Install wildcard SSL on Cisco Prime Infrastructure 1.4

I'm trying to install a wildcard SSL on a Cisco Prime Infrastrucure 1.4.
I've manage to install this certificate on the Cisco 5508 WLC, however not so much success with the Cisco Prime.
There are alot of documentation regarding the installtion of CSR certificates however I could not find anything related to wildcard or public key certificates from Cisco.
I did find the following from a NetBoyers, I've tried this process however this seems to apply for NCS versions prior to 1.4 as it was unsuccessful
Any assistance would be creatly appreciated.

I was able to follow the procedure in the Admin Guide to successfully import and use a CA-issued wildcard certificate (from GoDaddy) with unencrypted private key where the original CSR was not generated by the Prime Infrastructure server.
Prime needs to be defined with a record in your DNS serving the domain in the wildcard certificate. In my case I am using both an A record and cname alias.
Following a server restart the wildcard certificate appears fine in Chrome, Firefox and IE when I browse to https://prime.<my_customer's_domain>.
Below are the commands I used. You would need to have your own certificate and keyfile. My certificate includes the full chain - server certificate, intermediate certificate and root certificate in that order.
PI01/admin# copy ftp://192.168.254.7/privatekeyplaintext.pem disk:
Username: admin
Password:
PI01/admin# copy ftp://192.168.254.7/gd_bundle-g2-g1.crt disk:
Username: admin
Password:
PI01/admin#
PI01/admin# root
Enter root password :
Starting root bash shell ...
ade # pwd
/root
ade #
ade # cd ..
ade #
ade # cd localdisk
ade # ls -al
total 68
drwxr-xr-x 8 root root 4096 Nov 2 09:51 .
drwxr-xr-x 28 root root 4096 Oct 28 11:22 ..
lrwxrwxrwx 1 root root 20 Jul 14 13:11 crash -> /opt/CSCOlumos/crash
drwxr-xr-x 2 root root 4096 Jul 15 23:31 defaultRepo
drwxr-xr-x 2 root root 4096 Jul 14 13:10 ftp
-rw-rw-rw- 1 root gadmin 6710 Nov 2 09:51 gd_bundle-g2-g1.crt
drwx------ 2 root root 16384 Apr 17 2014 lost+found
-rw-rw-rw- 1 root gadmin 1679 Nov 2 09:50 privatekeyplaintext.pem
drwxr-xr-x 2 root root 4096 Jul 14 13:10 ssh
drwxr-xr-x 2 root root 4096 Jul 14 13:10 telnet
drwxr-xr-x 2 root root 12288 Nov 2 09:57 tftp
ade #
ade # mv ./gd_bundle-g2-g1.crt ./defaultRepo
ade # mv ./privatekeyplaintext.pem ./defaultRepo
ade #
ade # exit
exit
PI01/admin# show repository defaultRepo
PI01-140715-0330.tar.gpg
PI01-140716-0330.tar.gpg
gd_bundle-g2-g1.crt
privatekeyplaintext.pem
PI01/admin#
PI01/admin# ncs key importcacert wildcardcert gd_bundle-g2-g1.crt repository defaultRepo
INFO: no staging url defined, using local space. rval:2
truststore used is /opt/CSCOlumos/conf/truststore
The NCS server is running
Changes will take affect on the next server restart
Importing certificate to trust store
PI01/admin#
PI01/admin# ncs key importkey privatekeyplaintext.pem gd_bundle-g2-g1.crt repository defaultRepo
INFO: no staging url defined, using local space. rval:2
INFO: no staging url defined, using local space. rval:2
truststore used is /opt/CSCOlumos/conf/truststore
The NCS server is running
Changes will take affect on the next server restart
Importing RSA key and matching certificate
PI01/admin#
PI01/admin# ncs stop
Stopping Network Control System...
This may take a few minutes...
Network Control System successfully shutdown.
Plug and Play Gateway is being shut down..... Please wait!!!
Stop of Plug and Play Gateway Completed!!
SAM daemon process id does not exist
DA daemon process id does not exist
DA syslog daemon process id does not exist
PI01/admin# ncs start
Starting Network Control System...
This may take a few minutes...
Network Control System started successfully.
PI01/admin#

