Question in regards to the latest version of NCM and the security of the configuration files. I know the configuration files are stored in the Database, does anyone know if it is possible to pull these files directly from the SQL DB, bypassing NCM security.

I just want to verify users that are locked out of the NCM App, won't be able to pull the information directly from the Database. Or if someone can take a backup of the Orion DB and essentially have all the device configurations contained within it.

Dear All,

I am not able to login on Nortel switch through NCM,i  have all ready given my correct Credential,

Error show login faild at Banner,

How the Pass Ctrl Y screen

Hi,

Is there a device template for HP MSM760 Wireless Controller I can use in NCM to backup the device?

Thank you

At my current job we have an older version of Cisco ACS that is going EOL soon.  We've started looking into upgrading to the latest Cisco ACS server, which is version 5.5 I hear.   Not only is it very expensive to go above 500 devices, but Cisco is telling us that this is the very last version of Cisco ACS that will ever be put out and that they want everyone to move to ISE instead.   I'm guessing that will be several years in the future, but we're hesitant at paying so much money for what could be an eventual dead-end for us.

I find it a bit funny, especially since they don't even have an ISE server that does TACACS yet, and for those of us that want the ability to do things like Shell Command Authorization Sets, that's pretty critical since Radius can't do that to my knowledge.  I've noticed there are a couple TACACS alternatives out there, like tac_plus, tacacs.net and clearbox.  I'm just curious what people are planning on doing on their network, or if they are already moved away from Cisco's product, what are they using?

I'd really love to see Solarwinds put out a product geared at handling device management like this, to work in concert with NCM.  And preferably not stick it to us with a huge pricetag like Cisco is with both the newer ACS servers and ISE.  Wonder if there are any plans for that?  Would be a nice addition to their current product line.

Dear, Team

When i upload the Startup config to the cisco devices, it might be applied to the startup config ?

or it applied to the running config,

i have no idea for this,

Best Regards,

hello,

am new in SolarwWnds and am trying to use NCM in order to have configuration history for my network devices . Cisco devises are working well and I have a configuration history , but when am trying to have a configuration history from Alcatel devices the feild  Last Login Result display Connection Refused by x.x.x.x

please any help to solve that ?

thanks

Ok guys so I need your help!

I'm busy configuring our licensed version of NCM

Orion

Yesterday I managed to backup the configuration files of 105 out 186 Cisco devices (mixture of switches and routers) with no problem at all.

A while later when I tried to run the same job again I got this message from all my devices.

x.x.x.x (x.x.x.x):

   ERROR: Connection Refused by x.x.x.x

Now please bear in mind that all devices make use of the global default login credential setting with ssh version 2.

My testing thus far:

1. Confirm and reconfirm login credentials under SettingsNCM -> Settings -> Global Device Defaults

     Test config down load - failed

2. Under manage nodes pick one device that I knew was working and edit its login credentials to the same as the credentials in global device default.

     Test config down load - it worked

2.1 revert changes back

3. run NCM Configuration Manager wizard again and rebooted the server

     Test config down load - failed

4. Here is my login trace for the failed download job.

[2012/12/14 10:47:23 AM] -----------------NCM 7.1.1-------------------

[2012/12/14 10:47:23 AM] UseCustomMorePromptBehaviour: False

[2012/12/14 10:47:23 AM] MorePromptKey:

[2012/12/14 10:47:23 AM] Login Attempts: 1

[2012/12/14 10:47:23 AM] Custom UserName Prompt:

[2012/12/14 10:47:23 AM] Device Template: Cisco IOS-1.3.6.1.4.1.9.ConfigMgmt-Commands

[2012/12/14 10:47:23 AM] System Name: NAME OMITTED

[2012/12/14 10:47:23 AM] System Description: Cisco IOS Software, C2960S Software (C2960S-UNIVERSALK9-M), Version 12.2(55)SE5, RELEASE SOFTWARE (fc1)

Technical Support: http://www.cisco.com/techsupport

Copyright (c) 1986-2012 by Cisco Systems, Inc.

