Security

For example, Joe may be the NOC expert on xDSL modems, but he may be a relative ATM novice. Helen, on the other hand, may be the ATM expert but she may know very little about the intricacies of xDSL technologies. With Cisco EMF Access Control, the systems administrator is able to ensure Joe has read/write access to all xDSL network elements for configuration and test purposes, while Helen can only view the status information for these elements. Helen, on the other hand, can reconfigure ATM equipment, whereas Joe is refused access to the Element Manager windows which permit such reconfiguration.

Refer to the Cisco Element Management Framework User Guide for further information on the Cisco EMF Access Manager application.

This example describes how to:

• Create a new access specification (called SCM_PTA_Provisioning) that includes the feature lists that enables a user to deploy a PTA-MD service instance, configure the PTA-MD service instance, create and configure a subscriber, and then connect or disconnect the subscriber to the PTA-MD service instance

Note   Access specifications ensure that users are restricted to only carry out the tasks that they are permitted to do (by the selected feature lists). This example does not allow the user to create a PTA-MD service profile, this task is restricted to users with a higher security level.

• Create a new Cisco 6400 SCM User Group with SCM_PTA_Provisioning

• Create a new User who can deploy a PTA-MD service instance, configure the PTA-MD service instance, create and configure a subscriber, and then connect or disconnect the subscriber to the PTA-MD service instance

Step 3   Enter a name for the new access specification to be created.

Note   A valid name must have at least five characters with no spaces. You can use the Tab key to move between fields.

Step 4   Click Forward. The Copy from Existing Access Spec window appears:

Note   You are now required to select settings for the new access specification. You can copy settings from a previously created specification and edit the specification (refer to the Cisco Element Management Framework User Guide) or create a new specification without copying settings from an existing access specifications. In this example we will create a new specification without copying settings from an existing access specifications.

Step 5   Click No.

Step 6   Click Forward. The Select Permission window appears:

Step 7   Select a permission level from Read Only, Read Write, or Read Write Admin.

Step 8   Click Forward. The Select User Groups window appears.

Step 9   Select the user group that you wish to include in the new access specification, then click the right arrow to move the selected user group into the list of selected user groups in the right panel. An alternative method is to double click on a selected object. The left arrow moves the selected item back into the left panel.

Step 10   Click Forward when the list of selected user groups is complete. The Select Feature Lists window appears:

Note   Feature lists that allow access to the standard Cisco EMF applications (that is, Launchpad, Viewer, and Event Browser) are included and can be selected. The Launchpad, Viewer, and Event Browser applications provide entry points to the PTA-MD and SSG windows and the commonly used Cisco EMF fault management capability windows.

Note   The User in this example is not allowed to create service profiles. Creating service profiles would be the responsibility of another user (for example, a super user).

Step 12   Click Forward when the Selected Feature Lists is complete. The Select Object Groups window appears.

You may wish to restrict access for SCM_PTA_Provisioning to a specific geographical area. For example, to create a user who is restricted to SCM_PTA_Provisioning in the Chicago area only, with no access to other regions. To do this you would:

1. Create an object group to define the geographical area (refer to the "Object Group Manager" section in the Cisco Element Management Framework User Guide) for further information.

2. Associate this object group with the access specification. Step 13 describes how to associate an object group with the access specification.

Step 13   Select the object group you want to associate with the SCM_PTA_Provisioning access specification, then click the right arrow. When the group is complete, click Forward.

Note   You can create an access specification without associating it with an Object Group. This allows unlimited geographical access.

Note   A valid name must have at least five characters with no spaces. You can use the Tab key to move between fields.

Step 16   Click Forward. The Copy from Existing User Group window appears:

Note   You can copy settings from a previously created User Group and edit the specification (refer to the Cisco Element Management Framework User Guide) or create a new User Group without copying settings from an existing access specifications. In this example we will create a new User Group without copying settings from an existing User Group.

Step 17   Click No.

Step 18   Click Forward. The Select User Group window appears:

Step 19   Select the User Groups that you wish to include in the new User Group, then click the right arrow. This moves the selected User Group into the list of selected users in the right panel. An alternative method is to double click on an item in Available User Groups. The left arrow moves the selected item (in the right list) back into the left panel.

Step 20   Click Forward when the list of selected User Groups is complete. The Select Access Specification window appears:

Step 21   Select the access specification you wish to apply to the new User Group, then click the right arrow. In this example, the SCM_PTAProvisioning access specification that was created earlier is selected.

Step 2   Enter details for the new user into the Enter details panel.

Step 3   Click Forward. The Copy from Existing User window appears:

Note   You can copy settings from a previously created User Group and edit the specification (refer to the Cisco Element Management Framework User Guide) or create a new User without copying settings from an existing access specifications. In this example we will create a new User without copying settings from an existing User.

Step 4   Click No.

Step 5   Click Forward. The Select User Groups window appears, showing SCM_PTA_MD as one of the Available User Groups:

Step 6   Select the User Groups you wish your new user to belong to, then click the right arrow. This moves the selected User Group into the list of selected User Groups in the right panel. An alternative method is to double click on an Available User Group. The left arrow moves the selected item (in the right list) back into the left panel.

Step 7   Click Forward when the list of selected user groups is complete. The User Password Entry window appears:

Step 8   Enter a Password for the new user following the conditions specified in the panel (below the Back, Forward, Cancel and Finish buttons). You will be alerted when you enter an invalid password.

Step 9   Retype the password to confirm that you have entered the password correctly.

Step 11   Click Finish to create the User. The Access Manager window appears with the name of the new User displayed at the bottom of the User's list.

This example has described how to:

• Create a new access specification (called SCM_PTA_Provisioning) that includes the feature lists that enables a user to deploy a PTA-MD service instance, configure the PTA-MD service instance, create and configure a subscriber, and then connect or disconnect the subscriber to the PTA-MD service instance

• Create a new Cisco 6400 SCM User Group with the SCM_PTA_Provisioning access specification

• Create a new User who can deploy a PTA-MD service instance, configure the PTA-MD service instance, create and configure a subscriber, and then connect or disconnect the subscriber to the PTA-MD service instance

Using the principles described in the above example you should now be able to create users with different access security levels.