Similar Messages

Cisco Prime Infrastructure 2.0 and Cisco ASA

Hello,
We've recently installed trial version of Cisco Prime Infrastructure 2.0 Express. We hoped that it already supports Cisco ASA 55xx series (especially 5505, we have pretty amount of them). But we had some problems with PI and asa durind the exploitation process.
First, I've added ASA to PI, and Inventory Collection Status is Completed, but I can't see CPU and RAM utilization graphs. Inventory.logs are non-informative.
Also, config backup is success, but when I try to watch the backuped configuration at Configuration Archive PI says "Failed to fetch raw configuration". And so on.
ASA version is 5505, image is 9.1(2).
So, I have a question: is it possible to manage ASAs with PI 2.0?
UPD: I've just tried to upgrade asa to 9.1(4), and behavior of the equipment is quite the same. Seems we shall wait for 9.2 to be released.

Have you downloaded and applied the latest Device Pack updates?
PI enhanced ASA support after the initial 2.0 release and the Device Packs incorporate that change.
The README file for Device Packs explains how to install them. (A bug currently does not allow the direct download in PI so you need to follow the method for installation from local storage after you manually download. Here is a link to the download location.

Vmware tools on Cisco Prime Infrastructure

Hi,
Is there a way to install vMware tools on Cisco Prime Infrastructure 1.2. I know this can be done on LMS4.2. how about access to the shell like LMS4.2?
Thanks,
Kerim

This was not preinstalled on ours though the files were there. We found the .gz install in this directory:
/opt/CSCOlumos/tempInstallFiles
we copied the the file to tmp:
ade# cp /opt/CSCOlumos/tempInstallFiles/VMwareTools-8.6.5-621624.tar.gz /tmp
changed to that directory and unzipped the file
ade# tar zxvf VMwareTools-8.6.5-621624.tar.gz
and installed the file
ade# cd vmware-tools-distrib
ade# ./vmware-install.pl
and it is now running
ade # ps auxwww | grep vm
root     22100 0.0 0.0      0     0 ?        S<   07:59   0:00 [vmmemctl]
root     22326 0.0 0.0 134004 4124 ?        S    07:59   0:00 /usr/sbin/vmtoolsd
root     22397 0.0 0.0   6044   588 pts/1    S+   08:00   0:00 grep vm

Trouble With Cisco Prime Infrastructure 1.3

Hi,
I have installed the Evaluation Version Cisco Prime Infrastructure 1.3.
There are a few problems that i am facing;
I am trying to push a simple configuration to WLC using Prime Infrastructure. But it is failing as PI doesnot have RW SNMP access.
My question is that can I use PI to push configs without using SNMP. Like do it using ftp or something.
Also do the Wired Devices also need SNMP RW access on PI's part.
2. I tried running discovery for WLC and it worked fine where all the controllers were discovered. But when I try to discover a Switch, the reachability tab says Reachable but in Collection Status tab it shows Unmanaged. When I click on the Unmanaged tab it says " Pre-collection check failed because: ". I have configured the SNMP correctly.
3. I have the CAD files for all the maps in our environment but when I try to upload it to Prime it converts it into GIF, so the maps are uploaded as plain image with no knowledge of walls and obstacles.
So we would have to add the walls and obstacles by ourselves. Is there any way it can automatically pick up on the walls and obstacles and thus provide a better way for predicting RF profiles.
All your help is greatly appreciated.

