Overview

• Nexus Dashboard for the data center stands out as the first comprehensive technology solution in the industry developed by Cisco for network operators to manage day-2 operations in their networks.
• Nexus Dashboard automates troubleshooting and helps with rapid root-cause analysis and early remediation. It also helps infrastructure owners comply with SLA requirements for their users.
• Nexus Dashboard for the data center is supported on Cisco ACI and Cisco NX-OS/DCNM-based deployments.
• Nexus Dashboard collects data on Anomalies, Advisories, and Orchestrator (Multi-Site Orchestrator) from the Nexus API and parses the fields. Data is mapped with the CIM data models for Enterprise Security use cases.
• ACI is used to gather data from the Application Policy Infrastructure Controller (APIC), index the data, and use it for running searches and building dashboards.
• Nexus 9k provides a scripted input for Splunk that automatically extracts responses of CLI commands from Cisco Nexus 9000 Switches. Moreover, this app gathers Syslog from Cisco Nexus 9000 Switches and provides the same for running searches on data and building dashboards using it.

Author: Cisco Systems, Inc
Version: 1.0.1

Release Notes

Version 1.0.2

• Removed the admin user as the owner.

Version 1.0.1

*Updated default value of verify_ssl to True.

Compatibility Matrix

Recommended System Configuration

• The Splunk search head system should have 16 GB of RAM and an octa-core CPU to run this app smoothly.

Account Configuration

For configuring an account for the data collection of API data, follow the below-mentioned steps in the Cisco DC Networking App for Splunk.

ND Account Configuration

• Navigate to the Cisco DC Networking App for Splunk.
• Click on the Configuration Tab.
• Click on the ND Accounts tab.
• Click on Add.

• This provides 2 different modes of authentication to collect the ND data in Splunk. The common fields are Hostname(s)/IP address(es) and ND Port.

• The different modes are:

  • Password-Based Authentication

    • The user can configure the app using the default approach, i.e., using Password.
    • To set up ND with Password-Based Authentication, follow the steps below:
      • In the 'ND Authentication Type' field, select "Password-Based Authentication".
      • Enter the Hostname(s)/IP address(es) of the ND.
      • Enter the port of the ND, e.g., 443.
      • Enter the username and password used to log in to the ND.
      • Click on the Save button at the bottom of the page.

  • Remote User-Based Authentication

    • The user needs to provide both the Password and the Domain Name of the specified user.
    • To set up ND with Remote User-Based Authentication, follow the steps below:
      • In the 'ND Authentication Type' field, select "Remote User-Based Authentication".
      • Enter the Hostname(s)/IP address(es) of the ND.
      • Enter the port of the ND, e.g., 443.
      • Enter the username and password used to log in to the ND.
      • Enter the Domain Name of the user.
      • Click on the Save button at the bottom of the page.

ACI Account Configuration

• Navigate to the Cisco DC Networking App for Splunk.
• Click on the Configuration Tab.
• Click on the ACI Accounts tab.
• Click on Add.

• This provides 3 different modes to configure an ACI account. The common fields are Hostname(s)/IP address(es) and APIC Port.

• The different modes are:

  • Password-Based Authentication

    • The user can configure the app using the default approach, i.e., using Password.
    • To set up APIC with Password-Based Authentication, follow the steps below:
      • In the 'APIC Authentication Type' field, select "Password-Based Authentication".
      • Enter the Hostname(s)/IP address(es) of the APIC.
      • Enter the port of the APIC, e.g., 443.
      • Enter the username and password used to log in to the APIC.
      • Click on the Save button at the bottom of the page.

  • Certificate-Based Authentication

    • The user needs to provide the Certificate Name (as uploaded on APIC) and the Path of the RSA Private Key (path to the RSA private key, present on Splunk, of the certificate uploaded on APIC) on the setup page to collect data.
    • The procedure to create and configure a custom certificate for certificate-based authentication is given in the link below:
      Cisco APIC Basic Configuration Guide
    • Convert the Private Key to an RSA Private Key by running the following command in the terminal:

    • openssl rsa -in <private_key>.key -out <rsa_private_key>.key

    • To set up APIC with Certificate-Based Authentication, follow the steps below:

      • In the 'APIC Authentication Type' field, select "Certificate-Based Authentication".
      • Enter the Hostname(s)/IP address(es) of the APIC.
      • Enter the port of the APIC, e.g., 443.
      • Enter the username to log in to the APIC.
      • Enter the Name of the Certificate.
      • Enter the Path of the Private Key, e.g., /opt/splunk/ACI.key.
      • Click on the Save button at the bottom of the page.

  • Remote User-Based Authentication

    • The user needs to provide both the Password and the Domain Name of the specified user.
    • To set up APIC with Remote User-Based Authentication, follow the steps below:
      • In the 'APIC Authentication Type' field, select "Remote User-Based Authentication".
      • Enter the Hostname(s)/IP address(es) of the APIC.
      • Enter the port of the APIC, e.g., 443.
      • Enter the username and password used to log in to the APIC.
      • Enter the Domain Name of the user.
      • Click on the Save button at the bottom of the page.

Nexus 9K Account Configuration

• Navigate to the Cisco DC Networking App for Splunk.
• Click on the Configuration Tab.
• Click on the Nexus 9K Accounts tab.
• Click on Add.

Input Creation

For creating an input in Cisco DC Networking App for Splunk and start data collection of API data, follow the below-mentioned steps.

ND Input

• Navigate to the Cisco DC Networking App for Splunk.
• Click on the Inputs tab.
• Click on Create New Input.
• Select ND from the dropdown.
• Fill in all the necessary details.
• Click on Save.

The significance of each field is explained below:

ACI Input

• Navigate to the Cisco DC Networking App for Splunk.
• Click on the Inputs tab.
• Click on Create New Input.
• Select ACI from the dropdown.
• Fill in all the necessary details.
• Click on Save.

The significance of each field is explained below:

Nexus 9K Input

• Navigate to the Cisco DC Networking App for Splunk.
• Click on the Inputs tab.
• Click on Create New Input.
• Select Nexus 9K from the dropdown.
• Fill in all the necessary details.
• Click on Save.

The significance of each field is explained below: