This document describes the best practices in setting up and using Network Configuration Manager in an enterprise network environment. It is intended to offer guidance to IT administrators when they set up the software for use in their production environment.
Mandatory Settings
Immediately on installing the Network Configuration Manager, launch Network Configuration Manager web interface and ensure that the following settings are configured.
Optional Settings
In addition to the above mandatory settings, it is good to carry out the following optional settings:
After setting up Network Configuration Manager, you can carry out the following:
Use 'Discovery' to add your Devices
If your devices are SNMP-enabled, use 'Discover Devices' option to discover and your devices to the inventory. This option has several advantages including the following:
For more details, refer to the "Discover Devices" section in Help Documentation.
When you have lot of devices in your environment, grouping the devices based on some logical criteria will come in handy for carrying out operations in bulk. For example, you may create a group containing all cisco routers, or a group containing all cisco switches etc., This would help in carrying out certain common operations with ease.
A group can be created based on some criteria or it could be just a random collection of devices. Refer to the "Grouping Devices" section in the Help Documentation for details.
In practical applications, you may find that the same set of credentials could well be applied 'as they are' to many devices. In such cases, to avoid the cumbersome task of entering the credentials for each device separately, Network Configuration Manager offers the flexibility of creating common credentials and sharing the common credentials among multiple devices. This is called as 'Credential Profile'. For more details, refer to the "Credential-Profiles" section in Help Documentation.
Unauthorized configuration changes often wreak havoc to the business continuity and hence detecting changes is a crucial task. Detection should be real-time to set things right. Network Configuration Manager enables you to detect configuration changes in real-time.
Many devices generate syslog messages whenever their configuration undergoes a change. By listening to these messages, it is possible to detect any configuration change in the device. Network Configuration Manager leverages this change notification feature of devices to provide real-time change detection and tracking. Refer to the "Real-time Configuration Change Detection" section in Help Documentation.
Monitoring the changes done to the configuration is a crucial function in Configuration Management. Network Configuration Manager provides convenient change management options. Once the configuration change in a device is detected, it is important that notifications are sent to those responsible for change management. It also provides option to roll-back the changes.
Network Configuration Manager helps in sending notifications in the following ways:
And these notifications can be sent whenever there happens a change in
You can define change management rules to suit your needs. Refer to the "Change Management & Notification" section in Help Documentation.
Government and industry regulations require IT organizations conform to some standard practices. To become compliant with the regulations such as SOX, HIPAA, CISP, PCI, Sarbanes-Oxley and others, device configurations should conform to the standards specified.
The standards could be anything - ensuring the presence or absence of certain strings, commands or values. Network Configuration Manager helps in automatically checking for compliance to the rules defined. Reports on policy compliance and violations are generated. Refer to the "Compliance Policies" section in Help Documentation..
If you have a large number of devices, carrying out operations such as backup, upload etc., become monotonous, if they are to be done manually. You might also require to perform certain operations at regular intervals. Execution of these operations can be automated - that is they can be scheduled for execution at the required time automatically.
Tasks such as configuration backup, report generation and compliance check for a specific device or group of devices could be scheduled for execution at a future point of time. These tasks can be scheduled for automatic execution at periodic intervals or for one-time execution. Refer to the section on "Schedules" for more details.
Quite often, there arises a need to carry out changes to the running configuration of devices and at times, same set of changes need to be applied to multiple devices. Though network administrators can very well edit the configuration manually, the task can prove to be arduous due to the volume of changes and the repetitive nature of the work. Network Configuration Manager provides a simple solution for this by way of 'Configuration Templates' and 'Scripts'. Refer to the "Automation using Configlets & Scripts" section in Help Documentation.
Network Configuration Manager helps in backing up device configurations. The backedup configurations are properly versioned and stored in the Network Configuration Manager database. For any version of configuration, you can associate a label - that is, a unique tag. As configuration versions keep on changing, you will have difficulty in remembering the version number of a particular good configuration. To avoid that, you can associate the version with a label for easy identification. For details, refer to the "Viewing Device Details" section in Help Documentation.
Network Configuration Manager deals with the sensitive configuration files of devices and in a multi-member work environment, it becomes necessary to restrict access to sensitive information. Fine-grained access restrictions are critical for the secure usage of the product. Network Configuration Manager provides role-based access control to achieve this. By default, you can define any of the following three roles – Administrator, Power User and Operator and define access rules. Refer to the section on "Role-based Access Control" of our Help Documentation for details.