TAC Case! Sounds like a bug to me...
Sent from Cisco Technical Support iPad App

Installing Certificate from Microsoft CA (.pfx) in Cisco Prime Infrastructure 1.2

Hello,
we are trying to install certificates from our CA on our Cisco Prime Infrastructure 1.2
What we get from our colleagues is a file in .pfx format, containing an exportable key and the whole certificate chain.
On the prime server, using openssl 0.9.8, we exportet the key and converted the file to .pem.
When trying to install the certificate, we get the following error code:
prime# ncs key importkey key-nopw.pem newcert.pem repository certificate
INFO: no staging url defined, using local space. rval:2
ERROR: dowload of key-nopw.pem failed. rval:-200
Does anyone have an idea what formats can be used for prime ssl certificates and how to install them?
The official guide has only little information on how to make a csr and install the certificate.
Best regards,
Joerg

I solved the same problem 5min ago.!
select the device and press syc ..that helped me ...

Can i install Cisco prime infrastructure 1.3 with 1.1 license.

Can i install Cisco prime infrastructure 1.3 with 1.1 license.To be more precise it will be fresh installation
but the licenses I have is of 1.1.As per my overview from Cisco prime Infrastructure 1.2 NCS and NCS(WAN)
has been bundled into one service.But both were seperate entities in Cisco Prime Infrastructure 1.1.

It doesn't matter if you want to make a new installation or an upgrade. The questions is the license.
The base license is necessary for network management nodes (devices). But to get updates for your system you need the additional to your Base License the Lifecycle License (which can be ordered for 12, 24 or 36 months).
The Lifycycle License is also based on the number of managed devices. In your case 50 devices. So you have that License - congratulations!
Otherwise order the Lifecycle License for 50 devices (L-N-PI12-50-M). This generates CON-PSUU-PI12LF50 for 12 months, list price 414,81$. Then Upgrade from 1.1 to 1.2, patch the system and upgrade to 1.3.
Have fun,
Chris

Cisco Prime Infrastructure 1.2 is not working https & ncs

Hi, I have just deploy Cisco Prime Infrastructure 1.2 in a virtual appliance (Vmware Esxi 5.1). Console is ok & setup is also completed. but there is no NCS application. only app is shwoing: NCSPNP
Cannot access from https also.
Please suggest how to Starting Prime Infrastructure Serve

From what you describe, it sounds like you have installed the Plug and Play (PNP) ova image. You need to install the Prime Infrastructure image.
See the screenshot below for details (click to enlarge):

User Name and Password for Cisco Prime Infrastructure 2.1

Hi all:
I am stuck at the login page of Cisco Prime Infrastructure 2.1.
I have tried using the user name root and its password (when log in with root at Vsphere Client) and also the login user name "before" get into the appliance infrastructure, all cannot work.
Anybody knows what is the default username or password or any way to set the username and password for this Cisco Prime Infrastructure 2.1 website?
Thanks!
tangsuan

Hi Tangsuan,
Following is the documented procedure for password recovery..
In order to modify the GUI root user password, you will need to login to the NCS CLI
as an admin user, and enter the command
"ncs password root password <new password>" (without the quotes)
This should set the web interface root user password :
http://www.cisco.com/en/US/docs/wireless/ncs/1.1/configuration/guide/manag.html#wp1268889
If you have lost your CLI password , try the default logging that is ,
CLI user is admin and not root, so please try logging in as admin with
the password that was set during setup. If that does not work , you need
the install disk that came with the appliance to recover that password.
Follow these steps:
Recovering a Lost Admin Password
If you lose or forget the admin password for NCS appliance, follow these steps.
Step 1 Reboot the NCS appliance with the ISO DVD inserted. The Cisco Prime Network Control
System Welcome screen appears:
ISOLINUX 3.11 2005-09-02 Copyright (C) 1994-2005 H. Peter Anvin
             Welcome to Cisco Prime Network Control System
To boot from hard disk, press <Enter>.
Available boot options:
   [1] Network Control System Installation (Keyboard/Monitor)
   [2] Network Control System Installation (Serial Console)
   [3] Recover administrator password. (Keyboard/Monitor)
   [4] Recover administrator password. (Serial Console)
<Enter> Boot existing OS from Hard Disk.
Enter boot option and press <return>.
boot:
Step 2 Select the desired recovery option, 3 or 4, depending on how you
are connected to the appliance and then follow the prompts.
Thanks-
Afroz
***Ratings Encourages Contributors ****

