Setting Up Domains and Securing Applications

With the Users and Groups window, you can add an individual user to a group or you can add several users to a group at one time. Each of these procedures is described in the following subsections.

Adding an Individual User to a Group

To connect an individual user to a group, perform the following steps:

Step 1 From the Users and Groups window, select an individual username from the User scroll window. (See Figure 7-4.)

The username is highlighted.

Step 2 Select Options>Add User to Groups.

The Group List window appears. See Figure 7-11.

Figure 7-11 : Group List Window

Step 3 Select the group name to which you want to add the user.

Step 4 Click on Apply to connect this username with the selected group.

The username is added to the group, and the Group List window appears.

Adding Several Users to a Group

To connect several users to a group at once, perform the following steps:

Step 1 From the Users and Groups window (see Figure 7-4), select the desired group name from the Groups scroll window.

The group name is highlighted.

Step 2 Select Options>Add User to Groups.

The User List window appears. (See Figure 7-12.)

Figure 7-12 : User List Window

Step 3 Select the usernames you want to add to this group.

Step 4 Click on Apply to connect the users selected with this group.

The users are connected to the groups you indicate, and you return to the Users and Groups window.

Viewing User and Group Relationships

Use the Users and Groups Summary window to check your group assignments. This window allows you to sort by groups or users. Sorting by groups provides a quick look at all user accounts with this group's privileges. Sorting by users provides a quick look at all groups associated with one user.

To display your user or group assignments, perform the following steps:

Step 1 From the Users and Groups window, select Options>Summary. (See Figure 7-4.)

The Users and Groups Summary window appears. (See Figure 7-13.)

Figure 7-13 : Users and Groups Summary Window

Step 2 Click on the small button above the scroll bar to display a drop-down menu.

The drop-down menu allows you to change the sort category in order to view by Groups or by Users.

Step 3 Select the way you want to sort the accounts (by Groups or by Users).

The Users and Groups Summary window displays the newly selected sort category information.

Step 4 Click on OK to exit the window.

Connecting Domains to Groups

Domains are logical collections of devices, just as groups are collections of people. A device is any network entity that contains an SNMP agent. (Devices generally include routers, bridges, or communication servers.)

Creating domains gives you the flexibility to establish a new sphere of security because groups can be assigned privileges according to their connected domain. By incorporating the use of domains, you can allow a local network center to assign privileges for its own devices. The ability of a user to exercise one or more features of a given application is now defined by the group and domain association.

Upon installation, CiscoWorks automatically creates a World domain, which contains all the devices listed in the database. The World domain is predefined and cannot be deleted.

Depending on your needs, you can establish and modify other domains by using the Domain Manager application. For example, consider a large business whose expanding financial hub is located in New York. As a network administrator, you determine a need to protect the New York device configurations and inventories by securing the CiscoWorks applications that can potentially access them. Therefore, you establish the group of devices in New York as its own domain.

Users of the World domain can look into the New York domain to see its devices, but are denied any other privileges. However, New York users are also part of the World domain, so they can exercise the same privileges granted to others in the World domain.

Privileges to devices for users in New York depends on the definitions set by the New York-based network administrator. The network administrator assigns the application-specific privileges (such as read-only or execute) by using the Security Manager application.

Although a user can only belong to one group, a single group can contain many users. By applying this feature, the New York-based administrator decides to govern access to devices even further. Application-specific privileges can be assigned to groups to grant or restrict varying levels of access. In the New York domain, the administrator determines that only users of a specified group are granted the special privileges to modify the configuration files on selected routers. Next, the administrator creates a second group whose users are granted the application-specific privileges needed to modify other router information. Groups with other levels of privileges to other applications can be created or modified as the needs of the domain determine.

The net result is that corporate-wide users can view devices in the New York domain. But access to New York devices is restricted to its connected groups. Each connected group is further restricted to the application-specific privileges that were granted by the New York-based network administrator who toggled on each application-specific privilege in Security Manager.

If you want to learn how to create additional domains and the other functions of Domain Manager, go to the next section, "How Domain Manager Works." If you want to connect the default World domain (or other domains that may already exist) to the groups you established in the previous section, perform the following steps:

Step 1 From the Options menu of Security Manager, select Domains and Groups.

The Domains and Groups window appears, as shown in Figure 7-14.

Figure 7-14 : Domains and Groups Window

Step 2 From the Domains and Groups window, select the domain name to which you want to assign group-wide privileges.

If the domain already has privileges of one or more groups assigned, the names appear in the Groups column. The domain you select contains the devices you specified in the Domain Manager application. If necessary, use the Domain Manager application to review the devices to which you are about to assign privileges.

Step 3 From the Domains and Groups window, select Options>Add Domain to Groups.

The Group List window appears. (See Figure 7-15.)

Figure 7-15 : Group List Window

Step 4 From the Group List window, select the name of the group to which you want to add the specified domain.

Step 5 Click on Apply to confirm your action. (Click Cancel to close the window without saving any changes.)

If you clicked the Apply button, the devices in the specified domain are part of the group you selected in the previous step. Users in this group can now apply their assigned privileges to access devices in the connected domain.

How Domain Manager Works

The Domain Manager application enables you to assign meaningful alias names to groups of devices. Using the various alias domain names you created to manage your network, you can use other CiscoWorks applications to focus on certain domains in order to complete network management tasks.

