Table of Contents

Access Manager Overview

User Access Levels
Security Levels

Cisco 6400 SCM Default Access Specifications

SCM_All_Features
SCM_Service_Provisioning
SCM_Service_Profiles
SCM_Subscriber_Provisioning
SCM_Element_Management
SCM_Element_Admin

Create a Customized Normal User

Launching the Access Manager Application
Create an Access Specification for Typical User Categories
Creating Different Categories of Users
Creating a New User Group
Creating a User

Troubleshooting

Checking the User Editor Window
Checking the User Groups Editor Window
Checking the Access Specification Editor Window
Checking the new User

Cisco 6400 Security

This chapter describes the security features built into the Cisco 6400 Service Connection Manager (SCM) application. The Cisco 6400 SCM through the use of Cisco EMF carrier class security mechanisms known as Cisco EMF User Access Control, provides:

• System administrators control of their system features that various levels of personnel can access. This is important for security and efficient and effective network management.

• Reliable security and ease of use, which plays a key role in a network management application. For example, given the rapid growth in high-speed data services, many organizations have concurrently grown rapidly. Experienced network operations center (NOC) personnel might need to spend more of their time training new employees in the skills of network management.

  ---

  Note   It might be advisable to restrict the Cisco EMF options available to less experienced personnel.

  ---

Additionally, complex new equipment technologies are being launched into the market by both existing and new equipment providers. Faced with many new equipment features, personnel might make mistakes; for example in equipment configuration, which could affect network uptime.

Service provider organizations might be obligated under law to protect sensitive information contained within management systems. The ability to provide secure customer network management is therefore a valuable service to offer customers.

The Cisco 6400 SCM adds additional security mechanisms or feature lists to the standard Cisco EMF security mechanisms.

In a complex network operations environment, it is advisable to create user roles, so that less experienced and skilled personnel are restricted from accessing service affecting management functions. You might consider creating user categories for "Normal", "Super", and "Administrator" levels of responsibility.

An example is provided (see the "Create a Customized Normal User" section) that describes how to create and configure the various features of your system that can allow or restrict the access allowed by various levels of personnel.

Access Manager Overview

Cisco EMF security allows system administrators to set up Access Manager objects using the Access Manager GUI. Access Manager objects can be classed as either personnel or services as follows:

• Access specification— A number of services grouped in a feature list with an associated access level (services)

• Group of users—Identified by a user group name (personnel)

• User—Identified by login name (personnel)

The Access Manager object is set up to allow or restrict user access to features within Cisco EMF. For example, an administrator could set up users to have access only to those parts of Cisco EMF that are relevant to their specific tasks. Users would only be aware of their own access to the system and the use of their password.

User Access Levels

Three levels of user access are available. These names describe the type of access available to each level:

• Read Only (basic level)—Useful for a new user learning the Cisco EMF system.

• Read-Write (normal level)—An operator would usually have read-write access to features required for day-to-day tasks. However, the operator might only have read-write access to a limited set of features.

• Read-Write-Admin (administration level)—Used by an administrator who has read-write access to all features at all times.

Security Levels

Cisco EMF Security also enables administrators to define security levels for specific managed object attributes. This is key to restricting access to sensitive or critical parameters of managed equipment (for example, the IP address of an item of equipment.) A user with Read-Write access might be able to apply a new configuration to that piece of equipment, but the user might not be able to modify its IP address, because it might invalidate normal device management. The network topology manager should be responsible for control of the IP address.

Cisco 6400 SCM Default Access Specifications

Default access specifications are supplied by the Cisco 6400 SCM application. Default access specifications can be changed or removed by authorized users.

Commonly used features are grouped in the Cisco 6400 SCM applications as described below.

SCM_All_Features

Includes all the feature lists; that is, access to everything in the Cisco 6400 SCM application.

SCM_Service_Provisioning

Includes all Service Configuration windows and Service Deployment feature windows.

Note   SCM_Service_Profiles does not include service profile access. Service profile access is considered as a superuser "policy definition" feature.

SCM_Service_Profiles

Includes all Service Profile feature lists (all service profiles, plus Connection Template deployment and configuration).

Note   SCM_Service_Profiles does not include service profile access. Service profile access is considered as a superuser "policy definition" feature.

