Web Interface Operations. Avocent SwitchView IP 1020, IP 1020

PDF

Dokument

Reklama

C H A P T E R

Web Interface Operations

On-Board Web Interface

The SwitchView IP 1020 remote access device provides an on-board web interface to manage remote access. The remote access device on-board web interface provides secure “point-and-click” web browser-based access to control any device attached to your SwitchView IP 1020 remote access device.

Table 3.1 shows which operating systems and browsers the SwitchView IP 1020 remote access

device on-board web interface supports.

Table 3.1: On-Board Web Interface Supported Operating Systems and Browsers

Operating System

Windows 2000 Workstation or Server with

Service Pack 2

Yes

Windows Server 2003 Standard, Enterprise or Web Edition

Yes

Browser

Microsoft ®

Internet Explorer version 6.0 SP1 and later

Mozilla version 1.7.3 and later

Firefox version 1.0 and later

Yes

Windows XP Home Edition or Professional Yes

Red Hat Enterprise Linux 3 and 4 No

Sun Solaris 9 and 10

Novell SUSE ® Linux Enterprise 9 and 10

Fedora Core 4 and 5

Mac OS X Tiger (10.4+)

Yes

NOTE: Mac OS X requires Firefox 1.5 or later.

10 SwitchView IP 1020 Remote Access Device Installer/User Guide

Avocent recommends that the browser be kept up-to-date with the latest version.

A Video Viewer window allows you to control the keyboard, monitor and mouse functions of individual target devices connected to the SwitchView IP 1020 remote access device in real time.

You may also use predefined global macros to perform actions within the Video Viewer window.

For instructions on how to use the Video Viewer, see Chapter 4. Once the switch has been installed

and configured as described in Chapter 2 and you have set the IP address, you are ready to begin

regular operation.

Logging into the SwitchView IP 1020 remote access device

NOTE: The SwitchView IP 1020 remote access device boots to the following static IP address, gateway and netmask:

IP address: 192.168.1.254

Gateway: 192.168.1.1

Netmask: 255.255.255.0

Before you can begin a KVM session, you must first login to the SwitchView IP 1020 remote access device on-board web interface.

To log into the SwitchView IP 1020 remote access device on-board web interface:

Launch a web browser.

In the address field of the browser, enter the IP address or host name assigned to the

SwitchView IP 1020 remote access device you wish to access. Use https://xxx.xx.xx.xx or https://hostname as the format.

When the browser makes contact with the switch, enter your username and password, then click Login. The SwitchView IP 1020 Explorer Window will appear.

Chapter 3: Web Interface Operations 11

Figure 3.1: SVIP 1020 Explorer (User Login) Screen

NOTE: The default username is Admin with no password.

The SwitchView IP 1020 Explorer Window

When a user has been logged in and authenticated, the Avocent SwitchView IP 1020 Explorer window appears. From the SwitchView IP 1020 Explorer window, users may view, access and manage their SwitchView IP 1020 remote access device. The window may also be used to specify system settings and change profile settings.

12 SwitchView IP 1020 Remote Access Device Installer/User Guide

Figure 3.2: Avocent SwitchView IP 1020 Explorer Window

Table 3.2: Descriptions for Figure 3.2

Number Description

1 Top option bar: Use the top option bar to bookmark a SwitchView IP 1020 remote access device onboard web interface window, refresh the display of a SwitchView IP 1020 remote access device onboard web interface window, print a web page, log out of a software session or access the Avocent

Technical Support help page. The name of the logged in user appears on the left side of the top option bar.

Side navigation bar: Use the side navigation bar to display the system information you wish to display or edit, which displays in the content area. The side navigation bar also contains icons in the top left corner which, when clicked, expand or collapse all nodes.

Content area: Use the content area to display or make changes to the SwitchView IP 1020 remote access device on-board web interface system.

Using the side navigation bar

You can use the side navigation bar to display windows in which you can specify settings or perform operations. Clicking on a link that does not contain an arrow will display its corresponding window.

Chapter 3: Web Interface Operations 13

Using the top option bar

Bookmarking a window

The SwitchView IP 1020 Explorer window contains a bookmark icon and text in the top option bar.

Bookmarking a window will add a link to the window in the Favorites drop-down menu. You may select the link at any time to quickly access the bookmarked window.

