Network Registrar Help

Close Window

Network Registrar includes three roles that have broad powers to create other administrators and groups, add and edit administrator roles, add and edit owners and regions, and manage the servers:

• superuser
• regional-admin at the regional cluster
• ccm-admin at the local cluster

The regional-admin at the regional cluster can also push administrators, groups, roles, owners, and regions to, and pull them from, the local clusters. For the regional-admin subroles required for these operations, see the Regional Administrator Subrole Requirements for Push and Pull Operations topic.

NOTE: If you delete all the user accounts, you can no longer log in to Network Registrar. Click here for an emergency remedy.

• Manage product licenses
• Manage regional administrators
• Manage local administrators
• Manage groups
• Manage roles
• Manage owners
• Manage regions
• Manage encryption keys (local cluster only)
• Manage access control lists (local cluster only)
• Manage servers
• View the CCM datastore change log
• View the MCD datastore change log
• List CCM tasks
• List MCD tasks

Network Registrar deployments consist of multiple local server clusters, and a single regional server cluster for centralized management. Each cluster maintains its own set of licenses and each license type has a separate key. Network Registrar prompts for these license keys on login to the local Web UI and regional Web UI. The licenses manage the following aspects of cluster management:

• local-cluster license -- At the local cluster, sets the permissions to manage the DNS, DHCP, and TFTP protocol servers for the cluster. (You can use an existing Network Registrar Release 6.0 key for this license; all the remaining license types require new keys.)

• central-cluster license -- At the regional cluster, sets the permissions to manage the multiple local clusters at the regional cluster.

• addrspace license -- At the regional cluster, sets the permissions to manage subnets and address blocks from the regional cluster.

• router license -- At the regional cluster, sets the permissions to manage router interface configuration (RIC) servers from the regional cluster.

• node-count license -- At the local cluster, sets the permissions to manage a certain number of IP nodes.

This means that at the regional cluster, you can set the central-cluster, addrspace, and router licenses. All three of these licenses are needed for full access to the regional features. At the local cluster, you can set the local-cluster and node-count licenses. All licenses except the node-count license have product evaluation options.

Use the List/Add Product Licenses page to add licenses for full regional access or additional functionality that you acquire for the product.

If you have read-write privileges as a ccm-admin, you can add and delete product license keys on this page. If you have read-only privileges, you can only list the product license keys.

To add a product license key, obtain the license from Cisco and note the license key given to you for the feature. Add the valid key in the Key field (entry is not case sensitive and the hyphens are optional). There are separate license keys for the following features:

• local-cluster -- Sets the permissions to manage the DNS, DHCP, and TFTP protocol servers for the local cluster.

• central-cluster -- Sets the permissions to manage the local clusters at the regional cluster.

• addrspace -- Sets the permissions to manage subnets and address blocks at the regional cluster.

• router -- Sets the permissions to manage router interface configuration (RIC) servers at the regional cluster.

• node-count -- Sets the permissions to manage a certain number of nodes. A node is defined as an IP address that is: (a) managed directly through a DHCP server in a dynamic range or as a reservation, (b) managed indirectly as part of an on demand address pool, or (c) has a static DNS name associated with it. The maximum node count for the license appears in the Count column once you add the license key.

Enter the license key and click Add License. Once you add the valid key, the key appears in the table below the Key field. Each key is identified by license type (see the previous bulleted list), node count (if a local-cluster or node-count license), expiration date, and whether the license is for a time-limited product evaluation (false indicates that it is not an evaluation license).

To delete a key, click the Delete icon () next to the key name. You cannot modify a license key; you must delete it, then re-enter it.

This page lists the administrators and their passwords, superuser statuses, and group assignments. If you are a regional-admin assigned the authentication subrole and have read-write privileges, you can add, choose for editing, and delete administrators. You can also push administrators to, and pull administrators from, the local clusters. If you have read-only privileges, you can only list and view the administrators.

The page initially shows the admin user, who has superuser access -- full Web UI access, including creating and editing users and license keys -- indicated by a check mark in the Superuser column. Multiple administrators can be superusers, but it is best to limit this kind of access.

NOTE: If you delete all of the user accounts, you can no longer log in to Network Registrar. Click here for an emergency remedy.

On this page:

• To create an administrator, enter or choose:
  • Name -- This value is not case sensitive. Required.

  • Password -- This value is case sensitive. Required.

  • Superuser -- Click a check mark in this box if you want the administrator to have superuser privileges. Optional.

  • Choose which CLI privileges to give the administrator by clicking the value in the NRCMD drop-down list. Limited is the equivalent of assigning a group to the administrator with zone-admin, host-admin, and dhcp-admin privileges for all user interfaces. Full is the equivalent of assigning a group to the administrator with ccm-admin, zone-admin, host-admin, and dhcp-admin privileges for all interfaces.

  • Groups -- Predefined group or groups of roles in which you want to put the administrator. Choose the group name or names in the drop-down list. To choose multiple groups, use your browser's multiselection function. To remove a choice, use your browser's deselection function. Optional.

  After entering or choosing these items, click Add Administrator. The administrator now appears in the list below the entry fields. The list is in alphabetical order.

• At the regional cluster, you can push individual local cluster administrators to the local clusters by clicking Push Admin next to its name, or push all the created administrators by clicking Push All Administrators. You would then choose the clusters and update them on the Push Administrator Data to Local Clusters page.

