Purpose

Cisco Control Center enables you to do these tasks:

• Manage subscriber data, that is, find or create and edit information about your subscribers.

• View subscriber sessions.

• View system sessions.

• Populate custom reference data (CRD) tables.

URL and Port

HA: https://<lbvip01>:443

Protocol

HTTPS/HTTP

Accounts and Roles

There are two levels of administrative roles supported for Control Center: Full Privilege and View Only. The logins and passwords for these two roles are configurable in LDAP or in /etc/broadhop/authentication-password.xml.

• Full Privilege Admin Users: These users can view, edit, and delete information and can perform all tasks. Admin users have access to all screens in Control Center.

• View Only Admin Users: These users can view information in Control Center, but cannot edit or change information. View only administrators have access to a subset of screens in the interface.

Purpose

The Custom Reference Data (CRD) REST API enables the query of, creation, deletion, and update of CRD table data without the need to access the Control Center GUI. The CRD APIs are available using an HTTP REST interface. The specific APIs are outlined in a later section in this guide.

URL and Port

HA: https:// <lbvip01>:443/custrefdata

A validation URL is:

HA: https:// <lbvip01>:8443/custrefdata

Protocol

HTTPS/HTTP

Accounts and Roles

Security and account management is accomplished by using the haproxy mechanism on the platform Policy Director (LB) by defining user lists, user groups, and specific users.

On Cluster Manager: /etc/puppet/modules/qps/templates/etc/haproxy/haproxy.cfg

Configure HAProxy

Update the HAProxy configuration to add authentication and authorization mechanism in the CRD API module.

1. Back up the /etc/haproxy/haproxy.cfg file.

2. Edit /etc/haproxy/haproxy.cfg on lb01/lb02 and add a userlist with at least one username and password as shown:

   userlist <userlist name>
   user <username1> password <encrypted password>

   Use the following step to generate a encrypted password hash:

   1. Execute /var/qps/install/current/scripts/bin/support/generate_encrypted_password.sh script to get encrypted password.

   2. After script execution the encrypted password will be like below.

      
      +--------------------------------------------------------------------------------------------------------------+
      | Fri May 29 11:43:47 UTC 2020                                                                                             |
      | Encrypted key                                                                                                                         |
      | $6$bc732ffd2a5ad85e$dYuQfGowAsAS6E2mQyWgGtcSUY4IKss11.4AY1u852gGwZzr4Y54rBdkHG6zQytFPXXDJGwknx.IYIeDeW.jP.                                                                                                          |
      +--------------------------------------------------------------------------------------------------------------+
      

3. Add the following line in frontend https-api to enable Authentication and Authorization for CRD REST API and create a new backend server as crd_api_servers to intercept CRD REST API requests:

   mode http 
   acl crd_api path_beg -i /custrefdata/ 
   use_backend crd_api_servers if crd_api 
   backend crd_api_servers 
          mode http 
          balance roundrobin 
          option httpclose 
          option abortonclose 
          server qns01_A qns01:8080 check inter 30s 
          server qns02_A qns02:8080 check inter 30s 

4. Update frontend https_all_servers by replacing api_servers with crd_api_servers for CRD API as follows:

   acl crd_api path_beg -i /custrefdata/

   use_backend crd_api_servers if crd_api

5. Edit /etc/haproxy/haproxy.cfg on lb01/lb02 as follows:

   1. Add at least one group with user in userlist created in Step 2 as follows:

      group qns-ro users readonly

      group qns users apiuser

   2. Add the following lines to the backend crd_api_servers:

      acl authoriseUsers http_auth_group(<cps-user-list>) <user-group>

      http-request auth realm CiscoApiAuth if !authoriseUsers

   Map the group created in Step 5 with the acl as follows:

   acl authoriseUsers http_auth_group(<cps-user-list>) <user-group>

6. Add the following in the backend crd_api_servers to set read-only permission (GET HTTP operation) for group of users:

   http-request deny if !METH_GET authoriseUsers

HAProxy Configuration Example:

userlist cps_user_list 
        group qns-ro users readonly 
        group qns users apiuser 
      user readonly password  
$6$xRtThhVpS0w4lOoS$pyEM6VYpVaUAxO0Pjb61Z5eZrmeAUUdCMF7D75B 