If you bookmark a window and information related to the window changes, this new information will appear in the window when you next display the bookmarked window.

If you click BOOKMARK or the bookmark icon after the SwitchView IP 1020 remote access device on-board web interface session has timed out, the User Login window will open and you must log in again.

To bookmark a window:

In the top option bar, click BOOKMARK or the bookmark icon. The Add Favorite dialog box will appear.

If you wish, type a name for the window. You may also click the Create in button to create or specify a folder in which to place the window.

Click OK to close the Add Favorite dialog box.

Printing a window

All SwitchView IP 1020 remote access device on-board web interface windows contain a print icon in the top option bar.

To print a SwitchView IP 1020 remote access device on-board web interface window:

In the top option bar, click PRINT or the print icon. The Print dialog box will appear.

Specify the options you wish to use for printing the SwitchView IP 1020 remote access device on-board web interface window.

Click Print to print the SwitchView IP 1020 remote access device on-board web interface window and close the Print dialog box.

Refreshing a window

The SwitchView IP 1020 Explorer window may be refreshed at any time by clicking REFRESH or the refresh icon in the top option bar.

Logging out

A user may log out at any time by clicking the logout icon in the top option bar.

14 SwitchView IP 1020 Remote Access Device Installer/User Guide

Managing local accounts

The remote access device web interface provides local and login security through Administratordefined user accounts. By selecting Local Accounts on the side menu bar, Administrators may add and delete users, define user preemption and access levels and change passwords.

User access levels

Accounts have two access levels: user and administrator. Most switch management tasks can only be performed by persons with administrator level access.

Preemption levels

The preemption level of users determine whether they may disconnect another user’s serial or video (KVM) session with a target device.

Remote access device web interface administrators may specify the preemption level for user accounts when an account is created. The preemption level may be changed later.

Preemption levels range from 1-4, with 4 being the highest level. For example, a user with a preemption level of 4 may preempt other level 4 users, as well as those with a level 1, 2 or 3 setting.

To add a new user account (Administrator only):

On the side menu bar, select Local Accounts. The current user list will be displayed.

Click the Add button.

Enter the name and password of the new user in the blanks provided.

Select the preemption and access levels for the new user.

Click the Save button to complete the process.

To delete a user account (Administrator only):

On the side menu bar, select Local Accounts. The current user list will be displayed.

Click the box to the left of each account that you wish to delete, then click the delete button.

To edit a user account (Administrator or active user only):

On the side menu bar, select local accounts. The current user list will be displayed.

Click the name of the user you wish to edit. A user profile will appear.

Edit the user account as needed, then click Save.

Managing device properties

Viewing and changing appliance configuration information

The SwitchView IP 1020 remote access device can report most device properties directly through the remote access device web browser.

Chapter 3: Web Interface Operations 15

NOTE: Users can view all appliance information, but only Administrators can change settings.

Table 3.3: Viewing Appliance Information

To do this:

Display the unit’s name or type

Select this:

Appliance - Overview

Display a list of available target devices, their type and status

Target Devices

Enter, change or display the unit’s IP version, network address, gateway address, subnet mask, MAC address, LAN speed, DHCP enable status or ICMP ping reply status

Appliance - Appliance Settings - Network

NOTE: If DHCP is set to Enabled before changing the IP mode to either IPv4 or IPv6, the user should also verify that the DHCP server has a predetermined IP address associated with the MAC address of the remote access device.

Appliance - Appliance Settings - Versions Display the unit’s current firmware revision for application, boot and Video FPGA

Display a list of active KVM sessions and their duration

Appliance - Appliance Settings - Sessions - Active

View the unit’s part number, serial number and

EID number

Enter or display the unit’s Site, Department and

Location

Enable the inactivity timeout

Appliance - Properties - Identity

Appliance - Properties - Location

Appliance - Appliance Settings - Sessions - KVM settings

Then, click the Enable Inactivity timeout box.

Change the unit encryption level Appliance - Appliance Settings - Sessions - KVM settings

Then select the level of encryption desired for keyboard/ mouse signals and then video signals.

