is dis-
played in the MAC address field. This MAC address is inherited by the
new bridge interface.
4. Complete the new bridge details form as in the Bridge Form Definitions definitions
table below.
5. Click the Create button to finalize the creation of the new bridge.
Edit an Existing Bridge
To edit an existing bridge:
1. Navigate to the Configure > Network Connections > Network Interfaces page on
the Web UI.
2. Click on the bridge that you would like to edit, the bridge details are expanded.
Click on the bridge Edit button that is located next to the Enable / Disable
3.
toggle buttons.
4. Select which interface will serve as the primary interface for the new bridge.
5. Change the bridge details as required in accordance with the Bridge Form Defin-
itions table below.
6. Click the Update button to finalize the edit process. Updating the bridge will temporarily
interrupt network activity on this interface.
CONFIGURE MENU 77
Edit Bridge Form Definitions
New Bridge
Field
Definition
Description The editable
tion of the interface. If the description field is not completed
the field will default to a computed value to describe the interface.
Enable Spanning
Spanning Tree Protocol allows Operation Manager devices
Tree Protocol?
to:
l Discover and eliminate any unexpected networks
loops so that there is no broadcast radiation and the
network stays healthy and reliable
l Be able to function with redundant links (intentional
network loops) to increase the networks reliability and
fault tolerance
Description
field allows you to add a descrip-
Network Interface
Selection
Click the check box of each network interface you want to
include in the bridge.
Primary Interface Select the interface that is to be used for selecting the MAC
address of the aggregate. The new bond inherits the MAC
address of the primary interface. On creation, any Network
Connections which exist on the Primary Interface will be
attached to the Bond/Bridge after it is initially created. When a
Bond/Bridge is deleted, any Network Connections which exist
on the aggregate interface are handed over to the Primary
Interface.
Inherited
Connections
When the Primary Interface is selected, the connections inherited by the new bridge are listed here.
Click to edit the details of an existing interface.
CONFIGURE MENU 78
Create A New Bond
Note: Whether creating a new bond or editing an existing bond the page is
very similar.
To create a new bond:
1. Navigate to the Configure > Network Connections > Network Interfaces page on
the Web UI.
2. Click on the New Bond button that is located at the top-right of the window.
3. Select which interface will serve as the primary interface for the new bond.
Note: When the primary interface is selected, its MAC address is dis-
played in the MAC address field. This MAC address is inherited by the
new bond interface.
4. Complete the new bond details form as in the Bond Form Definitions definitions
table below.
5. Click the Create button to finalize the creation of the new bond. Network connections
from non-primary interfaces will be deleted when the new bond is created.
Edit an Existing Bond
To edit an existing bond:
1. Navigate to the Configure > Network Connections > Network Interfaces page on
the Web UI.
2. Click on the bond that you would like to edit, the bond details are expanded.
Click on the bond Edit button that is located next to the Enable / Disable
3.
toggle buttons.
CONFIGURE MENU 79
4. Change the bond details as required in accordance with the Edit Bond Form Defin-
itions table below.
5. Click the Update button to finalize the edit process. Updating the bond will temporarily
interrupt network activity on this interface.
Edit Bond Form Definitions
New Bond Field Definition
Description The editable
tion of the interface. If the description field is not completed
the field will default to a computed value to describe the interface.
Mode
The mode determines the way in which traffic sent out via the
bonded interface is dispersed over the real interfaces. Available modes are:
Round Robin Balancing - Packets are sequentially trans-
mitted/received through each interfaces one by one.
Active Backup
during a failover, the bond interface’s MAC address is then
changed to match the new active secondary’s MAC address.
XOR Balancing
packets between the Ethernet interfaces, using the same one
for each specific destination when possible.
Description
field allows you to add a descrip-
- If the active secondary interface is changed
- Balances traffic by splitting up outgoing
Broadcast
- All network transmissions are sent on all sec-
ondary interfaces. This mode provides fault tolerance.
802.3ad (Dynamic Link Aggregation)
- Aggregated NICs
act as one NIC, but also provides failover in the case that a
NIC fails. Dynamic Link Aggregation requires a switch that
supports IEEE 802.3ad.
CONFIGURE MENU 80
Transmit Load Balancing
- Outgoing traffic is distributed
depending on the current load on each secondary interface.
Incoming traffic is received by the current secondary interface. If the receiving secondary fails, another secondary
takes over the MAC address of the failed secondary.
Adaptive Load Balancing
- Includes transmit load balancing (tlb) and receive load balancing (rlb) for IPv4 traffic
and does not require any special switch support.
Poll Interval The poll interval specifies the MII link monitoring frequency in
milliseconds. This determines how often the link state of each
secondary is inspected for link failures. A value of zero disables MII link monitoring.
Network Interface
Selection
Click the check box of each network interface you want to
include in the bridge.
