Initial Configuration

Context

A tenant administrator can use a browser to log in to iMaster NCE-Campus to perform system management and maintenance operations. The following web browsers are supported:

• Google Chrome 57 or later
• Microsoft Edge 20 or Microsoft Edge 40

Procedure

1. Open a browser.
2. Enter https://iMaster NCE-Campus server IP address:port number in the address box, and press Enter.
   • The IP address of the iMaster NCE-Campus server is Northbound management IP specified when you install iMaster NCE-Campus.
   • The port number is 18008. The port number used for the login must be the same as that specified during the installation.
   • The method for logging in to an authentication component is the same as that for logging in to iMaster NCE-Campus.

3. Ignore the security certificate warning and access the login page.

   When you log in to iMaster NCE-Campus using a browser, the browser performs unidirectional authentication on iMaster NCE-Campus based on the ER certificate. The Huawei ER certificate has been pre-configured during iMaster NCE-Campus installation. This certificate is used only for temporary communication and is not for commercial use. You can apply for a new ER certificate to update the preconfigured ER certificate to improve iMaster NCE-Campus communication security. You are advised to periodically update the certificate to prevent system security risks caused by certificate expiration. After the ER certificate is updated, the message indicating a security certificate error will not be displayed.

   • Google Chrome: Choose Advanced > Proceed to ... (unsafe).

4. Enter a tenant administrator username and password, and click Log In.
5. (Optional) Upon the first login, change the password as prompted. Skip this step if it is not your first login.
   • For security purposes, do not save your password in the browser.
   • If the system administrator has configured an email server and the MSP administrator does not set an email address for the tenant administrator during tenant account creation, an email address needs to be bound to the tenant administrator account upon the tenant's first login.
   • If the system administrator has not configured an email server, no email address needs to be bound to the tenant administrator account upon the tenant's first login.
   • When a sub-tenant administrator account created by the root tenant administrator logs in to iMaster NCE-Campus for the first time, no email address needs to be bound to the sub-tenant administrator account.

6. (Optional) Perform two-factor authentication. If a mobile number has been set for the tenant administrator account, click Obtain Verification Code and enter the received verification code. You can log in to iMaster NCE-Campus after the verification succeeds. This step is not required if username and password authentication is selected when the MSP administrator creates the tenant administrator.
7. (Optional) Sign the privacy statement.

   If the MSP administrator selects a privacy statement when creating a root tenant administrator, the root tenant administrator needs to sign the privacy statement when logging in to iMaster NCE-Campus for the first time. Otherwise, the login will fail.

   If the root tenant administrator has signed the privacy statement, the sub-tenant administrators created by this root tenant administrator need to sign the privacy statement as well when logging in to iMaster NCE-Campus for the first time. Otherwise, the login will fail.

8. (Optional) Set a device administrator password and a password used to enter the BootROM menu of devices on iMaster NCE-Campus. This step is required only upon your first login.

   After a device goes online at a new site, the two passwords set here will automatically apply to the device. This ensures device security.

   If the system administrator disables The device BootROM password can be configured, tenants cannot change the BootROM password. For details about how to disable tenants from changing the BootROM password, see Configuring a BootROM Password Policy.

Context

The system administrator has configured account policies and password policies. Tenant administrators can modify these policies as needed.

Procedure

1. Configure account policies.

   Account policies have been configured on iMaster NCE-Campus by default. Tenant administrators can modify the account policies, such as account length policy and account login policy.

   Choose System > User Management > Administrator from the main menu, and click Account Policy, to configure account policies.

2. Configure password policies.

   Password policies have been configured on iMaster NCE-Campus by default. Tenant administrators can modify the password policies as needed, for example, password complexity requirements, the password change interval, and character limitations.

   Choose System > User Management > Administrator from the main menu, and click Password Policy, to configure password policies.

   For security purposes, configure all password policies provided by iMaster NCE-Campus.

   If PCI authentication is required, modify account and password policies as follows:

   • Enable Disable unused accounts, and set Maximum number of consecutive idles days of account to 90. An account is disabled if the account has not logged in to the system at all for more than 90 days.
   • Set Invalid password monitoring period (min) to 30 in the Account Lockout Trigger Conditions area. In this case, if an account fails to log in to the system for five consecutive times within 30 minutes, the account is locked for 30 minutes.
   • Set Number of historical passwords that cannot be reused to 4.