Configuring LDAP

LDAP is a vendor-independent protocol standard used for accessing, querying and updating a directory using TCP/IP. Based on the X.500 Directory Services model, LDAP is a global directory structure that supports strong security features including authentication, privacy and integrity.

If individual user accounts are stored on an LDAP-enabled directory service, such as Active

Directory, you can use the directory service to authenticate users. The default values given for the

LDAP search and query parameters are defined for use with Active Directory.

The settings made in the OBWI let you configure your authentication configuration parameters.

The software sends the username, password and other information to the appliance, which then determines whether the user has permission to view or change configuration parameters for the appliance in the OBWI.

16 SwitchView IP 1020 Remote Access Device Installer/User Guide

NOTE: Unless otherwise specified, the LDAP default values should be used unless Active Directory has been reconfigured. Modifying the default values may cause LDAP authentication server communication errors.

LDAP Overview parameters

On the LDAP Overview page in the OBWI, you can configure the LDAP authentication priority and the parameters that define LDAP server connection information.

LDAP authentication priority

In the LDAP Priority section of the LDAP Overview page, you can disable LDAP, or you can set the authentication priority by choosing whether local authentication or LDAP authentication should happen first.

To configure LDAP authentication priority parameters:

Select Appliance - Appliance Settings - User Accounts - LDAP Accounts - Overview.

Select either LDAP Disabled, LDAP before Local or LDAP after Local for the LDAP Priority.

Click Save.

LDAP servers

The Address fields specify the host names or IP addresses of the primary and secondary LDAP servers. The second LDAP server is optional.

The Port fields specify the User Datagram Protocol (UDP) port numbers that communicate with the

LDAP servers. The default value is 389 for non-secure LDAP and 636 for secure LDAP (LDAPS).

The default Port ID is automatically entered by the software when an access type is specified.

The Access Type radio buttons specify how a query is sent to each LDAP target device. When using LDAP, all usernames, passwords and other information sent between an appliance and LDAP server are sent as non-secure clear text. Use LDAPS for secure encrypted communication between an appliance and LDAP server.

Chapter 3: Web Interface Operations 17

Figure 3.3: LDAP Overview Page in the OBWI

To configure LDAP server parameters:

Select Appliance - Appliance Settings - User Accounts - LDAP Accounts - Overview.

Identify the primary and secondary server address, port and access type in the appropriate fields or radio buttons.

Click Save.

LDAP Search parameters

On the LDAP Search page, you can configure the parameters used when searching for LDAP directory service users.

Use the Search DN field to define an administrator-level user that the appliance uses to log into the directory service. Once the appliance is authenticated, the directory service grants it access to the directory to perform the user authentication queries specified on the Query page. The default values are cn=Administrator, cn=Users, dc=yourDomainName and dc=com and may be modified. For

18 SwitchView IP 1020 Remote Access Device Installer/User Guide example, to define an administrator Distinguished Name (DN) for test.view.com, type cn=Administrator, cn=Users, dc=test, dc=view , and dc=com.

This Search DN field is a required field unless the directory service has been configured to enable anonymous search, which is not the default. Each Search DN value must be separated by a comma.

The Search Password field is used to authenticate the administrator or user specified in the Search

DN field.

Use the Search Base field to define a starting point from which LDAP searches begin. The modifiable default values are dc=yourDomainName and dc=com. For example, to define a search base for test.com, type dc=test, dc=com . Each Search Base value must be separated by a comma.

The UID Mask field specifies the search criteria for User ID searches of LDAP target devices. The format should be in the form <name>=<%1>. The default value is sAMAccountName=%1, which is correct for use with Active Directory. This field is required for LDAP searches.

Figure 3.4: LDAP Search Page in the OBWI

Chapter 3: Web Interface Operations 19

To configure LDAP search parameters:

Select Appliance - Appliance Settings - User Accounts - LDAP Accounts - Search.

Enter the appropriate information in the Search DN, Search Password, Search Base and UID

Mask fields.

Click Save.

NOTE: These options cannot be changed if the LDAP Priority is set to LDAP Disabled on the Overview screen.

LDAP Query parameters

On the LDAP Query page, you can configure the parameters used when performing user authentication queries.