Primary Interface Select the interface that is to be used for selecting the MAC
address of the aggregate. The new bond inherits the MAC
address of the primary interface. On creation, any Network
Connections which exist on the Primary Interface will be
attached to the Bond/Bridge after it is initially created. When a
Bond/Bridge is deleted, any Network Connections which exist
on the aggregate interface are handed over to the Primary
Interface.
Active
Connections
When the Primary Interface is created, the connections inherited by the new bond are listed here. When edited, Active Connections on the aggregate will not be updated if the primary
interface is changed.
Click to edit the details of an existing interface. Updating a
bridge will temporarily interrupt network activity on the interface when you click the
CONFIGURE MENU 81
Update
button.
Spanning Tree Protocol
CONFIGURE > NETWORK CONNECTIONS > Network Interfaces > Select the tar-
get interface
Spanning Tree Protocol (STP) allows Operation Manager devices to discover and
eliminate loops in network bridge links, preventing broadcast radiation and allow-
ing redundancy.
When STP is implemented on switches to monitor the network topology, every link
between switches, and in particular redundant links, are cataloged. The spanning-
tree algorithm blocks forwarding on redundant links by setting up one preferred link
between switches in the LAN. This preferred link is used for all Ethernet frames
unless it fails, in which case a non-preferred redundant link is enabled.
Note: STP Limitations
If multiple bridges are created on the same switch they should not be used on
the same network segment as they have the same MAC addresses, therefore
STP will likely not work correctly as they will have the same bridge id.
Rapid Spanning Tree Protocol (RSTP), Multiple Spanning Tree Protocol
(MSTP) and other proprietary protocols are not supported.
The bridge settings relating to STP cannot be changed from the default values
shown below:
group_address
forward_delay (default is 15)
hello_time (default is 2)
max_age (default is 20)
priority (default is 32768 (0x8000))
CONFIGURE MENU 82
Enable STP in a Bridge
To enable STP you can use the UI or CLI. The procedures are:
Bridge With STPEnabled - UI
CONFIGURE > NETWORK CONNECTIONS > Network Interfaces > Select the tar-
get interface > New Bridge page
1. In the Network Interfaces page, click the Create New Bridge button.
2. Click to select the Enable Spanning Tree Protocol option.
Bridge With STPEnabled - OGCLI
admin@om2248:~# ogcli get physif system_net_physifs-5
bridge_setting.id="system_net_physifs-5"
bridge_setting.stp_enabled=true
description="Bridge"
device="br0"
enabled=true
id="system_net_physifs-5"
media="bridge"
name="init_br0"
slaves[0]="net2.3"
CONFIGURE MENU 83
Bridge With STPDisabled - OGCLI
admin@om2248:~# ogcli update physif system_net_physifs-5
bridge_setting.stp_enabled=false
bridge_setting.id="system_net_physifs-5"
bridge_setting.stp_enabled=false
description="Bridge"
device="br0"
enabled=true
id="system_net_physifs-5"
media="bridge"
name="init_br0"
slaves[0]="net2.3"
CONFIGURE MENU 84
IPsec Tunnels
CONFIGURE > NETWORK CONNECTIONS > IPsec Tunnels
On the IPsec Tunnels page, you can create, edit, and delete IPsec tunnels.
To create an IPsec tunnel:
1. Click CONFIGURE > NETWORK CONNECTIONS > IPsec Tunnels.
2. Click CREATE TUNNEL. This opens the EDIT IPSEC TUNNEL page.
CONFIGURE MENU 85
3. In the top section of the page, TUNNEL CONFIGURATION, click the
Enabled check box and give your new tunnel a name.
4. Select an IKE Protocol Version to use for exchanging keys. IKEv1 provides
two modes: Main and Aggressive. When using IKEv1, Main Mode is recom-
mended. Aggressive Mode is considered less secure because the hash of the
pre-shared key is exchanged unprotected.
5. Select a Cipher Suite Proposal. This is a set of algorithms used for nego-
tiation when attempting to establish the IPsec tunnel. By default, the device
will attempt to negotiate the tunnel using a list of common algorithms which
are considered safe. Alternatively, a set of default proposals that guarantee
Perfect Forward Secrecy (PFS) can be selected.
6. Click the Initiate checkbox to actively initiate the tunnel by sending IKE nego-
tiation packets to the remote end.
CONFIGURE MENU 86
7. Enter an Outer Local Address, a local IP address to use as the source
address of the tunnel
8. Enter an Outer Remote Address, the IP address or hostname of the remote
end of the tunnel.
9. Scroll down to the Traffic Selectors section of the page.
10. Enter a Local Subnet and Remote Subnet.
11. Scroll down to the third section, AUTHENTICATION.
CONFIGURE MENU 87
12. Enter a PSK Shared Secret.
13. Enter a Local ID and Remote ID.
14. Click Save. The new tunnel is now listed on the CONFIGURE > NETWORK
CONNECTIONS > IPsec Tunnels page.
