Initial Configuration

Context

If an MSP administrator created by the system administrator has all the rights of the MSP, this MSP administrator is called the root MSP administrator.

To ensure system security, the root MSP administrator can create multiple sub-MSPs and assign different rights to each sub-MSP by role.

Prerequisites

• View MSP administrator account policies.

  Account policies have been configured on iMaster NCE-Campus by default. An MSP administrator can view account policies, for example, account length policy and account login policy.

  Choose System > Administrator > Administrator from the main menu, and click Account Policy to view MSP administrator account policies.

• View MSP administrator password policies.

  Password policies have been configured on iMaster NCE-Campus by default. An MSP administrator can view password policies, for example, password complexity policy, password change interval policy, and character limitation policy.

  Choose System > Administrator > Administrator from the main menu, and click Password Policy, to view MSP administrator password policies.

  For security purposes, configure all password policies provided by iMaster NCE-Campus.

  If PCI authentication is required, modify account and password policies as follows:

  • Enable Disable unused accounts, and set Maximum number of consecutive idles days of account to 90. An account is disabled if the account has not logged in to the system at all for more than 90 days.
  • Set Invalid password monitoring period (min) to 30 in the Account Lockout Trigger Conditions area. In this case, if an account fails to log in to the system for five consecutive times within 30 minutes, the account is locked for 30 minutes.
  • Set Number of historical passwords that cannot be reused to 4.

• Roles have been created.

  If functional rights of existing roles in the system do not meet requirements, you can create new roles before creating accounts or workgroup.

  Choose System > Administrator > Administrator from the main menu, and click the Role tab. Click Create, and select functional rights to create a role.

  By default, a system administrator has following roles. These roles cannot be deleted or modified.

  • MSP Administrator: The MSP administrator performs manager services and configurations.
  • Operator: The operator manages system service running.
  • Open Api Operator: The open API operator owns the privilege of open API services and configurations.

Procedure

1. Choose System > Administrator > Administrator from the main menu.
2. Click Create, and set parameters on the Create User page.

   For security purposes, keep the password secure and change it periodically.

   • Manually set a password when creating a user account.

     Set Password create mode to Manual and then set a password for the account. If Modify password first login is set to Yes, the user will be prompted to change the password when using this account to log in to iMaster NCE-Campus for the first time, and can successfully log in after changing the password.

   • Create a password via email.

     Set Password create mode to Email. After the account is created, the system sends a URL to your email box. You can click the URL to configure a password for the user account.

     • If you choose to configure a password via email, configure an email server before creating an account. Otherwise, the system fails to send a URL to the specified email address. For details, see Configuring an Email Server
     • If the password for a user account is configured via email, the user does not need to change the password upon the first login to iMaster NCE-Campus.
     Table 6-17 Description of parameters on the Create Account page

     Parameter	Description
     Account	Login account of a newly created administrator.
     User type	LOCAL: Local users can log in to iMaster NCE-Campus only from the web UI. THIRD-PARTY SYSTEM ACCESS: A third-party system access user calls the northbound API /controller/v2/tokens to log in to iMaster NCE-Campus. NOTE: If the user type is Third-party system access, the user can log in to iMaster NCE-Campus only by API call. If the user type is Local, the user can log in to iMaster NCE-Campus only from the web portal. In an upgrade scenario, the user type is changed from Local or Third-party system access to Both. When the user type is Both, the user can log in to iMaster NCE-Campus either by API call or from the web portal.
     Password create mode	Mode in which a password is created. The options are Manual and Email.
     Password	Initial login password of the newly created administrator. NOTE: This parameter is displayed only when User Type is Local. If the password creation mode is set to Email, you must enter a valid email address. After the account is created, the system sends a link to the mailbox. You need to click the link to configure the account and password. In this mode, you do not need to change the password when you log in to iMaster NCE-Campus for the first time.
     Confirm password
     Modify password first login	Whether to change the password upon first time login.
     Mobile number	Email address of an MSP, which is provided for easy and prompt contact by Tenants under the MSP.
     Email address	Phone number of an MSP, which is provided for easy and prompt contact by Tenants under the MSP.
     Role	Selected the role from the drop-down list.

3. On the Managed Object page that is displayed, select the accounts to be managed by the MSP administrator, and click Next. By default, Select All Resources is enabled. In this case, the MSP administrator can manage all tenants. If you disable Select All Resources, you can select the tenants to be managed by the MSP administrator. In addition, select a role that is authorized by the tenant administrator to the MSP administrator. When the MSP administrator accesses the tenant Portal to maintain tenant services, the MSP administrator has the rights of the role authorized by the tenant administrator.

4. On the Access Control page that is displayed, click Create. Set the allowed IP address range, and click OK.

   After the IP address range is added, the account can use only an IP address within this range to log in to iMaster NCE-Campus. If no IP address range is added, the account can use any IP address to log in to iMaster NCE-Campus.

   After logging in to iMaster NCE-Campus using this account, choose System > System Management > Account Information from the main menu. On the Access Control page that is displayed, maintain the IP address range.