Compiled Thu 09-Feb-12 19:22 by prod_rel_team

[2012/12/14 10:47:23 AM] System OID: 1.3.6.1.4.1.9.1.1208

[2012/12/14 10:47:23 AM] OS Image: C2960S-UNIVERSALK9-M

[2012/12/14 10:47:23 AM] OS Version: 12.2(55)SE5, RELEASE SOFTWARE (fc1)

[2012/12/14 10:47:23 AM] Menu-Based mode=False

[2012/12/14 10:47:23 AM] FreezeLoginForPreCommands mode= False

[2012/12/14 10:47:23 AM]

-->StateChange: Connecting to server<--

[2012/12/14 10:47:23 AM] Got HostFingerPrint: ee:bb:12:89:50:ef:60:85:9c:85:0d:f1:7e:52:7b:f6

[2012/12/14 10:47:23 AM] SWTelnet9 Crypto Information Begin

[2012/12/14 10:47:23 AM] Protocol = SSH2

[2012/12/14 10:47:23 AM] RemoteName = SSH-2.0-Cisco-1.25

[2012/12/14 10:47:23 AM] SCcipher = aes128-cbc

[2012/12/14 10:47:23 AM] CSCipher = aes128-cbc

[2012/12/14 10:47:23 AM] Keys = ssh-rsa

[2012/12/14 10:47:23 AM] SWTelnet9 Crypto Information End

[2012/12/14 10:47:23 AM] Banner received

[2012/12/14 10:47:25 AM] TimerTick: mstrData=<> State=1 - Connecting to server

[2012/12/14 10:47:25 AM] Pending Disconnect = False

[2012/12/14 10:47:25 AM] TimerState not Idle, Leaving.

[2012/12/14 10:47:25 AM] Got Login Challenge: Password:

[2012/12/14 10:47:27 AM] TimerTick: mstrData=<> State=1 - Connecting to server

[2012/12/14 10:47:27 AM] Pending Disconnect = False

[2012/12/14 10:47:27 AM] TimerState not Idle, Leaving.

[2012/12/14 10:47:28 AM] Solarwinds.Net SWTelnet9 Version 9.0.27

[2012/12/14 10:47:28 AM] Connected!

[2012/12/14 10:47:28 AM]

-->StateChange: Disconnected from server<--

Please note that login to ALL device is failing no changes have been made to device and the backups did work earlier on.

Any idea's?

Hi,

I use the temp from an other post here in this Forum for a repeat command in Loop form.

Here you are the script:

/*
.CHANGE_TEMPLATE_DESCRIPTION
        This NCM Configuration Change Template will set a boot variable command to all applicable devices.

.CHANGE_TEMPLATE_TAGS
        Cisco, IOS, 3750

.PLATFORM_DESCRIPTION
        This runs on IOS devices.
 
.PARAMETER_LABEL @ipaddress
        Device IP address

.PARAMETER_DESCRIPTION @ipaddress
        Cisco IOS Image angeben das als Bootvariable gesetzt werden soll. Bsp: c2960s-universalk9-mz.150-2.SE6.bin

.PARAMETER_LABEL @indexes
        IP address (Muster) Bsp: 10.10.10.1

.PARAMETER_DESCRIPTION @indexes
        IP Range angeben der eingefuegt werden soll (Bsp: 1,2,3,4)

*/


script RELOAD_IOS (
                         NCM.Nodes @ContextNode,
                         string @ipaddress, int[] @indexes
                  )
{
string @ipnew

foreach(@id in @indexes)

    {

      @ipnew = setoctet(@ipaddress,3,@id)

      CLI

        {

           Allow @ipnew out

           Allow @ipnew UDP 2055 OUT

        }

    }

}

_______________________________________________________________

The Output of this Looks like this:

Allow 10.10.1.1 out

Allow 10.10.1.1 UDP 2055 OUT
Allow 10.10.2.1 out

Allow 10.10.2.1 UDP 2055 OUT
Allow 10.10.32.1 out

Allow 10.10.32.1 UDP 2055 OUT
Allow 10.10.4.1 out

Allow 10.10.4.1 UDP 2055 OUT

________________________________________________________________

This is ok for now. But I often have a Situation to repeat this for 70-90 devices. I dont want to enter the form like "1,2,3,4,...,70" in this used integer variable. I better would use 1-50 for example.