XKbs4dhNCbXjgChVE0ckfLDp4T2CsUzzNkoqLRdn7RbAAU1 
      user apiuser password 
$6$xRtThhVpS0w4lOoS$pyEM6VYpVaUAxO0Pjb61Z5eZrmeAUUdCMF7D75B 

XKbs4dhNCbXjgChVE0ckfLDp4T2CsUzzNkoqLRdn7RbAAU1 
frontend https-api 
   description API 
   bind lbvip01:8443 ssl crt /etc/ssl/certs/quantum.pem 
 
   mode http 
   acl crd_api path_beg -i /custrefdata/ 
   use_backend crd_api_servers if crd_api 
 
   default_backend api_servers 
   reqadd X-Forwarded-Proto:\ https if { ssl_fc } 
 
frontend https_all_servers 
description Unified API,CC,PB,Grafana,CRD-API,PB-AP 
bind lbvip01:443 ssl crt /etc/ssl/certs/quantum.pem no-sslv3 no-tlsv10 
ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:! 
aNULL:!eNULL:!LOW:!     3DES:!MD5:!EXP:!PSK:!SRP:!DSS 
mode http 
acl crd_api path_beg -i  /custrefdata/ 
use_backend crd_api_servers if crd_api 
backend crd_api_servers 
        mode http 
        balance roundrobin 
        option httpclose 
        option abortonclose 
        server qns01_A qns01:8080 check inter 30s 
        server qns02_A qns02:8080 check inter 30s 
        acl authoriseReadonlyUsers http_auth_group(cps_user_list) qns-ro 
        acl authoriseAdminUsers http_auth_group(cps_user_list) qns 
        http-request auth realm CiscoApiAuth if !authoriseReadonlyUsers !authoriseAdminUsers 
        http-request deny if !METH_GET authoriseReadonlyUsers 

Note	The haproxy.cfg file is generated by the Puppet tool. Any manual changes to the file in lb01/lb02 would be reverted if the pupdate or vm-init scripts are run.

Purpose

Grafana is a metrics dashboard and graph editor used to display graphical representations of system, application KPIs, bulkstats of various CPS components.

URL and Port

HA: https://<lbvip01>:9443/grafana

Protocol

HTTPS/HTTP

Accounts and Roles

An administrative user account must be used to add, modify, or delete Grafana dashboards or perform other administrative actions.

Refer to the Graphite and Grafana and Prometheus and Grafana chapters in this guide for details on adding or deleting these user accounts.

Purpose

Haproxy is a frontend IP traffic proxy process in lb01/lb02 that routes the IP traffic for other applications in CPS. The details of individual port that haproxy forwards is already described in other individual sections.

As per the Diameter configuration done, haproxy-diameter statistics will bind to one of the configurations and that URL will be displayed in about.sh output. For various options for Diameter configuration, refer to Diameter Related Configuration section in CPS Installation Guide for VMware.

More information about HAProxy is provided in the HAProxy.

Documentation for HAProxy is available at: #http://www.haproxy.org/#docs

URL and Port

To view statistics, open a browser and navigate to the following URL:

• For HAProxy Statistics: http://<diameterconfig>:5540/haproxy?stats

• For HAProxy Diameter Statistics: http://<diameterconfig>:5540/haproxy-diam?stats

Accounts and Roles

Not applicable.

Purpose

Java Management Extension (JMX) interface can be used for managing and monitoring applications and system objects.

Resources to be managed / monitored are represented by objects called managed beans (mbeans). MBean represents a resource running in JVM and external applications can interact with mbeans through the use of JMX connectors and protocol adapters for collecting statistics (pull); for getting/setting application configurations (push/pull); and notifying events like faults or state changes (push).

CLI Access

External applications can be configured to monitor application over JMX. In addition to this, there are scripts provided by application that connects to application over JMX and provide required statistics/information.

Port

pcrfclient01/pcrfclient02:

• Control Center: 9045

• Policy Builder: 9046

lb01/lb02:

• iomanager: 9045

• Diameter Endpoints: 9046, 9047, 9048...

qns01/qns02/qns... : 9045

Ports should be blocked using firewall to prevent access from outside the CPS system.

Accounts and Roles

Not applicable.

Purpose

Logstash is a process that consolidates the log events from CPS nodes into pcrfclient01/pcrfclient02 for logging and alarms. The logs are forwarded to CPS application to raise necessary alarms and the logs are stored at /var/log/logstash/logstash.log.

If logstash in not monitoring, then check the Policy Server (qns) process using monit summary.

monit summary
Monit 5.25.1 uptime: 19h 45m
┌─────────────────────────────────┬────────────────────────────┬───────────────┐
│ Service Name                    │ Status                     │ Type          │
├─────────────────────────────────┼────────────────────────────┼───────────────┤
│ sav-pcrfclient01                │ OK                         │ System        │
├─────────────────────────────────┼────────────────────────────┼───────────────┤
│ whisper                         │ OK                         │ Process       │
├─────────────────────────────────┼────────────────────────────┼───────────────┤
│ stale-session-cleaner-helper    │ Initializing               │ Process       │
├─────────────────────────────────┼────────────────────────────┼───────────────┤
│ stale-session-cleaner           │ Initializing               │ Process       │
├─────────────────────────────────┼────────────────────────────┼───────────────┤
│ snmpd                           │ OK                         │ Process       │
├─────────────────────────────────┼────────────────────────────┼───────────────┤
│ qns-2                           │ OK                         │ Process       │
├─────────────────────────────────┼────────────────────────────┼───────────────┤
│ qns-1                           │ OK                         │ Process       │
├─────────────────────────────────┼────────────────────────────┼───────────────┤
│ corosync                        │ OK                         │ Process       │
├─────────────────────────────────┼────────────────────────────┼───────────────┤
│ memcached                       │ OK                         │ Process       │
├─────────────────────────────────┼────────────────────────────┼───────────────┤
│ logstash                        │ OK                         │ Process       │
├─────────────────────────────────┼────────────────────────────┼───────────────┤
│ collectd                        │ OK                         │ Process       │
├─────────────────────────────────┼────────────────────────────┼───────────────┤
│ carbon-relay                    │ OK                         │ Process       │
├─────────────────────────────────┼────────────────────────────┼───────────────┤
│ carbon-cache-c                  │ OK                         │ Process       │
├─────────────────────────────────┼────────────────────────────┼───────────────┤
│ carbon-cache-b                  │ OK                         │ Process       │
├─────────────────────────────────┼────────────────────────────┼───────────────┤
│ carbon-cache                    │ OK                         │ Process       │
├─────────────────────────────────┼────────────────────────────┼───────────────┤
│ carbon-aggregator-b             │ OK                         │ Process       │
├─────────────────────────────────┼────────────────────────────┼───────────────┤
│ carbon-aggregator               │ OK                         │ Process       │
├─────────────────────────────────┼────────────────────────────┼───────────────┤
│ auditrpms.sh                    │ OK                         │ Process       │
├─────────────────────────────────┼────────────────────────────┼───────────────┤
│ aido_client                     │ OK                         │ Process       │
├─────────────────────────────────┼────────────────────────────┼───────────────┤
│ monitor-qns-2                   │ OK                         │ File          │
├─────────────────────────────────┼────────────────────────────┼───────────────┤
│ monitor-qns-1                   │ OK                         │ File          │
├─────────────────────────────────┼────────────────────────────┼───────────────┤
│ kpi_trap                        │ OK                         │ Program       │
├─────────────────────────────────┼────────────────────────────┼───────────────┤
│ db_trap                         │ OK                         │ Program       │
├─────────────────────────────────┼────────────────────────────┼───────────────┤
│ failover_trap                   │ OK                         │ Program       │
├─────────────────────────────────┼────────────────────────────┼───────────────┤
│ qps_process_trap                │ OK                         │ Program       │
├─────────────────────────────────┼────────────────────────────┼───────────────┤
│ admin_login_trap                │ OK                         │ Program       │
├─────────────────────────────────┼────────────────────────────┼───────────────┤
│ vm_trap                         │ OK                         │ Program       │
├─────────────────────────────────┼────────────────────────────┼───────────────┤
│ qps_message_trap                │ OK                         │ Program       │
├─────────────────────────────────┼────────────────────────────┼───────────────┤
│ ldap_message_trap               │ OK                         │ Program       │
├─────────────────────────────────┼────────────────────────────┼───────────────┤
│ logstash_process_status         │ OK                         │ Program       │
├─────────────────────────────────┼────────────────────────────┼───────────────┤
│ monitor_replica                 │ OK                         │ Program       │
├─────────────────────────────────┼────────────────────────────┼───────────────┤
│ mon_db_for_lb_failover          │ OK                         │ Program       │
├─────────────────────────────────┼────────────────────────────┼───────────────┤
│ mon_db_for_callmodel            │ OK                         │ Program       │
├─────────────────────────────────┼────────────────────────────┼───────────────┤
│ cpu_load_monitor                │ OK                         │ Program       │
├─────────────────────────────────┼────────────────────────────┼───────────────┤
│ cpu_load_trap                   │ OK                         │ Program       │
├─────────────────────────────────┼────────────────────────────┼───────────────┤
│ gen_low_mem_trap                │ OK                         │ Program       │
├─────────────────────────────────┼────────────────────────────┼───────────────┤
│ auto_heal_server                │ OK                         │ Program       │
└─────────────────────────────────┴────────────────────────────┴───────────────┘