• At the regional cluster, you can also pull administrators from the replica data of the local clusters. To do this, click Pull Replica Administrators to open the Select Replica Administrator Data to Pull page.

• To edit an administrator, click its name in the list. This opens the Edit Administrator page.

• To delete an administrator, click the Delete icon () next to the name in the list. This opens a Confirm Delete page. Click Delete to confirm, or Cancel to cancel, the deletion.

This page appears if you click Push Admin or Push All Administrators on the List/Add Administrators page. It shows the administrator to be pushed (or All Administrators) and a choice of local clusters to which to push them.

The fields and choices on this page are:

TIP: The cluster chosen and radio buttons are persistent, so that any future operations on this page will retain these settings.

After making these choices, click Push Data to Clusters, or Cancel. This opens the View Push Administrator Data Report page.

This page appears if you click Push Data to Clusters on the Push Administrator Data to Local Clusters page. It shows a read-only summary of the results of the push operation. Click OK to return.

At the regional cluster only, this page appears if you click Pull Replica Administrators on the List/Add Administrators page. It shows a tree view of the regional server's replica data for the local clusters' administrators. The tree has two levels, one for the clusters and one for the administrators in each cluster.

The columns on this page are:

Column	Description
Name	Name of the local cluster and its administrators. If necessary, click the cluster name to open the Edit Server Cluster page. You can also view the administrator data by clicking its name to open the View Administrator page.
Update Replica Data	To update the replica data for the local cluster on the regional cluster, click the Replica icon ().
Pull Data	To pull a specific administrator, choose a synchronization mode, then click Pull Administrator next to its name. To pull all the administrators from the cluster, click Pull All Administrators to open the Report Pull Replica Administrators page. The synchronization modes are: Ensure -- Ensures that the regional cluster has the replica data without affecting any existing data. Replace -- The default: Replaces the data without affecting other objects that are unique to the regional cluster. Exact -- Use with caution, because it puts an exact copy of the object data at the regional cluster, thereby overwriting any existing data and deleting objects that are unique to the regional cluster.

To return to the List/Add Administrators page without making changes. click Cancel.

At the regional cluster only, this page appears when you pull administrators on the Select Replica Administrator Data to Pull page. It shows the changes that would be made were you to run the pull operation. To run the pull operation, click Run to open the Run Pull Replica Administrators page, or to cancel the operation, click Cancel.

At the regional cluster only, this page appears when you click Run on the Report Pull Replica Administrators page. After looking at the actual data, click OK to return to the List/Add Administrators page.

If you are a regional-admin with read-write privileges and assigned the authentication subrole, and you click an administrator's name on the List/Add Administrators page, you can change the administrator's password, superuser access status, and group assignment. If you have read-only privileges, you can only view the administrator information.

You cannot change the administrator's name on this page. However, you can change the password and superuser status. A check mark next to Superuser? indicates that the administrator is a superuser. (Be aware that there should be a limited number of these types of administrators.)

You can re-assign groups in the Groups area of this page. Groups are assigned when they appear in the Selected field and de-assigned when they appear in the Available field. Move one or more groups back and forth between these fields as desired by choosing them and clicking << or >>. The Select All button chooses all items in the Available list so that you can move all of them to the Selected list.

When you finish making changes, click Modify Administrator, or click Cancel to cancel the changes. You return to the List/Add Administrators page.

This page lists the administrators and their passwords, superuser and NRCMD user statuses, and group membership. If you have read-write privileges as a ccm-admin assigned the authorization subrole, you can add, choose for editing, and delete administrators. If you have read-only privileges, you can only list and view the administrators.

The page initially shows the admin user, who has superuser access -- full Web UI and CLI access, including creating and editing users and license keys -- indicated by a check mark in the Superuser column. Multiple administrators can be superusers, but it is best to limit this kind of access to a few users only.

NOTE: If you delete all of the user accounts, you cannot log in to Network Registrar. Click here for an emergency remedy.

The NRCMD column indicates if the administrator has additional CLI (nrcmd program) access, with limited or full functions in the Web UI and CLI:

• limited -- Equivalent to assigning a group to the administrator with zone-admin, host-admin, and dhcp-admin privileges for all user interfaces.

• full -- Equivalent to assigning a group to the administrator with ccm-admin, zone-admin, host-admin, and dhcp-admin privileges for all interfaces.

On this page:

• To add an administrator, enter or choose:
  • Name -- This value is not case sensitive. Required.

  • Password -- This value is case sensitive. Required.

  • Superuser -- Click a check mark in this box if you want the administrator to have superuser privileges. Optional.

  • Choose which CLI privileges to give the administrator by clicking the value in the drop-down list in the NRCMD column. Limited is the equivalent of assigning a group to the administrator with zone-admin, host-admin, and dhcp-admin privileges for all user interfaces. Full is the equivalent of assigning a group to the administrator with ccm-admin, zone-admin, host-admin, and dhcp-admin privileges for all interfaces. Optional.

  • Groups -- Predefined group or groups of roles in which you want to put the administrator. Choose the group name or names in the drop-down list. To choose multiple groups, use your browser's multiselection function. To remove a choice, use your browser's deselection function. Optional.

  After entering or choosing these items, click Add Administrator. The administrator now appears in the list below the entry fields. The list is in alphabetical order.