If I enter in this form I get an error that I have to give it in 1,2,3... form.

I know, theres no Chance to use a normal programmer language for this scripts, but how can I fill the integer arrow?

I think about a for while Loop like foreach (for @id <= @STARTIP; id<=@ENDIP; @id++)  (this is just my Impression, not the complete code)

Sure I read the doku, but I only found the foreach variable for me.

Thanks for Response.

Otto

We're at a point where we want to start checking our devices for compliance with our companies security policies, so I've started playing with the Compliance Policy Reports and I'm trying to figure out how to accomplish some basic stuff that I'm probably missing.

So, out of the box you get a bunch of different reports already - Cisco, CISP, Foundry, HIPAA, Juniper and SOX reports.   While there are bits and pieces of some of the reports that might work for me, none of them really fit our companies policies as closely as I'd want, or at least not what we want to report on at the moment.

But on the main "Config Summary" page, it shows in the "Policy Violations" box 4 of these reports in what appears to be a somewhat random order, and the Report I'm building doesn't show up at all on this page.   I'd like to be able to either customize the order that its in, to show my report at the top, or to be able to hide the other reports from this box.  However, there doesn't seem to be a good way to do this.  Am I missing something?    I don't want to remove those other reports through "Manage Policy Reports" since I might want to use them or at least look at them to help figure out my own stuff.   Ideally I'd love to be able to lock them so others can't go in and customize them either, so if new versions come out they don't replace any customizations we might have done.   But for now I'd just like to be able to stop them from being reported on for at least the time being.

Also, when working on my reports, I'll usually "View Reports By Folder" and I have my own folder set up for my report.  However, I've noticed if I build a new rule or policy and want to check on things, when I go in and select my report and then do an "update all" to test it against all my configs, that I'm not only just updating my own report but all of the reports on the server.   Is there a way to only refresh the report you've selected or are working with?

So, how does everyone else work with the Compliance Reports?   Do you just leave the default reports in there?   Do you edit them directly or build your own?  Any hints/tricks would be helpful!!

I've captured the configs on about 500 routers, but on about 10 of them, I get the following error in config download every time:

Connectivity issues, discarding configuration (or configuration is too short)

How do I troubleshoot this?  I can login manually, and do a show configuration without a problem.

All routers should have identical configuration and IOS version.

Hi,

I actually have some Trouble with my compliance checks for some lines for my line Interfaces.

Is there any difference between the manual check in form that I paste a config block in the testwindow and the check for a normal downloaded config?

I use some check lines for my line Interfaces in this form:

line con 0\n(.*\n)*.* exec-timeout 5 0\n(.*\n)*(line|!)

I would check if there is a exact line under "line con 0" .

I use some further checks in like this in this compliance rule. This is just for an example.

If I run a test with a pasted config, I got the correct result. In case of test with a downloaded config from Solarwinds I get an error with "no found sting" . - I checked the downloaded config. The string is there.

Do anyone of you have a idea? - Is this a bug or a feature? :-)

Greetz Otto

Hello,

We have a wireless bridge that occasionaly becomes unavailable, to address it we have a remote device that will power cycle the unresponsive bridge (a dataprobe iBoot).  What I would like to do is create an alert condition in the NPM alerts that basically says if the switch is still accessible, but the bridge is not, then run an NCM action/Execute Config Script on the iBoot device.  I can create the alert, and the NCM script, but there is no way that I see to specify what node to execute the NCM action against?

Thanks in advance for any thoughts or insight,

John

When I upgraded our NCM to the newest model i have a message Orion User Account Limitations will be applied in NCM Jobs should i do anything extra?

I have an issue with NCM getting config off a device, i suspect it's because the prompt is being set wrongly.

Can someone please help me resolve this issue?