Note	On pcrfclient node, if Policy Server (qns) process is not running, 'logstash_process_status' program stops the logstash process so that the alarm is raised from another pcrfclient node.

CLI Access

There is no specific CLI interface for logstash.

Protocol

TCP and UDP

Ports

TCP: 5544, 5545, 7546, 6514

UDP: 6514

Accounts and Roles

Not applicable.

Purpose

In CPS 14.0.0 and higher releases, SSSD based authentication is supported, allowing users to authenticate against an external LDAP server and gain access to the CPS CLI. SSSD RPMs and default sssd.conf file is installed on each CPS VM when you perform a new installation or upgrade CPS.

For more information, refer to the CPS Installation Guide for VMware.

/etc/monit.d/sssd file has been added with the following content so that SSSD is monitored by monit:

check process sssd with pidfile /var/run/sssd.pid
start program = "/etc/init.d/sssd start" with timeout 30 seconds
stop program = "/etc/init.d/sssd stop" with timeout 30 seconds

Also /etc/logrotate.d/sssd file has been added to rotate the SSSD log files. Here is the default configuration:

“
/var/log/sssd/*.log {
    daily
    missingok
    notifempty
    sharedscripts
    nodateext
    rotate 5
    size 100M
    compress
    delaycompress
    postrotate
        /bin/kill -HUP `cat /var/run/sssd.pid 2>/dev/null` 2> /dev/null || true
    endscript
}
“

Use the monit summary command to view the list of services managed by monit. Here is an example:

monit summary
The Monit daemon 5.17.1 uptime: 4d 2h 22m 

Process 'whisper'                   Running
Process 'sssd'                      Running
Process 'snmptrapd'                 Running
Process 'snmpd'                     Running
Program 'vip_trap'                  Status ok
Program 'gr_site_status_trap'       Status ok
Process 'redis'                     Running
Process 'qns-4'                     Running
Process 'qns-3'                     Running
Process 'qns-2'                     Running
Process 'qns-1'                     Running
File 'monitor-qns-4'                Accessible
File 'monitor-qns-3'                Accessible
File 'monitor-qns-2'                Accessible
File 'monitor-qns-1'                Accessible
Process 'memcached'                 Running
Process 'irqbalance'                Running
Process 'haproxy-diameter'          Running
Process 'haproxy'                   Running
Process 'cutter'                    Running
Process 'corosync'                  Running
Program 'cpu_load_monitor'          Status ok
Program 'cpu_load_trap'             Status ok
Program 'gen_low_mem_trap'          Status ok
Process 'collectd'                  Running
Process 'auditrpms.sh'              Running
System 'lb01'                       Running

Important

Setting of other configuration files to support LDAP based authentication and the changes required in sssd.conf file as per the customer deployment is out of scope of this document. For more information, consult your Cisco Technical Representative.

Restriction

Grafana support LDAP authentication over httpd and does not use SSSD feature. Due to this, if LDAP server is down then grafana is not accessible for LDAP users.

CLI Access

No CLI is provided.

Port

Port number is not required.

Purpose

MongoDB is used to manage session storage efficiently and address key requirements: Low latency reads/writes, high availability, multi-key access and so on.

CPS support different models of mongo database based on CPS deployment such as, HA or Geo-redundancy. The database list is specific to your deployment.