The appliance performs two different types of queries. Query Mode (Appliance) is used to authenticate administrators attempting to access the appliance itself. Query Mode (Target Device) is used to authenticate users that are attempting to access attached target devices. Additionally, each type of query has three modes that utilize certain types of information to determine whether or not a VCS user has access to an appliance or connected target devices. See Appliance and Target

Device Query Modes on page 21 for detailed information on each mode.

You can configure the following settings on the LDAP Query page:

• The Query Mode (Appliance) parameters determine whether or not a user has access to the appliance.

• The Query Mode (Target Device) parameters determine whether or not a user has user access to target devices connected to an appliance. The user does not have access to the appliance.

• The Group Container, Group Container Mask and Target Mask fields are only used for group query modes and are required when performing an appliance or device query.

• The Group Container field specifies the organizational unit (ou) created in Active Directory by the administrator as the location for group objects. Group objects are Active Directory objects that can contain users, computers, contacts and other groups. Group Container is used when

Query Mode is set to Group Attribute. Each group object, in turn, is assigned members to associate with a particular access level for member objects (people, appliances and target devices). The access level associated with a group is configured by setting the value of an attribute in the group object. For example, if the Notes property in the group object is used to implement the access control attribute, the Access Control Attribute field on the LDAP Query page should be set to info. Setting the Notes property to KVM User Admin causes the members of that group to have user administration access to the appliances and target devices that are also members of that same group.

• The Notes property is used to implement the access control attribute. The value of the Notes property, available in group and user objects shown in Active Directory Users and Computers

(ADUC), is stored internally in the directory, in the value of the info attribute. ADUC is a

Microsoft Management Console snap-in for configuring Active Directory. It is started by

20 SwitchView IP 1020 Remote Access Device Installer/User Guide selecting Start - Programs - Administrative Tools -Active Directory Users and Computers. This tool is used to create, configure and delete objects such as users, computers and groups.

• The Group Container Mask field defines the object type of the Group Container, which is normally an organizational unit. The default value is “ou=%1”.

• The Target Mask field defines a search filter for the target device. The default value is

“cn=%1”.

• The Access Control Attribute field specifies the name of the attribute that is used when the query modes are set to Attribute. The default value is info.

Figure 3.5: LDAP Query Page in the OBWI

To configure LDAP query parameters:

Select Appliance - Appliance Settings - User Accounts - LDAP Accounts - Query.

Select either Basic, User Attribute or Group Attribute for the Appliance Query Mode and the

Target Device Query Mode.

Enter the appropriate information in the Group Container, Group Container Mask, Target Mask and Access Control Attribute fields.

Click Save.

NOTE: These options cannot be changed if the LDAP Priority is set to LDAP Disabled on the Overview screen.

Chapter 3: Web Interface Operations 21

Appliance and Target Device Query Modes

One of three different modes can each be used for Query Mode (Appliance) and Query Mode

(Target Device):

• Basic – A username and password query for the user is made to the directory service. If they are verified, the user is given administrator access to the appliance and any attached target devices for Query Mode (Appliance), or to any selected target device for Query Mode (Target

Device).

• User Attribute – A username, password and Access Control Attribute query for the appliance user is made to the directory service. The Access Control Attribute is read from the user object

(the user account) in Active Directory.

If the KVM Appliance Admin value is found, the user is given appliance administrator access to the appliance and any attached target devices for Query Mode (Appliance), or to any selected target device for Query Mode (Target Device). If the KVM User Admin value is found, the user is given User administrator access to the appliance and attached target devices for Query Mode (Appliance), or to any selected target device for Query Mode (Target Device).

The following are examples showing how the KVM Appliance Admin and KVM User Admin attribute modes are defined in Active Directory for a user named John Smith, stored in the

ADUC. You can access the ADUC by selecting Start - Programs - Administrative Tools -

Active Directory Users and Computers.

Figure 3.6: Active Directory - KVM User

22 SwitchView IP 1020 Remote Access Device Installer/User Guide

Figure 3.7: Active Directory - KVM Appliance Admin

• Group Attribute – A username, password and group query is made to the directory service for an appliance and attached target devices when using Query Mode (Appliance), or for a selected target device when using Query Mode (Target Device). If a group is found containing the user and the appliance name, the user is given access to the appliance or attached target devices, depending on the group contents, when using Query Mode (Appliance). If a group is found containing the user and target device IDs, the user is given access to the selected target device connected to the appliance when using Query Mode (Target Device).

