-
Cisco Enhanced Device Interface User's Guide, 2.0
-
Cisco E-DI Concepts
-
Using Cisco E-DI
-
Managing the Network
-
Managing Security
-
Managing Files
-
Configuring Devices
-
Managing Inventory
-
Scheduling Jobs
-
Handling and Reporting Alarms and Events
-
Using Perl Scripts
-
Troubleshooting the Network
-
Maintaining Cisco E-DI
-
Cisco E-DI Commands and Associated Privileges
-
Open Source License Acknowledgement
-
Feedback
Table Of Contents
Command Line Interface (CLI) and Prompt
CLI Command Mode and Command Context
Cisco E-DI Concepts
Cisco Enhanced Device Interface (Cisco E-DI) provides a comprehensive management interface for Cisco devices. See Figure 1-1. This chapter contains the following information:
•
Command Line Interface (CLI) and Prompt
Overview
Cisco E-DI provides interfaces for two main categories of users:
•
•
Most of the Cisco devices natively provide a comprehensive CLI for a human user to handle all device level management functions. Cisco E-DI builds upon that capability providing value added functions to manage groups of devices conveniently, while keeping the new commands consistent with Cisco IOS CLI. Cisco E-DI provides an intuitive syntax validation of the commands, easy visual feedback on configurable and operational aspects of multiple devices in the network, and running CLI scripts on groups of devices.
While CLI scripts and macro commands can provide some programmatic support for managing large networks, the approach can still be cumbersome and unsuitable for comprehensive management of large networks. Management applications handling multi-vendor devices expect a standards based programmatic interface. Cisco E-DI provides an XML (eXtensible Markup Language) PI based on NETCONF configuration protocol standards. The supported data model is published through XSD (XML Schema Definitions) files.
Figure 1-1 Cisco E-DI
Management functions on Cisco devices can be classified as:
•
•
•
•
•
•
Functionality natively supported on a Cisco device is always available to the Cisco E-DI user.
Cisco E-DI primarily offers an enhanced interface for the following device level tasks:
•
•
•
•
•
•
Cisco E-DI includes network virtualization for managing multiple devices. Network virtualization allows the user to dynamically group multiple devices into a single entity, and perform any of the tasks on all the selected devices.
A Cisco E-DI server manages a group of devices. However, if a user chooses to deploy multiple Cisco E-DI servers to manage the network, the partitioning of the network and which server will manage what partition of the network, will be the user's responsibility. Cisco E-DI is agnostic about another Cisco E-DI managing the network.
Cisco E-DI Features
Cisco E-DI includes the following features:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Types of User
There are four types of Cisco E-DI users:
•
•
•
•
In addition, there is a repair user who can perform limited administration tasks like resetting the admin password, and recreating server database tables from the repair shell. See "Maintaining Cisco E-DI" for more details.
Security in Cisco E-DI
Users need to login to Cisco E-DI by specifying a username and password.
When a user attempts to login to Cisco E-DI in an SSH or Telnet session, the user is authenticated. On successful authentication, users are able to access the CLI.
Each user is associated with a domain group. The privileges for the domain group are specified when the domain group is created. For more information about domain groups and control, see "Domain Control" section.
Cisco E-DI provides role-based access control at the device level, so that access to an NE is allowed or disallowed based on access privileges configured by the Cisco E-DI administrator.
To enable role-based access control, any new user has to be associated with an existing domain group. Each module contains the task information for which it is responsible. Authorization information for each task is maintained in XML files for each privilege level. This information is loaded at the time the Cisco E-DI server is started.The command will only be implemented if the authorization check is successful. For example, a Cisco E-DI user can perform a management task on an NE only if:
•
or
•
All logins and configuration changes done in Cisco E-DI are published as Cisco E-DI syslog events and stored in the database. The events contain the name of the user who logged in successfully. Configuration change events contain the name of the user who made the changes.
External syslog receivers are able to receive the syslog events by subscribing for the events. Syslog events can be subscribed to using the Cisco E-DI server configuration command logging host <IP-ADDRESS>.
Cisco E-DI uses SNMP, TFTP, and Telnet or SSH protocols to communicate with devices. The administrator has the option of choosing Telnet or SSH. For either protocol, the user must specify a login, password, and an enable password. All device credentials, such as SNMP community strings and CLI passwords, are encrypted and stored in the startup configuration of the Cisco E-DI.
Certain operations on a device can be destructive, for example, write erase which will erase the entire contents of flash on a device. Cisco E-DI provides a default list of forbidden commands, and administrators are able to modify the list. In Cisco E-DI, the administrator can define a list of commands which are not allowed to be implemented on any device.
Platform/OS Support
The actual devices, line-cards and OS releases supported by Cisco E-DI are determined and identified by the incremental device update (IDU) process and published on a regular basis. Refer to Release Notes for Cisco Enhanced Device Interface 2.0.