5. Click OK. The account is created successfully.

Follow-up Procedure

• Modify the account information, reset the password, and disable or enable an account.
  1. Choose System > Administrator > Administrator from the main menu.
  2. In the Operation column, click to modify the account information, click to reset the password, click to disable an account, and click to enable an account that has been disabled.

• Delete an account.
  1. Choose System > Administrator > Administrator from the main menu.
  2. Select an account and click Delete.

• Transfer workgroup administrator rights.

  If the administrator of a workgroup is changed, an upper-level administrator can transfer the corresponding rights to another administrator.

  Workgroup administrators can transfer their rights to the administrators created by themselves. Before transferring rights of a work administrator, ensure that the workgroup administrator has created an administrator account.

  • This operation can only be performed on level-1 sub-workgroups of the workgroup to which the current user belongs and cannot be performed on the workgroups of level 2 or higher.
  • If workgroup administrators remain online after their rights are transferred, they will be forced offline and has no rights.
  1. Choose System > Administrator > Administrator from the main menu. Click the User tab.
  2. Click Select, select the desired workgroup, and click OK.

     Select a desired account and click Hand Over to enable this account to become the new workgroup administrator.

     The new account must be an administrator account created by the old workgroup administrator account.

     If the icon is moved to the right of the new administrator account, the rights are transferred successfully.

• Set a user group.

  User groups are used to interconnect iMaster NCE-Campus with third-party services, such as the Active Directory Federation Services (ADFS), NetIQ, LDAP server, AD server, and RADIUS server.

  Choose System > Administrator > Administrator from the main menu, click the User Group tab, and click Create to create a user group.

  Click Next to select the managed objects of the user group.

  Only users with the MSP administrator rights can configure user groups.

• Configure personal settings.

  Personnel settings improve the access security of iMaster NCE-Campus. This function takes effect only for the current user.

  • Set the number of concurrently online users.
    1. Choose System > System Management > Account Information from the main menu.
    2. On the Basic Information page, set Max. concurrent users and click . The value 0 indicates there is no limit on the maximum number of concurrent online users.

  • Modify the password.
    1. Choose System > System Management > Account Information from the main menu.
    2. On the Basic Information page, click behind the password. In the dialog box that is displayed, set a new password.

  • Adjust the range of IP addresses that can be used by the current account to log in to iMaster NCE-Campus.

    Click Access Control tab. On the Access Control page, set the IP address range and click OK. If no IP address range is set, there is no limit on the login IP address range of the current account.

  • Set the idle timeout interval.

    To prevent other personnel from performing unauthorized operations when the administrator leaves, iMaster NCE-Campus provides the function of setting the idle timeout interval of the administrator. If an administrator does not perform any operation within the specified interval, the account will be automatically logged out. To perform further operations after the account is logged out, the administrator must log in to iMaster NCE-Campus again.

    Choose System > Administrator > Administrator from the main menu, click , set the idle time, and click OK.

  • Check online users.

    Choose System > Administrator > Administrator from the main menu and click the Online User tab.

• Check whether you have signed a privacy statement.
  1. Choose System > System Management > Account Information from the main menu.
  2. On the Basic Information page, check whether you have signed the privacy statement.
     • If Sign privacy statement is Not signed, you have not signed the privacy statement.
     • If Sign privacy statement is Signed, you have signed the privacy statement.
• Withdraw a privacy statement.
  To withdraw your consent to this privacy statement, click Cancel next to Sign privacy statement and click OK in the Warning dialog box that is displayed.

  You will be logged out if you withdraw the consent to the privacy statement. In addition, your mobile number and email address will be deleted from the controller. This may affect your login or password retrieval. Exercise caution when performing this operation.

Context

If iMaster NCE-Campus needs to send emails to users, you need to configure an email server first.

iMaster NCE-Campus needs to send emails in the following scenarios:

• The MSP administrator or tenant administrator forgets the password: iMaster NCE-Campus sends a reset password to the administrator through an email.
• The tenant administrator performs alarm settings on iMaster NCE-Campus: iMaster NCE-Campus sends emails to notify users of reported alarms.
• The tenant administrator wants to use the email-based deployment function: iMaster NCE-Campus needs to send deployment emails to related personnel.
• Tenants want to register accounts by themselves: iMaster NCE-Campus sends an email containing an activation link to the tenants.
• The MSP administrator inspects tenant devices: iMaster NCE-Campus sends the inspection report to the administrator's mailbox, if needed.
• The MSP administrator deletes ESNs or devices: iMaster NCE-Campus sends a notification email to the tenant administrator, if needed.
• A tenant license is about to expire: iMaster NCE-Campus sends a notification email to a tenant.
• When portal authentication is configured for guest access, you need to set the approver notification mode or guest notification mode to email notification.

The system administrator has configured an email server for sending emails. If the MSP administrator wants to use another email server, the MSP administrator needs to configure an email server separately.

If both the system administrator and MSP administrator have configured an email server, the email server configured by the MSP administrator is used preferentially. If the email server configured by the MSP administrator is not found, the email server configured by the system administrator is used.