To rotate the MongoDB logs on the Session Manager VM, open the MongoDB file by executing the following command:

cat /etc/logrotate.d/mongodb

You will have output as similar to the following:

{
daily
rotate 5
copytruncate
create 640 root root
sharedscripts
postrotate
endscript
}

In the above script the MongoDB logs are rotated daily and it ensures that it keeps the latest 5 backups of these log files.

HA

The standard definition for supported replica-set defined in configuration file. This configuration file is self-explanatory which contains replica-set, set-name, hostname, port number, data file path and so on.

Location: /etc/broadhop/mongoConfig.cfg

Table 1. HA MongoDB

Database Name	Port Number	Primary DB Host	Secondary DB Host	Arbiter	Purpose
session_cache	27717	sessionmgr01	sessionmgr02	pcrfclient01	Session database
balance_mgmt	27718	sessionmgr01	sessionmgr02	pcrfclient01	Quota/Balance database
audit	27725	sessionmgr01	sessionmgr02	pcrfclient01	Reporting database
spr	27720	sessionmgr01	sessionmgr02	pcrfclient01	USuM database
cust_ref_data	27717	sessionmgr01	sessionmgr02	pcrfclient01	Custom Reference Data

Note	The list provided in the Table 1 is for reference purposes only.

Note	The port number configuration is based on what is configured in each of the respective Policy Builder plug-ins. Refer to the Plug-in Configuration chapter of the CPS Mobile Configuration Guide for correct port number and ports defined in mongo configuration file.

CLI Access

Use the following commands to access the MongoDB CLI:

HA

Login to pcrfclient01 or pcrfclient02 and run: diagnostics.sh --get_replica_status

This command will output information about the databases configured in the CPS cluster.

Note	If a member is shown in an unknown state, it is likely that the member is not accessible from one of other members, mostly an arbiter. In that case, you must go to that member and check its connectivity with other members. Also, you can login to mongo on that member and check its actual status.

Protocol

Not applicable.

Port

Not applicable.

Accounts and Roles

Restrict MongoDB access for Readonly Users: If firewall is enabled on system, then on all VMs for all readonly users, IP table rule will be created for outgoing connections to reject outgoing traffic to MongoDB replica sets.

For example, rule similar to the following is created.

REJECT tcp -- anywhere sessionmgr01 tcp dpt:27718 owner GID match qns-ro reject-with icmp-port-unreachable

With this, qns-ro user has restricted MongoDB access on sessionmgr01 on port 27718. Such rules are added for all readonly users who are part of qns-ro group for all replica sets.

Purpose

By default, admin replica-set holds the following databases:

• sharding: This database holds the following information:

  • Session sharding: Session shard seeds and its databases.

  • Session type counters: Session statistics information. For example, number of sessions present in each shard for Gx, Rx, Sy, and so on.

  • Session compression dictionary data: Compression object data of session fields data.

  • Memcache rings data: Memcached rings and their sets data. Every set has two sessionmgr VMs followed with memcached port number.

  • Secondary Key sharding: Secondary Key shards seeds and its databases.

  • License data: Session license information.

• scheduler: This database holds the information about rebuilding the secondary key tasks data. When you execute rebuild sk rings or rebuild sk db, application creates the scheduled tasks to the “tasks” collection in this database. Once tasks are created, application pulls the information from the collection and execute those taks.

• diameter: This database holds the information about connected peers (inbound and outbound) connected to which load balance instance. This also holds the history of peers connected (start) and disconnected (stop) followed with timestamps.

• queueing: This database holds the information about internal TCP connection between the Policy Director (LB) and Policy Server (QNS) VMs in and out queue data.

• clusters: This database holds the information about sitenames and IP address of the ADMIN replica-set members in hosts collections.

• policy_trace: This database holds the information about the particular subscriber traces. To view the traces, you need to enable the trace for a particular subscriber.

• Keystore: This database holds the information about the redis key store configuration.

Note

There are separate configurations available for the Trace Database and Endpoint Database in Cluster configuration under Policy Builder. If Trace Database is configured, "policy_trace" database is stored in configured replica-set. If Endpoint Database is configured, "diameter, and queueing" databases are stored in configured replica-set. For more information on Trace Database and Endpoint Database configuration, see Adding an HA Cluster section in CPS Mobile Configuration Guide.