• To edit an administrator, click its name in the list. This opens the Edit Administrator page.

• To delete an administrator, click the Delete icon () next to the name in the list. This opens a Confirm Delete page. Click Delete to confirm, or Cancel to cancel, the deletion.

If you have read-write privileges as a ccm-admin assigned the authorization subrole, and you click an administrator's name on the List/Add Administrators page, you can change the administrator's password, superuser and additional CLI access status, and groups to which the administrator belongs. If you have read-only privileges, you can only view the administrator information.

You cannot change the administrator's name on this page. However, you can change the password, superuser status, and NRCMD user status. A check mark next to Superuser? indicates that the administrator is a superuser. (Be aware that there should be a limited number of these types of administrators.) The NRCMD user? field requires choosing limited or full. If you choose the null value, the administrator does not have additional CLI access, unless you also assigned superuser status.

You can also re-assign groups in the Groups area of this page. Groups are assigned when they appear in the Selected field and de-assigned when they appear in the Available field. Move one or more groups back and forth between these fields as desired by choosing them and clicking << or >>. The Select All button choose all items in the Available list so that you can move all of them to the Selected list.

When you finish making changes, click Modify Administrator, or click Cancel to cancel the changes. You return to the List/Add Administrators page.

You assign roles to administrators through groups. Note that a group has no function unless it has at least one role assigned to it. Network Registrar provides a set of predefined groups that you can assign to local and regional cluster administrators.

Plan for the group names to reflect the intended role of its members so that you can define the correct administrators with them.

If you have read-write privileges and are assigned the authorization subrole, you can list, create, choose for editing, and delete administrator groups on this page. You can also push groups to, and pull groups from, the local clusters. If you have read-only privileges, you can only list administrator groups on this page.

Network Registrar provides predefined groups that include the corresponding predefined roles at the regional and local clusters, including the aggregate address-mgt-group and dns-mgt-group at the local cluster. (The predefined groups for each cluster are shown in the following tables). Also, an upgrade creates group names that are based on the direct role associations in the previous release.

• To create a group, enter its name and a description, and click one or more roles in the Roles drop-down list. (The group is key to assigning the role to an administrator. If you omit the role assignment here, you should at least add it when you edit the group.) The group name is required, is not case sensitive, but must be unique. After entering these values, click Add Group. The new group (with its role assignment) appears in the list.

• At the regional cluster, you can push individual local cluster groups to the local clusters by clicking Push Group next to its name, or push all the created administrators by clicking Push All Groups. You would then choose the clusters and update them on the Push Group Data to Local Clusters page.

• At the regional cluster, you can also pull groups from the replica data of the local clusters. To do this, click Pull Replica Groups to open the Select Replica Group Data to Pull page.

• To edit a group, click its name in the list. This opens the Edit Administrator Group page.

• To delete a group, click the Delete icon () next to its name in the list. This opens a Confirm Delete page. Click Delete to delete the group, or Cancel to cancel the deletion.

This page appears if you click Push Group or Push All Groups on the List/Add Administrator Groups page. It shows the group to be pushed (or All Groups) and a choice of local clusters to which to push them.

The fields and choices on this page are:

TIP: The cluster chosen and radio buttons are persistent, so that any future operations on this page will retain these settings.

After making these choices, click Push Data to Clusters, or Cancel. This opens the View Push Group Data Report page.

This page appears if you click Push Data to Clusters on the Push Group Data to Local Clusters page. It shows a read-only summary of the results of the push operation. Click OK to return.

At the regional cluster only, this page appears if you click Pull Replica Groups on the List/Add Administrator Groups page. It shows a tree view of the regional server's replica data for the local clusters' groups. The tree has two levels, one for the clusters and one for the groups in each cluster.

The columns on this page are:

Column	Description
Name	Name of the local cluster and its groups. If necessary, click the cluster name to open the Edit Server Cluster page. You can also view the group data by clicking its name to open the View Group page.
Update Replica Data	To update the replica data for the local cluster on the regional cluster, click the Replica icon ().
Pull Data	To pull a specific group, choose a synchronization mode, then click Pull Group next to its name. To pull all the groups from the cluster, click Pull All Groups to open the Report Pull Replica Groups page. The synchronization modes are: Ensure -- Ensures that the regional cluster has the replica data without affecting any existing data. Replace -- The default: Replaces the data without affecting other objects that are unique to the regional cluster. Exact -- Use with caution, because it puts an exact copy of the object data at the regional cluster, thereby overwriting any existing data and deleting objects that are unique to the regional cluster.

To complete the operations, click OK, or Cancel, to return to the List/Add Administrator Groups page.

At the regional cluster only, this page appears when you pull groups on the Select Replica Group Data to Pull page. It shows the changes that would be made were you to run the pull operation. To run the pull operation, click Run to open the Run Pull Replica Groups page, or to cancel the operation, click Cancel

At the regional cluster only, this page appears when you click Run on the Report Pull Replica Groups page. After looking at the actual data, click OK to return to the List/Add Administrator Groups page.

If you have read-write privileges and are assigned the authorization subrole, and you click an administrator group's name on the List/Add Administrator Groups page, you can change the group's name, description, and assigned role or roles. If you have read-only privilege, you can only view the group information. The group name is required, is not case sensitive, but must be unique.