Network Virtualization
Cisco E-DI includes the concept of network virtualization, where a network (a subnet, a network in a building, a group of devices) is seen as a single virtual device. For more information about groups, see Groups.
Command Line Interface (CLI) and Prompt
Cisco E-DI allows the user to interact with network devices through the command line interface (CLI). Cisco devices natively provide a comprehensive CLI for a user to handle all device level management functions.
There are three related concepts in Cisco E-DI:
•
•
•
Command context and VFS are related. The command context set commands, network and server, and VFS directory command cd change both the command context and the VFS directory path, and enable navigation within the Cisco E-DI main command. This behavior differs from a traditional operating system's shell. For example, in UNIX, there is only one command (cd) that changes the directory path. See Table 1-1 for examples.
Figure 1-2 Cisco E-DI Virtual File System
Network Mode
In Cisco E-DI setting the command context to network using the network command changes the working directory at the same time to /network. Cisco E-DI network configuration command mode is used for configuring devices on the network. This mode contains configuration sub-modes based on the specific device or devices types, and associated software version.
In this mode, operations apply on the devices in the network. The prompt signifies on what sub-set of devices the actions will be performed. In network mode there are two pre-defined sub-modes which in turn have multiple sub-modes. :
•
•
Server Mode
Setting the command context to server using the server command changes the working directory to /server. Cisco E-DI server configuration command mode is used for configuring the Cisco E-DI server.
In this mode all server related functions can be performed. For example, use server mode to see all the users and their rights, to configure credential sets and to implement other configuration commands.
Cisco E-DI Prompt
The Cisco E-DI run-time prompt includes the VFS path. This provides a visual indication that the path has changed as a result of the command context command. It also shows the present directory as the user navigates through the directory structure to provide more context.
The Cisco E-DI prompt format is as follows:
User@Hostname[CommandContext:DirectoryPath]#User@Hostname[CommandContext:DirectoryPath](CommandMode)#The command context is shown as follows:
•
•
•
•
Table 1-1 shows examples of the Cisco E-DI prompt. CLI Command Mode and Command Context details the command context.
Note
CLI
Cisco E-DI NetCLI is the primary user interface to Cisco E-DI and is a CLI editor whose command editing facility is similar to that of Cisco IOS. To leverage the existing knowledge base in the Cisco user community, Cisco E-DI CLI is Cisco IOS CLI-like, Cisco E-DI NetCLI follows the same basic Cisco IOS CLI rules and behavior, for example, the concept of a no command to delete a configuration item.
The Cisco E-DI CLI includes the following features:
•
–
–
–
–
–
Additionally, a pass-through command is provided to send a single unvalidated EXEC command.
•
•
•
–
–
CLI Command Mode and Command Context
As in Cisco IOS, the Cisco E-DI CLI command mode determines the set of commands available to the user at the prompt. However, in addition to command modes within the main Cisco E-DI command mode, the CLI also uses command context to determine the entity that the command is applied to, whether or not the command is applicable, and if it is applicable, how to interpret the command.
There are six main CLI command modes and the four command contexts within the main Cisco E-DI command mode. The Cisco E-DI prompt indicates the context (Server, Network, Group or Device) and path (Directory).
The six basic CLI modes are:
1.
2.
3.
4.
5.
6.
Figure 1-3 shows the hierarchy and relationship of the 6 basic CLI modes.
Figure 1-3 Hierarchy and Relationship of the CLI Modes
The four command contexts within the Cisco E-DI main command mode are:
1.
2.
3.
4.
The concept of a group is an integral part of Cisco E-DI. For more information, see Grouping. Command context is associated with the Cisco E-DI VFS directory path.
Navigation between command contexts and VFS directories within the Cisco E-DI main command mode is supported by both the network and server command, and by the directory change command cd.
CLI Color Mode
Cisco E-DI CLI color mode enhances CLI usability by coloring the display headings and CLI mode in the prompt. The NE's alarm aggregate status is indicated in the CLI prompt. The color of the prompt indicates the highest alarm severity found in the devices within the scope of the CLI mode, as follows:
•
•
•
Cisco E-DI color mode has been tested on the following terminal types:
•
•
•
•
Additionally, each command typed by the user instantly gets color highlighted to indicate the validity of the command. For example, if the user enters the word hostne for the hostname command, the text will be highlighted blue till the word hostn is entered, but as soon as e is typed, the word hostne will be highlighted red to indicate that there is no matching command for that word.
Cisco E-DI admin Account
Cisco E-DI provides a pre-defined admin account. The name of the account may not be changed by any user, but the password can be changed. Users with FULL_CONTROL access are considered to be Cisco E-DI administrators. Any Cisco E-DI administrator can add more administrators or other user accounts in Cisco E-DI using the CLI commands.