Template is below:

<!-- edited with XML Spy v4.4 U (http://www.xmlspy.com) by () -->

<!--SolarWinds Network Management Tools-->

<!--Copyright 2005 SolarWinds.Net All rights reserved-->

<Configuration-Management Device="TopSec FW" SystemOID=" 1.3.6.1.4.1.14331.1.4">

    <Commands>

        <Command Name="Startup" Value=""/>

        <Command Name="Running" Value=""/>

        <Command Name="DownloadConfig" Value="show | [nostop]"/>

        <Command Name="Version" Value="system version"/>

        <Command Name="MenuBased" Value="false"/>

        <Command Name="VirtualPrompt" Value="%"/>

    </Commands>

</Configuration-Management>

Trace Session is below:

[2014-7-15 17:29:31] -----------------NCM 7.2.2-------------------

[2014-7-15 17:29:31] UseCustomMorePromptBehaviour: False

[2014-7-15 17:29:31] MorePromptKey: 

[2014-7-15 17:29:31] Login Attempts: 1

[2014-7-15 17:29:31] Custom UserName Prompt:

[2014-7-15 17:29:31] Device Template: 复件 TopSec-1.3.6.1.4.1.14331.1.4.ConfigMgmt-Commands

[2014-7-15 17:29:31] System Name: DCC-3G-EXS-FW-0A

[2014-7-15 17:29:31] System Description: Topsec NGFW4000-UF(TG-41308) Software Version tos_3.3.010.069C.1

Copyright(c) 2004 Beijing Topsec Network Security Technology Co.,Ltd

[2014-7-15 17:29:31] System OID: 1.3.6.1.4.1.14331.1.4

[2014-7-15 17:29:31] OS Image: TG-41308

[2014-7-15 17:29:31] OS Version: tos_3.3.010.069C.1

[2014-7-15 17:29:31] Menu-Based mode=False

[2014-7-15 17:29:31] FreezeLoginForPreCommands mode= False

[2014-7-15 17:29:31] FISP mode= False

[2014-7-15 17:29:31] NeedDelayEnableMode detected

[2014-7-15 17:29:31]

-->StateChange: Connecting to server<--

[2014-7-15 17:29:32] Got HostFingerPrint: 75:2d:0a:a0:60:1b:b0:96:8c:d4:82:17:90:3d:41:f7

[2014-7-15 17:29:32] SWTelnet9 Crypto Information Begin

[2014-7-15 17:29:32] Protocol = SSH2

[2014-7-15 17:29:32] RemoteName = SSH-2.0-3.2.5 SSH Secure Shell (non-commercial)

[2014-7-15 17:29:32] SCcipher = aes128-cbc

[2014-7-15 17:29:32] CSCipher = aes128-cbc

[2014-7-15 17:29:32] Keys = ssh-dss

[2014-7-15 17:29:32] SWTelnet9 Crypto Information End

[2014-7-15 17:29:32] Banner received

[2014-7-15 17:29:32]

-->StateChange: Connected to server - idle<--

[2014-7-15 17:29:32] Solarwinds.Net SWTelnet9 Version 9.0.27

[2014-7-15 17:29:32] Connected!

[2014-7-15 17:29:32] --->Topsec Operating System tos_3.3.010.069C.1Topsec Network Security Technology CO.,LTDhttp://www.topsec.com.cn

[2014-7-15 17:29:32] ProcessLogin State: 0

[2014-7-15 17:29:32] --->DCC-3G-EXS-FW-0A%

[2014-7-15 17:29:32] ProcessLogin State: 0

[2014-7-15 17:29:32] no credentials needed - Command mode prompt detected

[2014-7-15 17:29:32] Prompt is being set to : Topsec Operating System tos_3.3.010.069C.1Topsec Network Security Technology CO.,LTDhttp://www.topsec.com.cnDCC-3G-EXS-FW-0A%

[2014-7-15 17:29:32] Logged into Router

[2014-7-15 17:29:32] <--

[2014-7-15 17:29:32] -->

[2014-7-15 17:29:32] --> DCC-3G-EXS-FW-0A%

[2014-7-15 17:29:32] Start check prompt for menu-based device

[2014-7-15 17:29:32] Process Line = <>

[2014-7-15 17:29:32] Process Line = <DCC-3G-EXS-FW-0A% >

[2014-7-15 17:29:32] Fuzzy match detector start detecting prompt. String1=dcc-3g-exs-fw-0a% String2=topsecoperatingsystemtos_3.3.010.069c.1topsecnetworksecuritytechnologyco.,ltdhttp://www.topsec.com.cndcc-3g-exs-fw-0a%

[2014-7-15 17:29:32] Pushing back: <DCC-3G-EXS-FW-0A% >

[2014-7-15 17:29:32] mPrompt is : <Topsec Operating System tos_3.3.010.069C.1Topsec Network Security Technology CO.,LTDhttp://www.topsec.com.cnDCC-3G-EXS-FW-0A%>

[2014-7-15 17:29:33] TimerTick: mstrData=<DCC-3G-EXS-FW-0A% > State=3 - Connected to server - idle

[2014-7-15 17:29:33] Pending Disconnect = False

[2014-7-15 17:29:33] Fuzzy match detector start detecting prompt. String1=dcc-3g-exs-fw-0a% String2=topsecoperatingsystemtos_3.3.010.069c.1topsecnetworksecuritytechnologyco.,ltdhttp://www.topsec.com.cndcc-3g-exs-fw-0a%

[2014-7-15 17:29:33] TimerTick: Just tick-tockin away. ..

We have literally thousands of these same switches at one of our customers. We have to be able to use NCM to backup, change control, restore configurations to all of these switches.

One thing to point out is that the method the original poster (Jeff), and this here Jeff are using is somewhat unsupported by HP (formerly 3com).  When we login via Telnet, and type that command "_cmdline-mod on" then answer "Y" and enter the secret password - that is the only way we can access the advanced level command line.  It is somewhat Menu driven, but not really, because you can also type out commands. This is a strange bird to say the least, but one that *MUST* be solved and supported by Solarwinds at any cost. I am ready to open a case and work closely with any Engineer to get this resolved, but it must be resolved.

I get right to that "Please input password:" prompt, then it enters the correct number of *'s, but always reports incorrect password, then the rest of the script fails to run. I have tried the Template Builder Assistance and the Solarwinds Config Generator...and neither offer enough granularity in creating templates or configuration change scripts to be successful.

This is how it should work:

Username: admin

Password:

<PROMPT> _cmdline-mode on

All commands can be displayed and executed. Continue? [Y/N] Y

Please input password: ******

Warning: Now you enter an all-command mode for developer's testing, some commands may affect operation by wrong use, please carefully use it with our engineer's direction.

<PROMPT>

This is the reality when executing via script in NCM:

Username: admin

Password:

<PROMPT> _cmdline-mode on

All commands can be displayed and executed. Continue? [Y/N] Y

Please input password: ******

incorrect password

<PROMPT>

Here is the ConfigMgmt-Commands File I am working with -- Note some of this is added after using the Template Builder Assistant:

<Configuration-Management Device="3com-2928" SystemOID="1.3.6.1.4.1.43.1.8.75">

  <Commands>

    <Command Name="ALLOCATEPTY" Value="True" />

    <Command Name="CUSTOMUSERNAMEPROMPT" Value="Username:" />

    <Command Name="MENUBASED" Value="True" />

    <Command Name="EnterConfigMode" Value="_cmdline-mode on${CRLF}" />

  <Command Name="VirtualEnablePrompt" Value="Y${CRLF}" REGEX="All commands can be displayed and executed. Continue? [Y/N]" DELAY="5" />

  <Command Name="VirtualEnablePrompt" Value="123456${CRLF}" REGEX="Please input password:" DELAY="5" />

  <Command Name="DOWNLOADCONFIGINDIRECT" Value="backup startup-configuration to ${StorageAddress} ${Node Name}.cfg ${CRLF}" />

  </Commands>

</Configuration-Management>

Here is the Execute Script I am working with -- Generated with Solarwinds Config Generator 1.0:

'ADVANCED:FILTER RESULTS:False

'ADVANCED:FILTER PATTERN:Serial

'ADVANCED:SHOW COMMANDS:True

_cmdline-mode on

Y

123456

backup startup-configuration to 157.241.7.206 ${Node Name}.cfg

I hope someone has either done this or Solarwinds Tech Support see's this and can help me get to the next step.