Procedure

1. Upload an email server certificate.
   1. Contact the SMS server provider to obtain a certificate file.
   2. Choose System > System Management > Certificate Management from the main menu.
   3. Choose Service Certificate Management from the navigation pane. On the Services page, click CampusBaseServiceServerConfigMoudle.
   4. Click the Trust Certificate tab and click Import. On the displayed page, enter the certificate information, select the desired email server certificate, and click Submit to upload the certificate to iMaster NCE-Campus.

2. Choose System > System Management > Third-Party Service from the main menu.
3. Set parameters for connecting to the email server.

   If the email server uses a third-party CA certificate, you are advised to disable Validate server certificate.

4. Click Test to verify the email sending function.
   • If the message "The test succeeds" is displayed and the mailbox receives the test email, the configuration is successful. Click Save.
   • If the message "The test succeeds" is displayed but the mailbox does not receive the test email, check whether the email function of the SMTP server is normal.
   • If the message "Failed to connect to the email server" is displayed, check whether the above parameters are correctly configured.
     • Affected by the network quality and performance of the SMTP server, the time of receiving emails will be delayed within two minutes.
     • Some SMTP providers set the right control for third-party application access. If the test fails, check whether the function of controlling third-party application access is enabled on the SMTP server and set password to the authentication password of the SMTP server.
     • Limited by security policies of email service providers, administrators may fail to receive emails in some scenarios. If no email is received, log in to the email service website or contact the email service provider to check whether the email is returned or other exceptions occur. Alternatively, replace the email server and try again.

Parameter Description

Context

You need to configure the SMS service if SMS authentication is required.

Before configuring the SMS service, you need to configure an SMS platform to specify the SMS gateway and configure account information based on the SMS platform to send SMS messages.

• SMS platform: You need to set parameters about a third-party SMS platform on iMaster NCE-Campus according to the information provided by the SMS platform. For details, see the interface document of the third-party SMS platform.
• SMS server: You need to set parameters for interworking between iMaster NCE-Campus and a third-party SMS platform. After the interconnection is successful, iMaster NCE-Campus can send SMS messages.

  By default, the system is pre-configured with the following SMS server connection parameters:

  • fungo: http://qxt.fungo.cn/Recv_center. This is the SMS platform of fungo.cn (Beijing, China).
  • twilio: https://api.twilio.com:8443/2010-04-01/Accounts/{USERNAME}/Messages.json. To use this SMS server, access www.twilio.com and apply for an account.

Prerequisites

The system administrator has created an SMS server template.

Procedure

1. Import an SMS server certificate.
   1. Contact the SMS server provider to obtain a certificate file.
   2. Log in to iMaster NCE-Campus as a system administrator and choose System > System Management > Certificate Management from the main menu.
   3. Choose Service Certificate Management from the navigation pane. On the Services page, click CampusBaseServiceServerConfigMoudle.
   4. Click the Trust Certificate tab and click Import. On the displayed page, enter the certificate information, select the desired SMS server certificate, and click Submit to upload the certificate to iMaster NCE-Campus.

2. Choose System > System Management > Third-Party Service and click the SMS Server tab.
3. Select an SMS Platform, and configure the related data.

   HTTPS is recommended because it is more secure than HTTP.

   • Set SMS Service type to HTTP SMS Service and select fungo from the SMS platform drop-down list box.

   • Set SMS Service type to HTTP SMS Service and select twilio from the SMS platform drop-down list box.

   • Set SMS Service type to SMPP SMS Service and select the created SMS template from the SMS platform drop-down list box.

4. Click Test to verify validity of the SMS message sending function.
   • If the test succeeds, the message "The test succeeds" is displayed, and you can receive the test SMS message from iMaster NCE-Campus.
   • If the test fails, the message "Failed to test the SMS serve" is displayed. Perform operations according to the scenarios:
     • If an error code is displayed in the dialog box, check the product documentation of the SMS service provider for the cause of the error, and obtain the troubleshooting method.
     • If no error code is displayed in the dialog box, contact the system administrator to check the URL specified in the SMS server template to see whether the SMS server is reachable.

5. After the test is successful, click Save.

Parameter Description

Context

After you click to obtain an SMS verification code, no SMS message may be received due to poor network signals or mobile phone issues. In this case, you can obtain a new verification code one minute later. The validity period of a verification code is five minutes. A user will be locked for 10 minutes if the user applies for another verification code before the current verification code expires and fails to be authenticated after applying for more than five consecutive verification codes.

Prerequisites

iMaster NCE-Campus has connected to an SMS gateway.

Setting a Mobile Number

1. Choose System > System Management > Account Information from the main menu, and click Basic Information.
2. Click to the right of Mobile number. In the displayed window, complete the verification as prompted to bind the current account to the mobile number.

3. Click Modify next to SMS verification upon login. In the displayed window, enable SMS verification upon login and complete the verification using the SMS verification code.

Verification

After configuring SMS authentication, perform the following operations to check whether the configuration is successful.

1. Log out and log in to iMaster NCE-Campus again. After the user name and password are verified successfully, the Login Verification page is displayed.
2. Click Obtain Verification Code. After receiving an SMS verification code, enter it and click Confirm. If you log in to iMaster NCE-Campus successfully, the configuration is successful.