You can re-assign roles for the group in the Roles area. Roles are assigned when they appear in the Selected field and de-assigned when they appear in the Available field. Move one or more roles back and forth between these fields as desired by choosing it or them and clicking << or >>. The Select All button chooses all items in the Available list so that you can move all of them to the Selected list.

When you finish making changes, click Modify Group, or Cancel to cancel the changes. You return to the List/Add Administrator Groups page.

Network Registrar provides two different sets of administrator roles for the regional and local clusters. You use these roles to define the kinds of actions and functions the administrators assigned to them can exercise.

• The regional cluster provides write and read-only roles for user, cluster, router, DNS, DHCP, and address space administration. These roles can be unconstrained or set up with subroles to further limit their functionality.

• The local cluster provides write and read-only roles for various types of user, DNS, and DHCP administration. For example, you might want a zone administrator to manage a specific zone only; otherwise, an administrator assigned the unconstrained zone-admin based role can manage all the zones in the cluster. The Web UI currently lets you create constrained roles for zone and host administrators.

If you have read-write privileges as a regional-admin assigned the authorization subrole, you can list all administrator roles, choose the constrained roles for editing, and delete constrained roles (you cannot delete the predefined base roles). You can derive the constrained roles from the regional-admin, regional-addr-admin, and central-cfg-admin base roles. You can also push roles to, and pull roles from, the local clusters. If you have read-only privileges, you can only choose the administrator roles for viewing.

NOTE: If you assign an administrator multiple roles, one of which is read-only, the read-only functionality takes precedence for that role type.

The following table lists the predefined unconstrained regional cluster roles. You cannot delete these predefined unconstrained roles.

TIP: Click the Refresh icon () next to the Name column heading to refresh the page.

• To create a constrained role, enter its name and choose one of the base roles in the Base Role drop-down list. This opens the Add Role page appropriate to the base role you choose:
  • host-admin -- Add Host Administrator Role page (relevant for local clusters only).

  • zone-admin -- Add Zone Administrator Role page (relevant for local clusters only).

  • ccm-admin -- Add CCM Administrator Role page (relevant for local clusters only).

  • central-cfg-admin -- Add Central Configuration Administrator Role page.

  • regional-addr-admin -- Add Regional Address Space Administrator Role page.

  • regional-admin -- Add Regional Administrator Role page.

• At the regional cluster, you can push individual local cluster roles to the local clusters by clicking Push Role next to its name, or push all the created roles by clicking Push All Roles. You would then choose the clusters and update them on the Push Role Data to Local Clusters page.

• At the regional cluster, you can also pull roles from the replica data of the local clusters. To do this, click Pull Replica Roles to open the Select Replica Role Data to Pull page.

• To edit a role (you can edit both unconstrained and constrained roles), refresh the page, then click the role's name in the list. This opens the Edit Role page corresponding to the Add Role page listed in the "add" function.

• To delete a constrained role, click the Delete icon () next to its name in the list. This opens a Confirm Delete page. Click Delete to delete the constrained role, or Cancel to cancel the deletion. You cannot delete a predefined unconstrained role.

The following subroles of the regional-admin are required to push objects to, or pull objects from, the local clusters.

If you have read-write privileges as a regional-admin assigned the authorization subrole, and you add a central configuration administrator role or choose it to edit it on the List/Add Administrator Roles page, you are redirected to this page to finish creating or editing the role. The Add Central Configuration Administrator Role page appears when you first create the role; the Edit Central Configuration Administrator page appears when you edit the role. If you have read-only privileges and you click the role name on the List/Add Administrator Roles page, you can only view the role information.

NOTE: You must click Add Role on the Add Central Configuration Administrator Role page to finish creating the role.

These are the fields and choices for adding an administrator role:

When you finish making changes to the appropriate fields, click Add Role or Modify Role. (You must click Add Role on the Add Central Configuration Administrator Role page to finish creating the role). To cancel the creation or changes, click Cancel. You return to the List/Add Administrator Roles page. Refresh that page before choosing any more items for editing.

If you have read-write privileges as a regional-admin assigned the authorization subrole, and you create a regional cluster address space administrator role or choose it to edit it on the List/Add Administrator Roles page, you are redirected to this page to finish creating or editing the role. The Add Regional Address Space Administrator Role page appears when you first create the role; the Edit Regional Address Space Administrator page appears when you edit the role. If you have read-only privileges and you click the role name on the List/Add Administrator Roles page, you can only view the role information.

NOTE: You must click Add Role on the Add Regional Address Space Administrator Role page to finish creating the role.

These are the fields and choices for adding an administrator role:

When you finish making changes to the appropriate fields, click Add Role or Modify Role. (You must click Add Role on the Add Regional Address Space Administrator Role page to finish creating the role). To cancel the creation or changes, click Cancel. You return to the List/Add Administrator Roles page. Refresh that page before choosing any more items for editing.

If you have read-write privileges as a regional-admin with the authorization subrole, and you create a regional cluster administrator role or choose it to edit it on the List/Add Administrator Roles page, you are redirected to this page to finish creating or editing the role. The Add Regional Administrator Role page appears when you first create the role; the Edit Regional Administrator page appears when you edit the role. If you have read-only privileges and you click the role name on the List/Add Administrator Roles page, you can only view the role information.