SCM_Subscriber_Provisioning

Includes all Subscriber Provisioning feature lists (Subscriber deployment, configuration, connection and disconnection).

SCM_Element_Management

Includes all SCM Element Manager (EM) window feature lists, EM deployment, and all generic feature lists above with the exception of Backup/Restore and IOS Image Download.

SCM_Element_Admin

Includes Backup and Restore and IOS Image Download feature lists.

Create a Customized Normal User

The Cisco EMF Access Manager application allows system administrators the opportunity to control the features of their system that can be accessed by the various levels of personnel. This is important for secure network management.

This section provides an example of how to create a new Normal user who can create and configure ATM services and then connect subscribers to the service instance.

Figure 10-1 presents a typical workflow that shows how to first create an access specification, then create a user group; and then create the user.

• Launch the Access Manager application

• Create a new access specification (called Normal_User_AccessSpec) that includes the feature lists that enable the user to deploy and configure specific devices, create and configure a subscriber, and then connect the subscriber to the ATM service instance.

  ---

  Note   Access specifications are used to ensure that users are restricted to only be able to carry out the tasks that they are permitted to do (by the selected feature lists). That is, this example does not allow the user to disconnect a subscriber from a service, this task is restricted to users with a higher security level.

  ---

• Create a new Cisco 6400 SCM user group

• Create a new user

Launching the Access Manager Application

Click the Access icon on the Cisco EMF Launchpad to launch the Access Manager application (Figure 10-2) or choose Access from a pop up menu when using other Cisco EMF applications. The pop up menu is accessed by right-clicking on a selected object.

Create an Access Specification for Typical User Categories

This section describes how to create an access specification (called SCM_PTA_Provisioning) for a "normal" user. We also provide guidelines for creating three user categories:

• Normal User—User that is permitted to perform ATM service provisioning, and notably not ATM service disconnection.

• Superuser—User that can deal with all types of service provisioning

• Admin—User that can access element admin features such as IOS download

Creating the access specification ensures that a normal user can gain access to appropriate Cisco EMF functionality.

To create the example access specification, follow these steps:

Step 2   Choose Create, then Access Spec from the Edit dropdown menu. The Create Access Specification wizard launches. A window similar to Figure 10-3 appears.

Step 3   Enter a name for the new access specification to be created. In this example, it is SCM_PTA_Provisioning.

---

Note   A valid name must have at least five characters with no spaces.

---

Step 4   Click Forward. The Copy from Existing Access Specification window (Figure 10-4) appears.

Step 6   Click Forward. The Select Permission window appears (Figure 10-5).

Step 8   Click Forward. The Select User Groups window appears (Figure 10-6).

Step 9   Choose the user group that you want to include in the new access specification, then click the right arrow to move the selected user group into the list of selected user groups in the right panel. (An alternative method is to double-click a selected object.) The left arrow moves the selected item back into the left panel.

---

Note   You do not need to select a user group. This is an optional step. When using this application for the first time there will be no user groups in the available user group list.

---

Step 10   Click Forward when the list of selected user groups is complete. The Select Feature Lists window appears.

Figure 10-7: Select Feature Lists Window

---

Note   A Cisco EMF feature list is essentially a list of one or more windows that can have security access control applied to them. The Cisco 6400 SCM feature lists are those specific to the Cisco 6400 SCM functionality. The Cisco 6400 SCM feature lists are supplied by the Cisco 6400 SCM application, and are not user configurable. System administrators can add their own Cisco 6400 SCM specific access specifications built from the feature lists described in the following sections.

---

Step 11   Choose the feature list (one at a time) that you want to apply to the new specification (in the Available Feature List), then click the right arrow to include the selected feature list in the list of Selected Feature Lists.

Creating Different Categories of Users

Table 11-1 details the feature lists available for the different types of users. It displays the available feature lists that should be selected for a normal user and describes what each feature list allows the user to do. It also lists the recommended SuperUser and Administrator settings

Step 12   Click Forward when Selected Feature Lists is complete. The Select Object Groups window appears (Figure 10-8).

The Select Object Group window allows you to assign management responsibility for a network region as determined by an Object Group. For an example, you might want to restrict access for SCM_PTA_Provisioning to a specific geographical area.

Step 13   Click Forward. The Summary Details window, similar to Figure 10-9 appears.