Note

In GR deployment, if any site looses the connectivity (Internal/Replication) to the ADMIN replica-set, then the following impact is observed: If Admin/Endpoint databases are shared across all the sites. There can be communication issue between the Policy Server (QNS) and Policy Director (LB) VMs. As the application is not able to get to the connected peers to send the processing messages, timeouts or drops can be observed. Cross site messaging of stale session RARs from Policy Director (LB) of failed site to Policy Director (LB) of peer of running site fails. If Endpoint databases are not shared (co-located locally ) across all the sites. There is no communication issue between the Policy Server (QNS) and Policy Director (LB) VMs. As the application is able to get to the connected peers information locally to send the processing messages. Cross site messaging of stale session RARs from Policy Director (LB) of failed site to Policy Director (LB) of peer running site fails and vice versa. Grafana does not display the session counters properly. If subscriber trace is enabled, the policy_trace cannot insert the trace information about the configured subscribers.

Protocol

Not applicable.

Port

Not applicable.

Accounts and Roles

Not applicable.

Purpose

CPS is based on Open Service Gateway initiative (OSGi) and OSGi console is a command-line shell which can be used for analyzing problems at OSGi layer of the application.

CLI Access

Use the following command to access the OSGi console:

telnet <ip> <port>

The following commands can be executed on the OSGi console:

ss : List installed bundle status.

start <bundle-id> : Start the bundle.

stop <bundle-id> : Stop the bundle.

diag <bundle-id> : Diagnose the bundle.

osgi> listalarms
Active Application Alarms
id=1000 sub_id=3001  event_host=lb02  status=down date=2017-11-22,10:47:34,
051+0000  msg="3001:Host: site-host-gx Realm: site-gx-client.com is down"
id=1000 sub_id=3001  event_host=lb02  status=down date=2017-11-22,10:47:34,
048+0000  msg="3001:Host: site-host-sd Realm: site-sd-client.com is down"
id=1000 sub_id=3001  event_host=lb01  status=down date=2017-11-22,10:45:17,
927+0000  msg="3001:Host: site-server Realm: site-server.com is down"
id=1000 sub_id=3001  event_host=lb02  status=down date=2017-11-22,10:47:34,
091+0000  msg="3001:Host: site-host-rx Realm: site-rx-client.com is down"
id=1000 sub_id=3002  event_host=lb02  status=down date=2017-11-22,10:47:34,
111+0000  msg="3002:Realm: site-server.com:applicationId: 7:all peers are down"

Memcache Commands

Use the following OSGi commands to get the information related to memcache:

Note	The memcache commands have been deprecated in CPS 20.1.0 and later releases.

Table 4. Memcache Commands

Command	Description
disableCacheAudit	Used to disable the complete memcached audit. Default: enable
enableCacheAudit	Used to enable the regular memcached audit. Default: enable
cacheAuditStatus	Used to display the current regular memcached audit status.
enableFtsBasedCacheAudit	Used to enable Full Table Scan (FTS) threshold based audit. This works only when audit feature is enabled. Default: true
disableFtsBasedCacheAudit	Used to disable the FTS Threshold based audit.
ftsBasedCacheAuditStatus	Used to display the current FTS based memcached audit status.
currentCacheAuditInterval	Used to display current periodic memcached audit interval.
updateCacheAuditInterval Audi Interval[Integer]	Used to update the regular memcached audit interval. Audit interval cannot be less than 360 minutes.
currentFTSCacheAuditThreshold	Used to provide the current FTS threshold for FTS based memcached audit.
setFTSCacheAuditThreshold ThresholdVal[Integer]	Used to specify the FTS threshold value for FTS based memcached audit. This value cannot be less than 25% of total allowed FTS per qns.
nextCacheAuditSchedule	Used to display next regular memcached audit schedule when memcache audit is done.

Ports

pcrfclientXX:

• Control Center: 9091

• Policy Builder: 9092

lbXX:

• iomanager: 9091

• Diameter Endpoints: 9092, 9093, 9094 ...

qnsXX: 9091

Ports should be blocked using a firewall to prevent access from outside the CPS cluster.

Accounts and Roles

Not applicable.