NOTE: You must click Add Role on the Add Regional Administrator Role page to finish creating the role.

These are the fields and choices for adding an administrator role:

When you finish making changes to the appropriate fields, click Add Role or Modify Role. (You must click Add Role on the Add Regional Administrator Role page to finish creating the role). To cancel the creation or changes, click Cancel. You return to the List/Add Administrator Roles page. Refresh that page before choosing any more items for editing.

This page appears if you click Push Role or Push All Roles on the List/Add Administrator Roles page. It shows the role to be pushed (or All Roles) and a choice of local clusters to which to push them.

The fields and choices on this page are:

TIP: The cluster choice and radio buttons are persistent, so that any future operations on this page will retain these settings.

After making these choices, click Push Data to Clusters, or Cancel. This opens the View Push Role Data Report page.

This page appears if you click Push Data to Clusters on the Push Role Data to Local Clusters page. It shows a read-only summary of the results of the push operation. Click OK to return.

At the regional cluster only, this page appears if you click Pull Replica Roles on the List/Add Administrator Roles page. It shows a tree view of the regional server's replica data for the local clusters' roles. The tree has two levels, one for the clusters and one for the roles in each cluster.

The columns on this page are:

Column	Description
Name	Name of the local cluster and its roles. If necessary, click the cluster name to open the Edit Server Cluster page. You can also view the role data by clicking its name to open the View Role page for the role type.
Update Replica Data	To update the replica data for the local cluster on the regional cluster, click the Replica icon ().
Pull Data	To pull a specific role, choose a synchronization mode, then click Pull Role next to its name. To pull all the roles from the cluster, click Pull All Roles to open the Report Pull Replica Roles page. The synchronization modes are: Ensure -- Ensures that the regional cluster has the replica data without affecting any existing data. Replace -- The default: Replaces the data without affecting other objects that are unique to the regional cluster.
Pull Associated Owners (Always Ensure)	Click a check mark in this box if you want to pull the associated owners with the role, if applicable. This option appears only if you have the owner-region subrole enabled for the role.

To return to the List/Add Administrator Groups page without performing a pull operation, click Cancel.

At the regional cluster only, this page appears when you pull roles on the Select Replica Role Data to Pull page. It shows the changes that would be made were you to run the pull operation. To run the pull operation, click Run to open the Run Pull Replica Roles page, or to cancel the operation, click Cancel

At the regional cluster only, this page appears when you click Run on the Report Pull Replica Roles page. After looking at the actual data, click OK to return to the List/Add Administrator Roles page.

If you have read-write privileges as a ccm-admin assigned the authentication subrole, you can list all administrator roles, choose the constrained roles for editing, and delete only the constrained roles (you cannot delete the predefined base roles). You can derive the constrained roles only from the following three base roles:

• host-admin -- host administrator base role
• zone-admin -- zone administrator base role
• ccm-admin -- CCM administrator base role

If you have read-only privileges, you can only choose the administrator roles for viewing.

NOTE: If you assign an administrator multiple roles, one of which is read-only, the read-only functionality takes precedence for that role type.

The following table lists the predefined unconstrained roles and their automatic group assignments. You cannot delete these predefined unconstrained roles.

TIP: Click the Refresh icon () next to the Name column heading to refresh the page.

• To add a constrained role, enter its name and choose the ccm-admin, zone-admin, or host-admin base role in the Base Role drop-down list, then click Add Role. This opens the Add CCM Administrator Role, Add Zone Administrator Role, or Add Host Administrator Role page, depending on which base role you choose.

• To edit a role (you can edit both unconstrained and constrained roles), refresh the page, then click the role's name in the list. This opens the Edit CCM Administrator Role, Edit Zone Administrator Role, or Edit Host Administrator Role page, depending on which base role was applied.

• To delete a constrained role, click the Delete icon () next to its name in the list. This opens a Confirm Delete page. Click Delete to delete the constrained role, or Cancel to cancel the deletion. You cannot delete a predefined unconstrained role.

If you have read-write privileges as a ccm-admin assigned the authorization subrole, and you create a CCM administrator constrained role or click its name to edit it on the List/Add Administrator Roles page, you are redirected to this page to finish creating or editing the role. The Add CCM Administrator Role page appears when you first create the role; the Edit CCM Administrator page appears when you edit the role. If you have read-only privileges and you click the role name on the List/Add Administrator Roles page, you can only view the role information.

NOTE: You must click Add Role on the Add CCM Administrator Role page to finish creating the role.

These are the fields and choices for adding an administrator role:

When you finish making changes to the appropriate fields, click Add Role or Modify Role. (You must click Add Role on the Add CCM Administrator Role page to finish creating the role). To cancel the creation or changes, click Cancel. You return to the List/Add Administrator Roles page. Refresh that page before choosing any more items for editing.

If you have read-write privileges as a ccm-admin assigned the authorization subrole, and you create a zone administrator constrained role or click its name to edit it on the List/Add Administrator Roles page, you are redirected to this page to finish creating or editing the role. The Add Zone Administrator Role page appears when you first create the role; the Edit Zone Administrator page appears when you edit the role. If you have read-only privileges and you click the role name on the List/Add Administrator Roles page, you can only view the role information.

You can assign zone restrictions to the role either by zone name or indirectly by the owner of the zone. Restricting by zones or owner is mutually exclusive.

