Configuring a NIC Scenario (SRC CLI)
The following topics provide procedures for configuring a NIC scenario with the SRC CLI:
Defining the NIC Configuration to Use
The OnePop configuration scenario is the default configuration for NIC. If you want to use another configuration scenario, you first clear data for the configuration scenario and change the scenario name that identifies the scenario, see Changing NIC Configurations (SRC CLI).
When you select a NIC configuration scenario, the software adds the default configuration for most properties. You can modify the NIC properties, including those for agents.
We recommend that you change only those statements visible at the basic editing level. Contact Juniper Professional Services or Juniper Customer Support before you change any of the NIC statements not visible at the basic editing level.
To specify a NIC configuration scenario for NIC to use:
Make sure that the NIC component is running.
user@host> show component Installed Components Name Version Status ... nic Release: 7.0 Build: GATEWAY.A.7.0.0.0168 running ...
From configuration mode, access the statement that configures a NIC configuration scenario, and specify the name of a scenario.
[edit]user@host# edit shared nic scenario nameFor example:
[edit]user@host# edit shared nic scenario OnePopLoginView the default configuration for the configuration scenario. For example:
[edit shared nic scenario OnePopLogin] user@host# show
hosts { DemoHost { configuration { hosted-resolvers "/realms/login/A1, /realms/login/B1, /realms/login/C1, /realms/login/D1, /realms/ip/A1, /realms/ip/B1, /realms/ip/C1"; hosted-agents "/agents/LoginNameVr, /agents/VrSaeId, /agents/IpLoginName, /agents/PoolVr"; } } OnePopBO { configuration { hosted-resolvers "/realms/login/A1, /realms/login/C1, /realms/ip/A1, /real ms/ip/C1"; hosted-agents /agents/VrSaeId; } } OnePopH1 { configuration { hosted-resolvers "/realms/login/B1, /realms/login/D1, /realms/ip/B1"; hosted-agents "/agents/LoginNameVr, /agents/IpLoginName, /agents/PoolVr"; } } } agents { VrSaeId { configuration { directory { search-base o=Network,<base>; search-filter (objectclass=umcVirtualRouter); search-scope 2; server-url ldap://127.0.0.1:389/; backup-servers-url ; principal cn=nic,ou=Components,o=Operators,<base>; ' '' '' '' '' '' '' 'credentials ********; } } } LoginNameVr { configuration { sae-plug-in { event-filter "(&(!(PA_USER_TYPE=INTF))(!(PA_LOGIN_NAME=[None])))"; number-of-events-sent-in-a-synchronization-call 50; } } } IpLoginName { configuration { sae-plug-in { number-of-events-sent-in-a-synchronization-call 50; } } } PoolVr { configuration { directory { search-base o=Network,<base>; search-filter (objectclass=umcVirtualRouter); search-scope 2; server-url ldap://127.0.0.1:389/; backup-servers-url ; ' '' '' '' '' '' '' 'principal cn=nic,ou=Components,o=Operators,<base>; ' '' '' '' '' '' '' 'credentials ********; } } } }(Optional) Update logging configuration.
See Logging for SRC Components Overview.
By default, NIC has the following logging enabled for a NIC host:
logger file-1 {file {filter !ConfigMgr,!DES,/debug-;filename var/log/nicdebug.log;rollover-filename var/log/nicdebug.alt;maximum-file-size 10000000;}}logger file-2 {file {filter /info-;filename var/log/nicinfo.log;}}logger file-3 {file {filter /error-;filename var/log/nicerror.log;}}For each agent that the NIC configuration scenario includes, if needed update NIC agent configuration to define properties specific to your environment, such as directory properties.
Each type of agent has different configuration properties. The output from the show command identifies the type of agent under the agents hierarchy. For example:
VrSaeId { configuration { directory {LoginNameVr { configuration { sae-plug-in {
Configuring Directory Agents
Use the following configuration statements to configure NIC directory agents:
To configure a directory agent:
From configuration mode, access the statement that specifies the configuration for the agent.
[edit]user@host# edit shared nic scenario name agents agent configuration directoryFor example:
[edit]user@host# edit shared nic scenario OnePopLogin agents VrSaeId configuration directoryReview the default configuration for the agent. For example:
[edit shared nic scenario OnePopLogin agents VrSaeId configuration directory] user@host# show search-base o=Network,<base>; search-filter (objectclass=umcVirtualRouter); search-scope 2; server-url ldap://127.0.0.1:389/; directory-backup-urls ; principal cn=nic,ou=Components,o=Operators,<base>; credentials ********;
(Optional) Change the distinguished name (DN) of the location in the directory from which the agent should read information.