Cisco E-DI Root Login
Access to the root login is fully restricted since the root login and password is disabled.
An incremental root login package that enables root login is available as a patch for debugging and serviceability purposes. On applying this patch, a user can gain root privileges. The purpose of the root login is to allow TAC, or the user with instructions from TAC, to troubleshoot basic Linux functions.
Configuring Multiple Devices
Through the network virtualization feature, Cisco E-DI provides an ability to configure multiple devices with one set of commands. When a user selects multiple devices of different types and/or different OS versions, Cisco E-DI automatically determines the least common denominator set of commands and presents them to the user in typical Cisco IOS-like fashion. If the color mode is enabled, then the command is highlighted with an appropriate color to give the user an instant feedback on the validity of a command with the given device/OS selection. See CLI Color Mode for more information. The user can then press the key combination Ctrl-G to view the detailed mapping of a command for any given device type/OS version.
When configuring multiple devices, Cisco E-DI provides interface macros, for example all-fastethernet, all-gigabitethernet. When configuring a single device, Cisco E-DI provides an additional macro for selecting a single interface.
Syntax Checking
Cisco E-DI maintains the CLI knowledge base for every device family/OS version that it supports. With this knowledge base, Cisco E-DI can perform automatic syntax checking on all user input. Cisco E-DI also internally uses the syntax checking feature to intelligently identify changes between two configurations.
Cisco E-DI also allows the user to select syntax checking of additional options such as OS version, and OS type.
Credential Sets
Device credentials like login, password, and SNMP community string settings are required for communication with a device. Cisco E-DI combines these credentials into a credential set which specifies the necessary information for Cisco E-DI to communicate to the device. It is assigned to a device when the device is managed.
Credential sets have the following attributes:
•
•
•
•
–
–
–
–
–
–
–
•
•
Note
Cisco E-DI uses the attributes defined in the credential set to login to the device, and to perform SNMP operations. A credential set can be assigned to a single device or multiple devices. If there is no credential set assigned to a device, default credential set will be used.
Credential sets can also be used for troubleshooting, where the user specifies the credential set to be used for trying connectivity to the device.
Groups
Cisco E-DI provides the option to create groups. This can be used to manage groups of devices conveniently. There are the following types of groups:
•
–
–
•
•
•
Once the NEs are grouped, then the grouped NEs can be placed in a domain group, that is, the administrative domain.
Groups can also be nested within a group.
Groups are fundamental to the concept of network virtualization (see Network Virtualization) where users can dynamically group multiple devices into a single entity, and perform any of the tasks on all the selected devices.
When network mode is selected, operations apply on the devices in the network. The prompt signifies on what sub-set of devices the actions will be performed. In network mode there are two sub-modes which in turn have multiple sub-modes. There are two pre-defined sub-modes under the network mode; groups and devices.
Static Groups
Static groups contain a statically defined set of devices, or other groups which can be static, dynamic or system defined, creating a nested group.
Devices are added to these groups statically. A user can add another static or dynamic group to a static group, to create a nested group. The devices contained in the nested groups are the list of all devices contained in all of the groups included in the nested groups with redundant devices listed only once.
Only managed devices can be added to a static group. Devices can be added to or deleted from a static group.
Dynamic Groups
Dynamic groups are rule-based. Devices are grouped together based on user-defined rules. The list of devices is dynamically computed based on user-defined rules. Whenever a device is managed, it becomes a part of a dynamic group if it satisfies the rules specified for that group. Devices cannot be removed from a dynamic group. Devices can be prevented from being added to a group if exclude options are included in the rules for that group. Rule features include:
•
•
•
•
•
Device Capabilities
Device capability is a unique name that identifies certain capabilities that a device supports. For example: cdp-mib-supported. Capabilities are used by Cisco E-DI to determine which Cisco E-DI functionalities are applicable to the device. Table 1-2 lists the capabilities supported by Cisco E-DI:
Interface Groups
Interface group is a static system-defined groups used within a device context. A device context could cover single or multiple devices.
Interface groups allow user to configure multiple interfaces with one set of commands. Interface groups can be used with multiple devices or a single device. The interface grouping feature is only available through the CLI.
Table 1-3 lists the supported interface groups.
System Defined Groups
There are several pre-defined dynamic groups known as system defined groups, as follows:
•
•
•
•
•
•
•
•
•
•
•
MyGroup Dynamic Group
MyGroup is an ad-hoc dynamic group which is created by the user, and is lost when the user exits the session. MyGroup can be any combination of devices and existing groups.
For example, MyGroup would be created when a command similar to the following is entered:
[SVR:/server] (config) # network 172.16.0.202 172.16.0.200 172.16.0.204You can enter [SVR:/server] # show devices group to show the devices in the group.