NOTE: You must click Add Role on the Add Zone Administrator Role page to finish creating the role.

These are the fields and choices for adding an administrator role:

When you finish making changes to the appropriate fields, click Add Role or Modify Role. (You must click Add Role on the Add Zone Administrator Role page to finish creating the role). To cancel the creation or changes, click Cancel. You return to the List/Add Administrator Roles page. Refresh that page before choosing any more items for editing.

If you have read-write privileges as a ccm-admin assigned the authorization subrole, and you create a host administrator constrained role or choose it to edit it on the List/Add Administrator Roles page, you are redirected to this page to finish creating or editing the role. The Add Host Administrator Role appears when you first create the role; the Edit Host Administrator page appears when you edit the role. If you have read-only privileges and you click the role name on the List/Add Administrator Roles page, you can only view the role information.

NOTE: You must click Add Role on the Add Host Administrator Role page to finish creating the role.

These are the fields and choices for adding an administrator role:

When you finish making changes to the appropriate fields, click Add Role or Modify Role. (You must click Add Role on the Add Host Administrator Role page to finish creating the role). To cancel the creation or changes, click Cancel. You return to the List/Add Administrator Roles page. Refresh that page before choosing any more items for editing.

Use the following metacharacters in specifying regular expressions in the following places:

• Host Name Regular Expression field in the Host Restrictions area of the Add or Edit Host Administrator Role page.

• Zone Name Regular Expression field in the Zone Restrictions area of the Add or Edit Zone Administrator Role page.

NOTE: Although the regular expression value matching is case sensitive, the server considers host and zone names as not case sensitive.

If you have read-write privileges as a ccm-admin assigned the authorization subrole, and you click a DHCP administrator role on the List/Add Administrator Roles page, you can edit the role on the Edit DHCP Administrator Role page. If you have read-only privileges and you click the role name on the List/Add Administrator Roles page, you can only view the role information.

When you finish making changes to the appropriate fields, click Modify Role. To cancel the changes, click Cancel. You return to the List/Add Administrator Roles page. Refresh that page before choosing any more items for editing.

If you have read-write privileges as a ccm-admin assigned the authorization subrole, and you click an address block administrator role on the List/Add Administrator Roles page, you can edit the role on the Edit Address Block Administrator Role page. If you have read-only privileges and you click the role name on the List/Add Administrator Roles page, you can only view the role information.

When you finish making changes to the appropriate fields, click Modify Role. To cancel the changes, click Cancel. You return to the List/Add Administrator Roles page. Refresh that page before choosing any more items for editing.

At the local cluster, you can secure dynamic DNS updates using keys. This allows DNS and DHCP servers to verify that requests and responses come from an authorized source. Both the DNS and DHCP servers can read and process transaction signature (TSIG) data from Network Registrar or other servers. TSIG is supported only as of Network Registrar Release 6.0, and in that release only for dynamic DNS updates. As of Network Registrar Release 6.1, support was added for queries and zone transfers.

If you have read-write privileges as a ccm-admin assigned the authentication subrole, you can list, add, choose for editing, and delete TSIG keys. Adding and editing a key involves adding its name, a time skew value, and a secret value. If you have read-only privileges, you can only list the TSIG keys to choose for viewing.

• To add a TSIG encryption key, enter its name, its optional time skew value, and the secret value in the fields provided. After entering the values, click Add Key.

• To edit a key, click the key's name in the list. This opens the Edit Key page.

• To delete a key, click the Delete icon () next to the name in the list. This opens a Confirm Delete page.

You can use the Network Registrar cnr_keygen utility to generate random TSIG key secrets so that you add them to the Secret field on the List/Add Encryption Keys page or Edit Encryption Key page.

Execute the cnr_keygen key generator utility from a DOS prompt, or a Solaris or Linux shell. On Windows, the utility is, by default, in the C:\Program Files\Network Registrar\Local\bin folder. On Solaris and Linux, the utility is in the install-path/usrbin directory. An example of its usage on Solaris is:

$ /opt/nwreg2/local/usrbin/cnr_keygen -n hosta.-hostb.example.com. -b 16 -s 300 
                key "hosta.-hostb.example.com." {
                algorithm hmac-md5;
                secret "xGVCsFZ0/6e0N97HGF50eg==";
                # cnr-time-skew 300;
                # cnr-security-type TSIG;
};

The only required input is the key name. The following table describes the options:

Enter the secret value in the Secret field on the List/Add Encryption Keys page or Edit Encryption Key page. You can also redirect the output to a file if you use the > or >> indicators at the end of the command line. The > overwrites the file and the >> appends to the file. For example:

$ /opt/nwreg2/local/usrbin/cnr_keygen -n example.com. > keyfile.txt
$ /opt/nwreg2/local/usrbin/cnr_keygen -n example.com. >> addtokeyfile.txt

Then, import the file using the following CLI command:

nrcmd> import keys keyfile.txt

Remember to refresh the list of keys using the Refresh icon () if you imported the key file using the CLI.

If you have read-write privileges and you click a key name on the List/Add Encryption Keys page, you can edit the key by modifying its name, time skew value, and secret value. If you have read-only privileges, you can only view the key data.

To unset values the Time Skew and Secret fields, click a check mark in Unset?, then click Unset Fields. When you finish making changes, click Modify Key, or Cancel to cancel the edits. You return to the List/Add Encryption Keys page. Refresh that page before choosing any more items for editing.