You can use the Security Manager application to assign group privileges to certain domains. For example, a domain named "North America" might only allow a group called "America-admin" to perform configuration management on these Cisco devices.

Other applications can use domains efficiently to perform their tasks. The Domain Manager communicates domain information to the following CiscoWorks applications:

• AutoInstall Manager (read/write domain information)
  

• Configuration Management (read-only domain information)
  

• Device Management (read/write domain information)
  

• Security Manager (read-only domain information)
  

• Software Management (read-only domain information)
  

The Domain Manager sends update messages to these applications, so the domain name and device information is accurate at any given time.

Domain Manager Window

Figure 7-16 illustrates the Domain Manager window. Table 7-3 describes the components in this window.

Figure 7-16 : Domain Manager Window

Table 7-3 : Domain Manager Window Components

Component	Subcomponent	Description
File	Import Print Exit	Opens the File Selection Box window, which allows you to open an ASCII file to import domain information. Prints a snapshot of the current window. Exits the current window.
Security	Change User Privileges	Enables you to log in again as another user. Displays the current user's security privileges.
Help	On Version On Domain Manager	Displays the CiscoWorks version information for this application. Provides help text on the current window.
Domains		Displays list of current groups of devices.
Domain Devices		Displays list of current devices within the domain selected.
New	OK Add Devices Copy Domain Cancel	Creates a domain containing the added devices or, if no devices are added, creates a domain without any devices. Creates new domain names. Allows you to add devices or copy an existing domain. When a new domain name is specified, allows you to copy all the device information from an existing domain to the newly established one. Closes the window without saving any changes.
Modify		Allows you to edit the name of an existing domain.
Delete		Deletes domain names from the scroll window. Updates other CiscoWorks applications on any changes to domain list.
Add		Adds devices to the selected domain.
Remove		Removes devices from the selected domain.

Domain Manager Task List

You can perform the following tasks with the Domain Manager application:

• Add new domains and associate devices with the domain
  

  • Acquire devices from the domain World (created automatically upon installation)
    

  • Acquire by copying an existing domain
    

• Add a new domain from an ASCII file
  

• Changing the name of an existing domain
  

• Edit domains (adding or deleting devices)
  

• Delete domains
  

• Viewing domain information
  

Adding New Domains and Associating Devices with Domains

Part of the process of creating domains, or groups of devices associated to an alias, is to first create a domain name and then associate devices with that domain name.

There are three ways to add a new domain to CiscoWorks:

• Create a new domain name and associate all devices with that domain
  

• Copy an existing domain, rename it, and edit the domain devices
  

• Import an ASCII file that contains domain information
  

The following sections provide procedures for each of the tasks.

Creating a New Domain

To create a domain, perform the following steps:

Step 1 Select Domain Manager.

On SunNet Manager, select Tools>Domain Manager.

On HP OpenView, select Administer>Security>Domain Mgr.

The Domain Manager window appears. (See Figure 7-16.)

Step 2 From the Domain Manager window, click on New. (See Figure 7-16.)

The New Domain window appears.

Step 3 Enter the new domain name in the text field.

Step 4 Click on Add Devices.

The Adding Devices window appears.

Step 5 Select the devices you want to include in this domain and click on OK.

The Domain Manager window updates automatically to include the new domain name and the devices included in that domain.

Creating a Domain from an Existing One

You can create a new domain by copying devices from one or more existing domains. To copy an existing domain, perform the following steps:

Step 1 From the Domain Manager window, click on New. (See Figure 7-16.)

The New Domain window appears.

Step 2 Enter the new domain name in the text field.

Step 3 Click on Copy Domain.

The Copy Domain window appears.

Step 4 Select the domain or domains you want to copy and click on OK.

For example, select the World domain and click on the OK button. The Domain Manager window updates automatically to include the new domain name and the devices included in that domain.

Creating and Importing an ASCII File with Domain Information

To create an ASCII file that contains domain data and import it into the Domain Manager, perform the following steps:

Step 1 Create a file (for example, "domain_new") using a text editor, such as vi, textedit (Sun only), or vuepad (HP-UX only).

Step 2 Add the following information to the new file in the proper sequence (the first line is essential for checking the format of the imported file):

# CiscoWorks 2.0 Domain Creation File

New_domain_name

Device_1

Device_2

Device_3

Device_4

Step 3 Save the new file.

Step 4 To import the ASCII file into Domain Manager, select File>Open.

The File Selection window displays.

Step 5 If you know the directory path to the ASCII file, enter the pathname including the ASCII file name into the Filter field. If you do not know the path, select one of the directories displayed in the Directories scroll window and then select the filename from the Files scroll window.

Your selection appears in the Selection field.

Step 6 When the selection field displays the correct file to import, click on the OK button.

The Domain Manager window updates automatically to include the new domain name and the devices included in that domain. If some devices do not display in the Domain Devices scroll window, check to ensure that the missing device names are valid.

Changing the Name of an Existing Domain

To change the name of an existing domain, perform the following steps:

Step 1 From the Domain Manager window, select the domain name you want to modify and click on Modify. (See Figure 7-16.)

The Edit Domain Name window appears.

Step 2 Enter the new domain name in the text field and click on OK.

The Copy Domains window appears.

Step 3 Select the domain or domains you want to copy and click on OK.

The Domain Manager window updates automatically to include the new domain name and the devices included in that domain.