CONFIGURE MENU 88
Network Resilience
CONFIGURE > NETWORK RESILIENCE >
Under the NETWORK RESILIENCE menu, you can manage Out-of-Band (OOB)
and IP Passthrough settings.
CONFIGURE MENU 89
OOB Failover
CONFIGURE >NETWORKRESILIENCE>OOB Failover
To manage Out-of-Band failover, click CONFIGURE
>NETWORKRESILIENCE>OOB Failover:
CONFIGURE MENU 90
IP Passthrough
CONFIGURE > NETWORK RESILIENCE > IP Passthrough
To manage IP Passthrough settings clickCONFIGURE
>NETWORKRESILIENCE>OOB Failover:
CONFIGURE MENU 91
User Management
CONFIGURE > USER MANAGEMENT
Under the User Management menu, you can create, edit, and delete groups and
users, as well as assign users to groups. You can also set up remote user authen-
tication.
CONFIGURE MENU 92
Groups
CONFIGURE > USERMANAGEMENT > Groups
To create a new group:
1. Select CONFIGURE > USERMANAGEMENT > Groups.
2. Click the Plus button. The NEWGROUP page opens.
CONFIGURE MENU 93
3. Enter a Group Name, Description, and select a Role for the group.
4. Choosing the Console User role allows you to select specific ports this group
will be able to access.
CONFIGURE MENU 94
5. Click the Group Enabled checkbox to enable the group. After creation,
groups can also be enabled or disabled from the CONFIGURE >
USERMANAGEMENT > Groups page.
6. Click Save Group.
Note: Group Name is case sensitive. It can contain numbers and some alpha-
numeric characters. When using remote authentication, characters from a
user's remote groups that are not allowed are converted to underscores during
authentication. Local groups can be created that take that into account, allow-
ing the authentication to continue.
If the Role selected is Administrator, members of the group have full access to
and control of all managed devices, full system configuration privileges, and full
access to the command line shell.
To modify an existing group:
1. Select CONFIGURE > USERMANAGEMENT > Groups.
2. Click Edit in the Actions section of the group to be modified and make
desired changes.
3. Click Save Group.
The CONFIGURE > User Management > Groups page also allows administrators
to delete a group. Users who were members of the deleted group lose any access
and administrative rights inherited from the group.
Note: The netgrp group is inherited as the primary group for all remote AAA
users who are not defined locally. By default, netgrp has the Administrator role
and is disabled. It must be enabled to take effect for remote AAA users.
CONFIGURE MENU 95
Local Users
CONFIGURE > USERMANAGEMENT > Local Users
To create a new user:
1. Navigate to the CONFIGURE > USERMANAGEMENT > Local Users tab.
2. Click the + button. The New User dialog appears.
CONFIGURE MENU 96
3. Enter a Username, Description, and Password.
4. Re-enter the Password in the Confirm Password field.
5. Select the Enabled checkbox.
6. Click Apply.
To create a new user without password which causes them to fall back to remote
authentication:
1. Select CONFIGURE > User Management > Remote Authentication
2. Select a Scheme.
3. Enter Settings and click Apply.
4. Select CONFIGURE > USERMANAGEMENT > Local Users
5. Click the + button. The New User dialog loads.
6. Enter a Username, Description.
7. Select the Remote PasswordOnly checkbox.
CONFIGURE MENU 97
8. Select the Enabled checkbox.
9. Click Apply.
To modify an existing user:
1. Select CONFIGURE > USERMANAGEMENT > Local Users
2. Click the Edit User button in the Actions section next to the user to be mod-
ified and make desired changes.
3. Click Save User.
The Edit Users dialog allows the user’s Description to be changed, Group Mem-
berships modified, and the user’s Password to be reset. The username cannot be
changed. To disable a user, uncheck the Enabled checkbox.
Disabled users cannot log in to the OPERATIONS MANAGER using either the
Web-based interface or via shell-based logins.
To manage SSH authorized keys for a user:
CONFIGURE MENU 98
1. Select CONFIGURE > USERMANAGEMENT > Local Users
2. Click the Manage SSH Authorized Keys button in the Actions section next
to the user.
3. Click the Plus button to add a new key. This opens the NEW AUTHORIZED
KEY page for this user.
4. Enter the key and click Apply. You can also click on Add Authorized Key
and disable password for SSH for this user from this page.
5. To delete a key, click CONFIGURE > USER MANAGEMENT > Local Users
and click the Authorized Key button for the user.
CONFIGURE MENU 99
6. Click the Delete button next to the key you wish to remove.
To delete a user:
1. Select CONFIGURE > USERMANAGEMENT > Local Users
2. Click the Delete User button in the Actions section next to the user to be
deleted.
3. Click Yes in the Confirmation dialog.
CONFIGURE MENU 100
Loading...