Purpose

Policy Builder is the web-based client interface for the configuration of policies in Cisco Policy Suite.

URL and Port

HA: https://<lbvip01>:7443/pb

Protocol

HTTPS/HTTP

Accounts and Roles

Initial accounts are created during the software installation. Refer to the CPS Operations Guide for commands to add users and change passwords.

Purpose

To allow initial investigation into a Proof of Concept API for managing a CPS System and Custom Reference Data related through an HTTPS accessible JSON API.

CLI Access

This is an HTTPS/Web interface and has no Command Line Interface.

URL and Port

API: http://<Cluster Manager IP>:8458

Documentation: http://<Cluster Manager IP>:7070/doc/index.html

Accounts and Roles

Initial accounts are created during the software installation. Refer to the CPS Operations Guide for commands to add users and change passwords.

Purpose

Enhanced log processing is provided using Rsyslog.

Rsyslog logs Operating System (OS) data locally (/var/log/messages etc.) using the /etc/rsyslog.conf and /etc/rsyslog.d/*conf configuration files.

rsyslog outputs all WARN level logs on CPS VMs to /var/log/warn.log file.

On all nodes, Rsyslog forwards the OS system log data to lbvip02 via UDP over the port defined in the logback_syslog_daemon_port variable as set in the CPS deployment template (Excel spreadsheet). To download the most current CPS Deployment Template (/var/qps/install/current/scripts/deployer/templates/QPS_deployment_config_template.xlsm), refer to the CPS Installation Guide for VMware or CPS Release Notes for this release.

Additional information is available in the Logging chapter of the CPS Troubleshooting Guide. Refer also to http://www.rsyslog.com/doc/ for the Rsyslog documentation.

CLI Access

Not applicable.

Protocol

UDP

Port

6514

Accounts and Roles

Account and role management is not applicable.

Apache™ Subversion (SVN) is the versioning and revision control system used within CPS. It maintains all the CPS policy configurations and has repositories in which files can be created, updated and deleted. SVN maintains the file difference each time any change is made to a file on the server and for each change it generates a revision number.

In general, most interactions with SVN are performed via Policy Builder.

CLI Access

Use the following commands to access SVN:

From a remote machine with the SVN client installed, use the following commands to access SVN:

Get all files from the server:

svn checkout --username <username> --password <password> <SVN Repository URL> <Local Path>

Example:

svn checkout --username broadhop --password broadhop http://pcrfclient01/repos/configuration/root/configuration

If <Local Path> is not provided, files are checked out to the current directory.

Store/check-in the changed files to the server:

svn commit --username <username> --password <password> <Local Path> -m “modified config”

Example:

svn commit --username broadhop --password broadhop /root/configuration -m “modified config”

Update local copy to latest from SVN:

svn update <Local Path>

Example:

svn update /root/configuration/

Check current revision of files:

svn info <Local Path>

Example:

svn info /root/configuration/

Note	Use svn --help for a list of other commands.

Protocol

HTTP

Port

80

Accounts and Roles

Purpose

CPS 7.0 and above has been designed to leverage the Terminal Access Controller Access Control System Plus (TACACS+) to facilitate centralized management of users. Leveraging TACACS+, the system is able to provide system-wide authentication, authorization, and accounting (AAA) for the CPS system.

Further the system allows users to gain different entitlements based on user role. These can be centrally managed based on the attribute-value pairs (AVP) returned on TACACS+ authorization queries.

CLI Access

No CLI is provided.

Port

CPS communicates to the AAA backend using IP address/port combinations configured by the operator.

Account Management

Configuration is managed by the Cluster Management VM which deploys the /etc/tacplus.conf and various PAM configuration files to the application VMs. For more account management information, refer to TACACS+ Service Requirements.

For more information about TACACS+, refer to the following links:

• TACAC+ Protocol Draft: http://tools.ietf.org/html/draft-grant-tacacs-02

• Portions of the solution reuse software from the open source pam_tacplus project hosted at: https://github.com/jeroennijhof/pam_tacplus

For information on CLI commands, refer to Accessing the CPS CLI.

Purpose

Unified APIs are used to reference customer data table values.

URL and Port

HA: https://<lbvip01>:8443/ua/soap

Protocol

HTTPS/HTTP

Accounts and Roles

Currently there is no authorization for this API