At the local cluster, access control lists (ACLs) provide a way to assign security keys to the DNS server or to individual zones. ACLs also provide an easier way to manage dynamic update restrictions with a more versatile form of listing authorized networks and hosts. You can set the following types of ACLs:

• Keys
• IP addresses
• Network addresses
• Other ACLs

If you have read-write privileges as a ccm-admin assigned the authentication subrole, you can list, add, choose for editing, and delete ACLs. Adding and editing an ACL involves adding its name and a match list. If you have read-only privileges, you can only list the ACLs to choose for viewing.

The Match List field can include one or more of the following, separated by commas:

• TSIG keys -- The value must be in the form key name, with the keyword key followed by the name of the key (do not use quotes). For example: key hosta.-hostb.example.com.

• IP addresses -- In the form 192.168.1.2.

• Network addresses -- In the form 192.168.1.0/24 or 192.168.1/24.

• Another ACL -- The ACL must be predefined. Note that you should not delete an ACL that is referenced in another ACL's match list.

Here is how to proceed on this page:

• To add an ACL, enter its name and a match list value. The match list can be a key, IP address, network address, or reference to another ACL. You can combine one or more of these values separated by commas. If adding a TSIG key, use the syntax key keyname. To add the ACL, click Add ACL. The new entry appears in the list.

• To edit an ACL, click the ACL's name in the list. This opens the Edit ACL page.

• To delete an ACL, click the Delete icon () next to the name in the list. This opens a Confirm Delete page. Do not delete an ACL referenced in another ACL's match list.

If you have read-write privileges as a ccm-admin assigned the authentication subrole, and you click an ACL name on the List/Add Access Control Lists page, you can edit the ACL by modifying its match list. If you have read-only privileges, you can only view the match list data.

The match list can be one or more of the following, separated by commas:

• TSIG keys -- The value must be in the form key name, with the keyword key followed by the name of the key (do not use quotes).

• IP addresses -- In the form 192.168.1.2.

• Network addresses -- In the form 192.168.1.0/24 or 192.168.1/24.

• Another ACL -- The ACL must be predefined. Note that you should not delete an ACL that is referenced in another ACL's match list.

Click Modify ACL, or Cancel to cancel. You return to the List/Add Access Control Lists page. Refresh that page before choosing any more items for editing.

At the regional cluster, you can manage the Network Registrar local server agent, CCM server, and RIC server from the Web UI. At the local cluster, you can manage the Network Registrar protocol servers (DNS, DHCP, and TFTP), MCD server, and local server agent. Managing these servers involves determining their current state and health, and starting, stopping, or reloading the protocol servers, if necessary. This function requires the server-management subrole of the ccm-admin role.

NOTE: If you find a server error, investigate the server log file for a configuration error, correct the error, return to this page, then refresh the page.

The columns on this page are:

Column	Description
Name	Description of each server, such as Local Server Agent.
IP Address	IP address of the server, or 127.0.0.1 for the local host.
Type	Type of server -- At the local cluster: CNRAGENT -- local server agent CCM -- CCM server DHCP -- DHCP server DNS -- DNS server TFTP -- TFTP server At the regional cluster: CNRAGENT -- local server agent CCM -- CCM server RIC -- RIC server You can edit the regional cluster CCM server by clicking its name to open the Edit CCM Server page.
State	State of the protocol server, which can be initialized, running, or disabled. If the Web UI cannot determine the state, ? appears.
Health	Relative health of the protocol server, as a color indicator: (10) -- optimal health -- less than optimal health (0) -- stopped. If the Web UI cannot determine the server's health, ? appears. Note that the DHCP server is healthy only if at least one scope of addresses exists.
Statistics	For statistics on the protocol server, click the Statistics icon () in the column. This opens the Statistics for Server page.
View Log	To view the log file for the server, click the View Log icon () in the column. This opens the Log for Server page.
Start/Stop/Reload	Click the: Start icon () to start or restart the server Stop icon () to stop the server Refresh icon () to reload the server. If any of these functions is unsuccessful, a red X appears in the column.

Refresh the list. The page indicates when it was last refreshed. To move from this page, click any other Navigation bar choice.

At the regional cluster, you can edit the CCM server to set its subnet utilization and lease history polling and trimming intervals and related attributes.

NOTE: The prerequisite to capturing subnet utilization and lease history data is that scopes and address ranges are set up, leases issued, and the DHCP server enabled for this data collection. For details, see Querying Subnet Utilization or Querying Lease History.

The CCM server performs background trimming, which trims off the subnet utilization and lease history data older than a certain age at regular intervals. The polling intervals (how often polling occurs) for both are set by default to every four hours. The trimming intervals for both are set by default to 24 hours, and the trimming ages (how far back to go in time before trimming) to 24 weeks. The CCM server retries polling once by default if it fails, and you can set the time offset of specifically when during the day you want polling to occur (using a 24-hour clock value).

NOTE: If you set the trimming interval to zero, no background trimming occurs. Also, the trimming and compacting operations require an administrator to be assigned the database subrole of the regional-admin role.

