Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

NCM Node

Hi Guys,

We have two separate teams in our network operation, both teams devices added in NPM and NCM and they are currently using a common user I.e. NOC user for monitoring /view nodes pertain to there domain.

The problem is that now they want to separate NCM user for disable view rights of Startup / Running configurations to other team for security / privacy concern. is there any way to disable a group / department to view other's node configuration while using same NPM NOC user or need to create user for this?

Is there any way to manage this requirements??? . Please help.

Current we are using Orion Platform 2016.2.100, NCM 7.5, IVIM 2.1.2, NetPath 1.0.1, NPM 12.0.1, QoE 2.2.0, NTA 4.1.2.

Find more posts tagged with

Accepted answers

All comments

deverts

@jawwad05,

I've done this in my organization, but you are correct, I have different user IDs. And actually, I had AD Groups (SW_Group_1, SW_Group_2, etc.) built for each team and configured the views per group using Account Limitations. This does several things for you:

You aren't using a shared user account - bad security practice for a ton of reasons.
You aren't creating individual accounts or pointing to individual AD accounts for each person - administratively painful.
As people come and go from the organization, when they disable the AD account, they also disable the Orion access - account management is covered.

This shouldn't be hard to do, you've already built the majority of view permissions, that's the hard part. I'd just have your AD team create you some groups and put the appropriate user accounts in those groups. Then mirror your current permissions to each of the groups and modify Account Limitations accordingly per team.

jawwad05

deverts ,

Thanks for time and detail reply. So what I conclud it's mean in that case I've to create account with limitation of node group.. ... View binding!!

By the way what for NCM Group feature for node ??

Thanks again.

deverts

Account limitations are global, so you can use anything available to create it. If you have NCM groups, you can use those, if you want to use NPM groups...if you have custom fields...you can apply just about anything. That's what is so powerful about this method.

jawwad05

Sound good idea, Yeah I I've custom fields for managing view and alerts.. thanks for the tip.. I'll try and update here as well..

jawwad05

deverts can you please explain more as I cant make any difference

deverts

jawwad05,

Try this...if it doesn't fit your situation, it should at least point you in the right direction.

Step 1: Have your AD Admins create as many groups as you need (Execs, Tech Support, Sys Admins, Network, etc.). Talking about just this instance, NetTeam1 and NetTeam2.

Step 2: Have your AD Admins add the user accounts for each team member to the appropriate group.

Step 3: Orion - Settings - Manage Accounts - Groups --> map the new AD Groups to Orion and use all the same settings you have for the current shared account.

Step 4: Disable the shared account, and have them logout and back in with their Domain accounts (blah\johndoe).

This provides them with all the same access they already had, but tests that user authentication is working properly. If access is working correctly, proceed to Step 5.

Step 5: This is all custom based on your environment, you can use SNMP strings or other fields.

a. SNMP String "Contact": if you have each team name in the Contact field on each device

1. Open one of your new User Group mappings, and about half way down the page is "Account Limitations", choose "add"

2. Select "System Contact" and "Continue"

3. Choose the correct contact and "Submit"

4. Have them logout again, and log back in...they should only see their devices across all views

b. Other fields...once you select "Account Limitations" like above, you will see all the options available to you. Choose what is best for your scenario.

Step 5 (Alternative): if all teams want to see all devices, but you are trying to limit only the NCM configs...

a. You will have to build special, individual NCM pages for each team and apply a view limitation to the pages. This is a much more involved discussion and customization.

jawwad05

Many Thanks deverts for your details answer, your last line that is Step 5 is fit for me .. ;/ ".. want to monitor all and limit for particular .." So as per your expert advice I have to make individual account / pages for NCM with view limitation and disable NCM on shared user that our teams currently using.. correct??

deverts

It sounds that way. You won't have to disable NCM on the shared account, everyone will be logging in with their new credentials and won't be using the shared account anymore; so no need to actually disable the NCM view on that shared account.

jawwad05

hmmm deverts .. Yeah!! this what I thinking of .. many thanks for your clear answer and help.