If any details are incorrect, you can click Cancel to exit the wizard or click Back to return to the appropriate window and correct the details.

Creating a New User Group

To use the newly created access specification as a basis for defining a new group of users, follow these steps:

---

Note   A valid name must have at least five characters with no spaces.

---

Step 2   Click Forward. The Copy from Existing User Group window appears (Figure 10-11).

Step 6   Click Forward when the list of selected user groups is complete. The Select Access Specifications window appears (Figure 10-13).

Step 8   Click Forward. A Summary Details for User Group window, similar to Figure 10-14 appears. When any details are incorrect, you can click Cancel to exit the wizard or click Back to return to the appropriate window and correct the details.

Creating a User

Step 3   Click Forward. The Copy from Existing User window appears (Figure 10-16).

Step 5   Click Forward. The Select User Groups window appears (Figure 10-17).

Step 7   Click Forward when the list of selected user groups is complete. The User Password Entry window appears (Figure 10-18).

Step 10   Click Forward. A Summary Details for User window, similar to Figure 10-19, appears. When any details are incorrect, you can click Cancel to exit the wizard or click Back to return to the appropriate window and correct the details.

Troubleshooting

This section describes a number of checks that you should carry out after you have created a new User.

Be certain that:

• You have a selected User Group in the User Editor window. Refer to the "Checking the User Editor Window" section.

• You have a selected User on the User Group Editor window and the correct access specification is displayed. Refer to the "Checking the User Groups Editor Window" section.

• You check the access specification created using the Access Specification Editor. Refer to the "Checking the Access Specification Editor Window" section.

• You check the new user to ensure that they have access to the correct functionality. Refer to the "Checking the new User" section.

Checking the User Editor Window

To check that you have associated the correct user group with the user group, proceed as follows:

Step 2   Double-click on the appropriate user in the list. The User Editor window appears.

Step 3   Check the user details displayed in the User Details tab.

Step 4   Click the Select User Groups tab.

Step 5   Check that the appropriate User Group is selected in the list of Selected User Groups.

Step 6   Click Close to close the window.

Checking the User Groups Editor Window

To check that you have associated the correct user with a specific user group, proceed as follows:

Step 2   Double-click on the appropriate user group in the list of user groups displayed. The User Groups Editor window appears.

Step 3   Check the appropriate user is selected in the Select Users tab.

Step 4   Click the Select Access Specifications tab.

Step 5   Check that the appropriate access specifications is displayed in the list of Selected Access Specs.

Step 6   Click Close to close the window.

Checking the Access Specification Editor Window

To check the selected access specification, proceed as follows:

Step 2   Double-click on the appropriate access specification from the list displayed. The Access Specification Editor window appears.

Step 3   Check that the Read Write Admin option is selected in the Select Permissions tab.

Step 4   Click the Select User Groups tab.

Step 5   Check that the appropriate user group is displayed in the list of Selected User Groups.

Step 6   Click the Select Feature Lists tab.

Step 7   Check that all of the appropriate feature lists are displayed in the list of Selected Feature Lists.

---

Note   As a minimum you must have the Launchpad, Events-View, Viewer-View feature lists selected. A normal user whose focus was ATM Provisioning would also have subscriber connection, ATM related feature lists, and various deployment feature lists.

---

Step 8   Click the Select Object Groups tab. Object Groups are normally not selected unless you are using advanced features.

Step 9   Click Close to close the window.

Checking the new User

You should check that the new user has been set up correctly by logging into the system as the new user and checking the functionality available to the user.

To check the new user, proceed as follows:

Step 2   Login as the new user using the passwords set when the new user was created. The Map Viewer window appears.

Step 3   Check the menu options available by right clicking on a number of objects. Options are greyed out when the corresponding feature lists were not selected. For example, when we were setting up our example normal user earlier, we decided that we would not allow a normal user to be able to disconnect subscribers. We stopped the normal user from being able disconnecting subscribers by making sure that we did not select the SCM_Subscriber_Disconnection feature list.

Figure 10-20 shows the Disconnect option greyed out in the Subscriber menu option as expected.

Posted: Tue May 29 10:37:08 PDT 2001
All contents are Copyright © 1992--2001 Cisco Systems, Inc. All rights reserved.
Important Notices and Privacy Statement.