[edit shared nic scenario name agents name configuration directory]user@host# set search-base search-baseFor example:
[edit shared nic scenario OnePop agents PoolVr configuration directory]user@host# set search-base o=myNetwork,<base>You can use <base> in the DN to refer to the globally configured base DN.
(Optional) Change the directory search filter that the agent should use.
[edit shared nic scenario name agents name configuration directory]user@host# set search-filter search-filterFor example:
[edit shared nic scenario OnePop agents PoolVr configuration directory]user@host# set search-filter objectclass=umcVirtualRouter(Optional) Change the location in the directory relative to the base DN from which the NIC agent can retrieve information.
[edit shared nic scenario name agents name configuration directory]user@host# set search-scope (0 | 1 | 2)where:
0—Entry specified in the search-base statement
1—Entry specified in the search-base statement and objects that are subordinate by one level
2—Subtree of entry specified in the search-base statement
For an installation on a Solaris platform, specify the location of the directory in URL string format.
[edit shared nic scenario name agents name configuration directory]user@host# set server-url ldap:// host:portNumberFor example, to specify the directory on a C Series Controller:
[edit shared nic scenario OnePop agents PoolVr configuration directory]user@host# set server-urlldap://127.0.0.1:389/List the URLs of redundant directories. Separate URLs with semicolons.
[edit shared nic scenario name agents name configuration directory]user@host# set directory-backup-urls backup-servers-urlsSpecify the DN that contains the username that the directory server uses to authenticate the NIC agent.
[edit shared nic scenario name agents name configuration directory]user@host# set principal principalFor example:
[edit shared nic scenario OnePop agents PoolVr configuration directory]user@host# set principal cn=nic,ou=Components,o=Operators,<base>Specify the password that the directory server uses to authenticate the NIC agent.
[edit shared nic scenario name agents name configuration directory]user@host# set credentials credentialsRestart the NIC agent.
user@host>request nic restart agent name name
Configuring SAE Client Agents
Use the following configuration statements to configure NIC SAE client agents:
To configure an SAE client agent:
From configuration mode, access the statement that specifies the configuration for the agent.
[edit]user@host# edit shared nic scenario name agents agent configuration sae-clientFor example:
[edit]user@host# edit shared nic scenario OnePopLoginPull agents IpSaeId configuration sae-clientReview the default configuration for the agent. For example:
[edit shared nic scenario OnePopLoginPull agents IpSaeId configuration sae-client] user@host# show principal cn=umcadmin,<base>; credentials ********; subscriber-id user-ip-address; search-base ou=sspadmurls,o=Servers,; search-filter (objectclass=corbaObjectReference); search-scope sub-tree; server-url ldap://127.0.0.1:389/; directory-backup-urls "";
(Optional) Change the authentication DN.
For example:
[edit shared nic scenario OnePopLoginPull agents IpSaeId configuration sae-client ]user@host# set principal cn=umcadmin, <base>(Optional) Change the password that the NIC uses to access the directory. For example:
[edit shared nic scenario OnePopLoginPull agents IpSaeId configuration sae-client ]user@host# set credentials —Specify the part of the directory that you want the network publisher to search.
[edit shared nic scenario OnePopLoginPull agents IpSaeId configuration sae-client ]user@host# set search-base search-base(Optional) Change the URL that identifies the primary Juniper Networks database to which the NIC agent connects.
[edit shared nic scenario OnePopLoginPull agents IpSaeId configuration sae-client ]user@host# set server-url server-urlSpecify the type of subscriber ID that the agent uses to identify the subscriber. The type can be user-ip-address, dn, login-name, or interface-name. For example, to specify an IP address:
[edit shared nic scenario OnePopLoginPull agents IpSaeId configuration sae-client ]user@host# set subscriber-id use-ip-address
Configuring SAE Plug-In Agents
By default, the CORBA naming server on a C Series Controller uses port 2809. The NIC host is configured to communicate with this naming server; you do not need to change JacORB properties.
Use the following configuration statements to configure NIC SAE plug-in agents:
If you plan to change the event filter for the agent, make sure that you are familiar with:
Plug-in attributes and values
See Types of Tracking Plug-Ins.
Filter syntax
See the documentation for the SAE CORBA Remote API in the SAE Core API documentation on the Juniper Networks website at:
https://www.juniper.net/documentation/software/management/src/api-index.html.