Context

Users with the same operation rights can be managed by role. After an account is attached to a role, the account has all rights of this role.

Procedure

1. Choose System > User Management > Administrator from the main menu, and click the Role tab.
2. Click Create. Enter the role name and select function rights for the role.

   By default, the following roles are preset for tenants. These roles cannot be deleted or modified.

   • Monitor: A monitor can view tenant services and configurations.
   • Open Api Operator: An open API operator can use open API services and related configurations.
   • Tenant Administrator: A tenant administrator can perform operations on tenant services and related configurations.
   • Operator: An operator can manage system service running.

     The Operator role is unavailable for tenant administrators created on iMaster NCE-Campus running V300R019C00.

   • CLI Operator: A user attached with this role has the permission to import device commands using a command template. For details, see Issuing Commands Using a Template.

     Issuing commands is supported only on the WAN. The CLI Operator role is available only in EVPN tunnel mode.

   In the Select function list, each function node has a fixed name but the node order in the list varies depending on the iMaster NCE-Campus version. Figures in this section are for reference only.

3. You are advised to create roles and grant function rights based on the following table. You can also create roles as needed.

   Role Type	Rights
   Management	Global management personnel, with all rights.
   Monitoring	Global monitoring personnel, with all monitoring rights.
   Configuration	Network configuration personnel, with rights to configure the network, traffic policies, and security policies.
   Maintenance	O&M personnel, with rights to maintain devices and manage files and logs.

   • For a management role: Select all functions.

   • For a monitoring role, select Monitoring and all functions under it.

   • For a configuration role, select Design, Provision, System, Admission, Policy, ServiceConsisitency Group, along with all functions under them.

   • For a maintenance role, select Maintenance and all functions under it.

4. Click OK.

Context

A tenant administrator created by an MSP administrator has all rights of a tenant, and is called a root tenant administrator.

To ensure system security, the root tenant administrator can create multiple sub-tenant administrators and attach roles to each sub-tenant administrator so that the sub-tenant administrator can have corresponding rights of the roles.

A tenant administrator can set the maximum number of concurrent online users. The value ranges from 0 to 999. The value 0 indicates that the maximum number of concurrent online users is not limited. To ensure system performance, the maximum number of concurrent online users is limited to 5000.

Procedure

1. Choose System > User Management > Administrator from the main menu.
2. Click Create, and set parameters on the Create User page.

   For security purposes, keep the password secure and change it periodically.

   • Manually configure a password when creating an account.

     Set Password create mode to Manual and then set a password for the account. If Modify password first login is set to Yes, the user will be prompted to change the password when using this account to log in to iMaster NCE-Campus for the first time, and can successfully log in after changing the password.

   • Create a password via email.

     Set Password create mode to Email. After the account is created, the system sends a URL to your email box. You can click the URL to configure a password for the user account.

     • If you choose to configure a password via email, configure an email server before creating an account. Otherwise, the system fails to send a URL to the specified email address. For details, see Configuring an Email Server
     • If the password for a user account is configured via email, the user does not need to change the password upon the first login to iMaster NCE-Campus.
     Table 6-21 Description of parameters on the Create User page

     Parameter	Description
     Account	User account used for login.
     User type	The following two user types are available: Local: Local users can log in to iMaster NCE-Campus only from the web UI. Third-party user: A third-party system user can invoke the northbound API /controller/v2/tokens to log in to iMaster NCE-Campus. NOTE: A third-party user can log in to iMaster NCE-Campus only by invoking the API. A local user can log in to iMaster NCE-Campus only through the web UI. After an upgrade, local users and third-party users can log in to iMaster NCE-Campus either by calling the API or through the web UI.
     Password create mode	Mode in which a password is created. The options are Manual and Email.
     Password	Initial login password of the newly created administrator. NOTE: The two parameters are configurable only when User Type is set to Local. If Password create mode is set to Email, set a valid email address. After the account is created, the system sends a URL to the mailbox. The user can click the URL to configure a password. If Password create mode is set to Email, the user does not need to change the password when logging in to iMaster NCE-Campus for the first time.
     Confirm Password
     Modify password first login	Whether to change the password upon first login.
     Email address	When resetting passwords, users can receive new random passwords generated automatically through emails.
     Mobile number	When resetting passwords, users can receive new random passwords generated automatically through SMS messages.
     Role	Role to be attached to the user.