Thanks,

Jeff Singleton

Motorola Solutions Inc.

Good morning/afternoon/evening;

We currently run NCM 7.1.1 and Orion 7.1 however they are not integrated but do share the same DB server (not the same DB). The NCM server is installed on a VM here in office. I have been tasked with moving the NCM server to our new DC, what I am planning to do is build a new VM and then install the product there, pointing it to the old NCM DB, if I do this will the existing jobs and templates be migrated to the new version and be accessible from the new NCM server?

Process;

Shutdown existing NCM platform

Backup the NCM DB

Use config wizard to point the new NCM to the existing DB

Backout being restore the NCM DB.

Is this a sensible approach?

Thanks.

Hello all,

I am new to NCM, and I have one question for which I can't seem to find answer in documentation. Can anyone explain me configuration retrieval process when SNMP/TFTP is used. I was under impression it is possible to retrieve (download) Cisco switch configuration by reading it using SNMP RO string and transfering it using TFTP to TFTP server that is up and running on SolarWinds NCM server. Now that I've written it like this, I am not really sure it is possible. What is the correct procedure and is there a way to keep network environment more secure by not enabling RW access from SolarWinds NCP server (and still being able to get config)?

Thanks, MSM

I could use some help with creating a regular expression that the config change report ignores during it's comparison.  Basically, I have Cirrus comparing the most recent config downloaded with the latest baseline.  The problem is that the running configuration of my cisco devices has the crypto key listed in the config, and in the startup, the crypto key doesn't exist.  I would like to exclude this section from even being compared, but my regular expression knowledge is severely lacking.  I'm guessing there is a way for me to exclude the following:

crypto ca certificate chain TP-self-signed-1667691779
 certificate self-signed 01
  3082022B 30820194 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
  31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
  69666963 6174652D 31363637 36393137 3739301E 170D3036 30383036 31303234
  35365A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
  4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D31 36363736
  39313737 3930819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
  8100B4CA F3563FC5 43010A48 B075619E A7DE4790 AF982EF5 5402B501 207DB313
  67C78E80 CCD4CBA7 D2214222 055D8CBF A676A6A3 64C0B6C2 2247D76C C4C60202
  EFCA453E 5848D707 16D2940D C7384BBE 6BA52028 5F1CD47F C66CFD7B EF51188D
  8AF9B9E9 D4DFB645 1D36E2B0 1D2B6BDE CF00F2FB 149AA487 7CF2FD66 74A4D032
  CDFB0203 010001A3 53305130 0F060355 1D130101 FF040530 030101FF 301F0603
  551D2304 18301680 14797F79 CD395C9D 9BBBF477 BE2CB863 2BD9D2B3 DA301D06
  03551D0E 04160414 797F79CD 395C9D9B BBF477BE 2CB8632B D9D2B3DA 300D0609
  2A864886 F70D0101 04050003 8181007B 9EB45922 73A18372 A31736D2 DA9089FD
  760DE6D1 0B50007E 05BA8328 D8A48A76 5B68D3EE 69BA29BD 89D63CE8 6BEF5ECE
  05DC7804 FAE7DA90 716CB0C5 40BBCB21 8BFDE99D AF3E4D35 796BFA05 FF5F3000
  78368944 B9BA15C8 F017126D 7AF337D0 88F38689 57F73A18 7509491A F3060E3A
  D0F1BCE8 4C110ECF 9A016242 7758E3
  quit

Is there a way to exclude everything to "quit" and what would it look like?  Any help would be appreciated.

I'm hoping someone knows how to remedy the issue.  We have a few and I of course and trying to back up their configs but I constantly am getting a pw error but believe it's just the way the the commands are ordered in the way of login as there is no user id to login.  Has anyone else ran into this problem?

Has anyone been able to get NCM Real-Time updates with e-mail notification to work? We've got it running rather well, but I can't seem to get it to send e-mail updates to one of our users... the only difference is that this particular user is outside of our organization. Any help?