To configure an SAE plug-in agent:
From configuration mode, access the statement that specifies the configuration for the agent.
[edit]user@host# edit shared nic scenario name agents agent configuration sae-plug-inFor example:
[edit]user@host# edit shared nic scenario OnePopLogin agents LoginNameVr configuration sae plug-inReview the default configuration for the agent. For example:
[edit shared nic scenario OnePopLogin agents LoginNameVr configuration sae-plug-in] user@host# show event-filter "(&(!(PA_USER_TYPE=INTF))(!(PA_LOGIN_NAME=[None])))"; number-of-events-sent-in-a-synchronization-call 50;
(Optional) Change an LDAP filter that change the events that the agent collects.
[edit shared nic scenario name agents agent configuration sae-plug-in]user@host# set event-filter event-filterTypically, you do not need to change this value. If you do want to filter other events, use the format pluginAttribute=attributeValue format for event filters, where:
pluginAttribute—Plug-in attribute name
attributeValue—Value of filter
For example:
[edit shared nic scenario name agents agent configuration sae-plug-in]user@host# set event-filter PA_USER_TYPE=INTF
Specify the number of events that the SAE sends to the agent at one time during state synchronization.
[edit shared nic scenario name agents agent configuration sae-plug-in]user@host# set number-of-events number-of-eventsFor example:
[edit shared nic scenario OnePopLogin agents LoginNameVr configuration sae plug-in]user@host# set number-of-events 50
Configuring the SAE to Communicate with SAE Plug-In Agents When You Use NIC Replication
For each NIC host that uses SAE plug-in agents, configure a corresponding external plug-in for the SAE. By default, the SAE plug-in agents share events with the single SAE plug-in. You must also configure the SAE to communicate with the SAE plug-in agent in each NIC host that you use in the NIC replication.
For information about configuring an external plug-in for the SAE, see Configuring the SAE for External Plug-Ins (SRC CLI).
To configure an external plug-in:
From configuration mode, access the statement that specifies the configuration for an external plug-in for the SAE that communicates with the agent, and assign the plug-in a unique name.
[edit]user@host# shared sae configuration plug-ins name nameConfigure CORBA object reference for the plug-in.
[shared sae configuration plug-ins name name external]user@host# corba-object-reference corba-object-referenceFor the CORBA object reference, use the following syntax:
host: port-number/NameService#plugInNamewhere:
host—IP address or name of the machine on which you installed the NIC host that supports the agent
For local host, use the IP address 127.0.0.1.
port-number—Port on which the name server runs
The default port number is 2809.
plugInName—Name under which the agent is registered in the naming service
Use the format nicsae_groupname/saePort where groupname is the name of the replication group. (When replication is not used, the format is nicsae/saePort.)
For example:
[shared sae configuration plug-ins namename external]user@host# set corba-object-reference corbaname::127.0.0.1:2809/NameService#nicsae/saePort
Configure to save the interim events in the fail-queue.
[shared sae configuration plug-ins name name external]user@host# set store-interim-events-in-failqueueThis configuration stores the events to file based fail-queue or in-memory based fail-queue based on the plug-ins.
Configure attributes that are sent to the external plug-in for a NIC host. Because the SAE plug-in agents share the event by default, you configure only one for a NIC host.
[shared sae configuration plug-ins name name external]user@host# set attr[( router-name | user-dn | session-id | user-type | user-ip-address | event-time-millisecond | login-name)]Note To detect out-of-order interim events, the mandatory event-time-millisecond plug-in attribute has to be configured in SAE external plug-in configuration. NIC uses this attribute to check the event timestamp of interim events and sends OutOfSync exception to SAE, if the events are not in the order. If this attribute is not configured, the events are rejected in NIC with an exception.
Note During synchronization between SAE and NIC, the out-of-order events are processed.
Specify the plug-in options that the agent uses. You must specify the options session-id, event-time-millisecond and router-name, and other options that you specified for the agent’s network data types and the agent’s event filter. Do not specify attributes options of the PAT_OPAQUE attribute type, such as the option dhcp-packet.
Note Do not include attributes that are not needed.
Reference the NIC as a subscriber tracking plug-in.
[edit shared sae group name configuration plugins event-publishers]user@host# set subscriber-tracking pool-nameFor example, for a pool named nic:
[edit shared sae group name configuration plugins event-publishers]user@host# set subscriber-tracking nic