3. On the Managed Object page, select the sites to be managed by the sub-tenant administrator, and click Next.

   If a sub-tenant administrator is authorized to managed selected sites, the administrator cannot view the following menus after logging in to iMaster NCE-Campus since the administrator does not have the permission to manage all resources:

   • Monitoring > Health > Overview
   • Monitoring > Health > Inter-Site
   • Monitoring > Health > Site

   • Monitoring > Monitor Settings > Monitor Settings

4. (Optional) Configure access control.

   On the Access Control page, click Create, configure the range of IP addresses that can be used to log in to iMaster NCE-Campus, and click Next.

5. Click OK.

Follow-up Procedure

• Modify account information, reset the password, and disable or enable the account.
  1. Choose System > User Management > Administrator from the main menu.
  2. In the Operation column, click to modify account information, click to reset the password, or click to disable the account. If the account has been disabled, click to enable the account.

• Delete an account.
  1. Choose System > User Management > Administrator from the main menu.
  2. Select an account, and click Delete.

• Transfer workgroup administrator rights.

  If the administrator of a workgroup is changed, an upper-level administrator can transfer the workgroup administrator rights to another administrator.

  Workgroup administrators can transfer their rights only to the administrators created by themselves. Before transferring rights of a workgroup administrator, ensure that the workgroup administrator has created an administrator account.

  • This operation can only be performed on level-1 sub-workgroups of the workgroup to which the current user belongs and cannot be performed on the workgroups of level 2 or higher.
  • If workgroup administrators remain online after their rights are transferred, they will be forced offline and has no rights.
  1. Choose System > User Management > Administrator from the main menu. Click the User tab.
  2. Click Select, select the desired workgroup, and click OK.

     Select a desired account and click Hand Over to enable this account to become the new workgroup administrator.

     The new account must be an administrator account created by the old workgroup administrator account.

     If the icon is moved to the right of the new administrator account, the rights are transferred successfully.

• Configure a user group.

  User groups are used to interconnect iMaster NCE-Campus with third-party services, such as the Active Directory Federation Services (ADFS), NetIQ, LDAP server, AD server, and RADIUS server.

  Choose System > User Management > Administrator from the main menu. Then, click the User Group tab, and click Create to create a user group.

  Click Next and select objects to be managed by the user group if Select all resources is disabled.

• Perform personalized settings.

  Personalized settings improve iMaster NCE-Campus access security. The personalized settings apply only to the current tenant administrator account.

  • Set the number of concurrent online users.
    1. Choose System > User Management > Account Information from the main menu.
    2. On the Basic Information tab page, click and set Max. concurrent users. The value 0 indicates there is no limit on the maximum number of concurrent online users.

  • Change the user password.
    1. Choose System > User Management > Account Information from the main menu.
    2. On the Basic Information tab page, click next to the password. In the dialog box that is displayed, set a new password.

  • Modify the IP address range that can be used by the current account to log in to iMaster NCE-Campus.
    1. Choose System > User Management > Account Information from the main menu.
    2. On the Access Control tab page, create Create, set a start IP address and an end IP address, and click OK. If the IP address range list is empty, login is allowed from any IP address.

  • Set an idle timeout interval for the current tenant administrator account.

    iMaster NCE-Campus supports the idle timeout interval setting to prevent unauthorized operations when the administrator is away. If an administrator does not perform any operation within a specified period of time, the administrator will be logged out automatically and needs to log in to iMaster NCE-Campus again.

    Choose System > User Management > Administrator from the main menu, click Idle Timeout Settings, set Idle duration (min), and click OK.

  • Check online users.

    Choose System > User Management > Administrator from the main menu, click the Online User tab, and view online users.

• Check whether you have signed a privacy statement.
  1. Choose System > User Management > Account Information from the main menu.
  2. On the Basic Information tab page, check whether you have signed the privacy statement.
     • If Sign privacy statement is Not signed, you have not signed the privacy statement.
     • If Sign privacy statement is Signed, you have signed the privacy statement.
     • Withdraw a privacy statement.
       To withdraw your consent to the privacy statement, click Cancel next to Sign privacy statement and click OK in the Warning dialog box that is displayed.

       You will be logged out if you withdraw the consent to the privacy statement. In addition, your mobile number and email address will be deleted. This may affect your login or password retrieval. Exercise caution when performing this operation.

Procedure

1. Choose Design > Basic Network Design > Network Settings > Tunnel Mode.
2. Set VPN Mode to EVPN or IPSecVPN.

3. Click Apply.