Groups can be nested to a maximum of 16 levels in depth. Use nesting to create groups within other groups. For example, you may have a top-level group named Computers that contains a member named R&D, which is a group. The R&D group may contain a member named

Domestic, which is a group, and so on.

The following is an example of groups defined in Active Directory.

Chapter 3: Web Interface Operations 23

Figure 3.8: Active Directory - Define Groups

Setting up Active Directory for performing queries

Before you can use any of the querying modes for units, you must first make changes to Active

Directory so that the selected querying mode can assign the applicable authorization level for the user.

To set up group queries:

Log into Windows with administrator privileges.

Open Active Directory software.

Create an organizational unit to be used as a group container.

Create an object in Active Directory with a name identical to the switching system name for querying appliances (specified in the Appliance Overview screen of the OBWI), or identical to the attached target devices for querying target devices. The name must match exactly, including case.

The appliance names and target device names used for group queries are stored in the appliance. The appliance name specified in the Appliance Overview screen of the OBWI and target device names must identically match the object names in Active Directory. Each appliance name and target device name may be comprised of any combination of upper-case and lower-case letters (a-z, A-Z), digits (0-9) and hyphens (-). You cannot use spaces and periods (.) or create a name that consists entirely of digits. These are Active Directory constraints.

24 SwitchView IP 1020 Remote Access Device Installer/User Guide

NOTE: The factory default name in earlier versions contains a space that must be removed by editing the switching system name in the Appliance Overview screen of the OBWI.

Create one or more groups under the group container organizational unit.

Add the usernames and target device and appliance objects to the groups you created in step 5.

Specify the value of any attribute being used to implement the access control attribute. For example, if you are using info as the attribute in the Access Control Attribute field and using the

Notes property in the group object to implement the access control attribute, the value of the Notes attribute in Active Directory may be set to one of the three available access levels (KVM User,

KVM User Admin or KVM Appliance Admin) for the group object. The members of the group may then access the appliances and target devices at the specified access level.

Rebooting the appliance

Periodically, such as after an upgrade, you may need to reboot the SwitchView IP 1020 remote access device.

To reboot the SwitchView IP 1020 remote access device remotely:

From the side navigation bar, select Appliance - Overview.

When the appliance overview window appears, click Tools - Reboot Appliance.

Managing local accounts

The SwitchView IP 1020 remote access device on-board web interface provides local and login security through administrator-defined user accounts. By selecting Local Accounts on the side menu bar, administrators may add and delete users, define user preemption and access levels and change passwords.

Access levels

When a user account is added to the on-board web interface, the user may be assigned to any of the following access levels:

• Appliance administrators

• User administrators

• Users

Chapter 3: Web Interface Operations 25

Table 3.4: Allowed Operations by Access Level

Access Level

Operation

Configure on-board web interface system-level settings Yes

Configure access rights

Add, change and delete user accounts

Change your own password

Access target device

Yes

No Yes

Yes, for all access levels

Yes

Yes, all target devices

Yes, for users and user administrators only

Yes

Yes, all target devices

Yes

Yes, if allowed

To add a new user account (administrator only):

On the side menu bar, select Local Accounts. The current user list will be displayed.

Click the Add button.

Enter the name and password of the new user in the blanks provided.

Select the preemption and access levels for the new user.

Click the Save button to complete the process.

To delete a user account (administrator only):

On the side menu bar, select Local Accounts. The current user list will be displayed.

Click the box to the left of each account that you wish to delete, then click the Delete button.

To edit a user account (administrator or active user only):

On the side menu bar, select Local Accounts. The current user list will be displayed.

Click the name of the user you wish to edit. A user profile will appear.

Edit the user account as needed, then click Save.

Preemption levels

The preemption level of users determines whether they may disconnect another user’s serial or video (KVM) session with a target device.

SwitchView IP 1020 remote access device on-board web interface administrators may specify the preemption level for user accounts when an account is created. Preemption levels range from 1-4,

26 SwitchView IP 1020 Remote Access Device Installer/User Guide with 4 being the highest level. For example, a user with a preemption level of 4 may preempt other level 4 users, as well as those with a level 1, 2 or 3 setting.