To trim the data right away or compact it, set the two Trimming/Compacting attributes at the bottom of the page, then use one of the trimming or compacting controls:

• Trim/Compact age -- How far in time to go back to trim the subnet utilization or lease history data, or compact the subnet utilization data. There are no bounds to this value. However, if you set a very small value (such as 1m), it trims or compacts very recent data, which can be undesirable. In fact, if you set it to zero, you lose all of the collected data. Setting the value too high (such as 10y) may end up not trimming or compacting any data.

• Compact interval -- Time interval at which to compact the subnet utilization records older than the Trim/Compact age. This interval can be some multiple of the polling interval; if the compact interval is set to twice the polling interval, for example, it eliminates every other record.

The controls on this page are:

This page shows the log for the specific server chosen by clicking the View Log icon () on the Manage Servers page. This function is available to all users.

The log items are ordered by date and time, historically from earliest to latest, and include the log item description. You can view the items in two different ways by clicking the View Log icon () at the top of the page, and you toggle between the two ways with each click:

• Table view -- Shows the items in a table
• Text view -- Shows the items as plain text so that you can more easily cut and paste the lines to a text file.

Note that both views operate independently. If you step through one view using the arrow keys, you must also step through the other view to get to the same items.

To return to managing the server, click Return to Manage Servers in Table view.

This page shows the statistics for the DHCP, DNS, or TFTP server chosen by clicking the View Log icon () on the Manage Servers page, or on the Manage DHCP Server or Manage DNS Server page. This function is available to all users.

You can click the name of each statistic attribute for an explanation. The DNS server also includes Performance, Query, Security, Error, and Max Counter statistics.

To return to managing the server, click Return to Manage Servers.

The CCM change log lists a set of all changes to the configuration database, in reverse chronological order (most recent first). To view these change logs at the local cluster, you must be a ccm-admin assigned the database subrole. At the regional cluster, you must be a regional-admin assigned the database subrole.

The columns in the change log are:

Click any sequence number in the DBSN column to see more specific information on the change entry. The View CCM Change Set page appears.

TIP: Click the Refresh icon () from time to time to refresh the list with the most recent changes. Note that the page shows up to only the last n number of change log entries, based on what n is set in the Change Page Size field (see the Searching for Items and Changing Page Size topic).

The CCM change set lists the entries for the change log sequence number you choose on the View CCM Change Log page. Change sets are groups of one or more changes to a single object. The top of the page lists the change log item. Below it are the CCM database entries and any tasks created for the change set. You can step through the change log items using the Previous Page () and Next Page () icons next to the DBSN column heading. Note that the next page is actually the lower DBSN.

The columns in the Change Entries table are:

The columns in the Task Entries For Change Set table are:

To return to the View CCM Change Log page, click Return to Change Set List.

The MCD change log lists a set of all changes to the server configuration database, in reverse chronological order (most recent first). To view the MCD change logs at the local cluster, you must be a ccm-admin assigned the database subrole.

The columns in the change log are:

Click any sequence number in the DBSN column to see specific information on the change entry. The View MCD Change Set page appears.

TIP: Click the Refresh icon () from time to time to refresh the list with the most recent changes. Note that the page shows up to only the last n number of change log entries, based on what n is set in the Change Page Size field (see the Searching for Items and Changing Page Size topic)

The MCD change set lists the change sets for the specific change log sequence number you choose on the View MCD Change Log page. Change sets are groups of one or more changes to a single object. The top of the page lists the change log item and below it are the MCD database change sets for this change log item. You can step through the change set items using the Previous Page () and Next Page () icons next to the DBSN column heading. Note that the next page is actually the lower DBSN.

The columns in the Change Entries table are:

The columns in the Task Entries For Change Set table are:

To return to the View MCD Change Log page, click Return to Change Set List.

The CCM task list displays the database tasks associated with object additions and modifications. The tasks refer back to change set DBSN numbers for change logs. To view these change tasks at the local cluster, you must be a ccm-admin assigned the database subrole. At the regional cluster, you must be a regional-admin assigned the database subrole.

You can expand and contract the tree of change sets to display the tasks for each change set by clicking the plus sign (+) next to any of the DBSN sequence numbers. You can expand all the entries by clicking Expand All, or collapse them all by clicking Collapse All. Clicking the DBSN sequence number itself opens the View CCM Change Set page for that change entry.

Refresh this page every time you open it. You can step through the tasks using the Previous Page () and Next Page () icons at the bottom of the page.

The columns in the table are:

The MCD task list displays the database tasks associated with object additions and modifications. The tasks refer back to change set DBSN sequence numbers for change logs.To view the MCD tasks at the local cluster, you must be a ccm-admin assigned the database subrole.

You can expand and contract the tree of change sets to display the tasks for each change set by clicking the plus sign (+) next to any of the DBSN sequence numbers. You can expand all the entries by clicking Expand All, or collapse them all by clicking Collapse All. Clicking the DBSN sequence number itself opens the View MCD Change Set page for that change entry.

Refresh this page every time you open it. You can step through the tasks using the Previous Page () and Next Page () icons at the bottom of the page.

The columns in the table are:

If you accidentally delete all the roles by which you can log in to Network Registrar (those having superuser, ccm-admin, or regional-admin privileges), you can recover by creating a username/password pair in the install-path/conf/priv/local.superusers file. You must create this file, have write access to it, and include a line in it with the format:

username password

After you create the file, stop and restart the Network Registrar server agent. Use this username and password for the next login session.