Cisco Prime Infrastructure 1.2 on Windows Server/Hyper-V

Hi Everyone,
In Entriprise environment while designing a BYOD solution we need to integrate ISE3315 with CPI 1.2. I know that Cisco ISE software either runs on 3315 platform or other option is virtual appliance (which is VMware based). Now problem is that we have Hyper-V environment as standard so I need to go with ISE-3315. Here my concern is to I install CPI 1.2 on Hyper-V, or on a Windows Server (2008 or 2012) based machine. Is that doable?
Any help, suggessions would be warmly welcomed.
Thanks,
Azhar...

Cisco Prime LMS will slowly be phased out in favor of Cisco Prime Infrastructure and hence there are no new mainline releases are planned to provide support to new Hardware or virtualization support.
However, Prime LMS do support Hyper V Virtualization (As an installable in Windows 2008). Please note that Virtualization technologies like, VMWare and Hyper V virtualization systems are not supported in LMS 5000, and LMS 10000 Devices license, in Windows. VMWare Systems are supported in LMS 5000, and LMS 10000 Devices license in Soft Appliance. Virtualization technologies like, VMWare and Hyper V virtualization systems are not supported in LMS 5000, and LMS 10000 Devices license, in Windows. VMWare Systems are supported in LMS 5000, and LMS 10000 Devices license in Soft Appliance.
For more details on HW and SW requirements for Cisco Prime LMS, please check document here.
-Thanks
Vinod

Ciscoworks LMS 3.0 to Cisco Prime Infrastructure LMS 4.2

In order to complete the upgrade the LMS 3.x runs over a physical server that ends with the upgrade(server its gona be retired), the think is that the Cisco Prime comes with an UCS and its gona run over a VM. The question here is the "Cisco Prime Infrastructure 1.1 - Maj Upg from LMS 2.x/3.x" media could be runs as clean install, I mean with no LMS 3.x intalled before? an the "Prime Infrastructure LMS 4.2 - 1.5K Device Maj Upg Lic" could be registered with no license installed of LMS 3.x?

There are a couple of things to distinguish:
1. The product SKU you need to order to migrate from LMS 3 to LMS 4.2.
2. The license file that is installed on that new LMS server.
#1 is based on Cisco agreeing, usually through the partner or reseller you are working with, that you are entitled to order the upgrade SKU (vs. buy a complete new product). The upgrade SKUs are all listed in the ordering guide here.
L-PI12-1.5K-UP (note - NOT the 1.1 product description you noted in the original post) would be the SKU for a major upgrade from LMS 2.x/3.x to the current Prime Infrastructure 1.2 release at the 1500 device license level. That upgrade includes licenses for both PI 1.2 and Prime LMS 4.2. You may choose which to install - most LMS customers stick with LMS for now as PI 1.2 does not yet have full feature parity. Your managed devices should not exceed 1500 combined (in this case) but that combined number is not enforced technically by the product's license daemon.
Once you have purchased the product and have the media you can install it on any host that meets the installation prerequisites as far as OS, memory, disk etc. A clean installation of LMS does not check for or require a previous installation as far as technical checks.
#2 - Once you have installed the new LMS server (and optionally a step near the end of installation, you need to add in the license file (*.lic file). That is obtained through the Cisco licensing portal (or via the TAC if you prefer) using the Product Activation Key (PAK) received with your product.

UPS monitoring support with Cisco Prime Infrastructure 1.2

Dear Members,
Good day,
I am having a project implemented wherein i have the UPS power redudancy solution for our network devices.
Now can anyone gide that is it possible for below :-
UPS units installed with SNMP cards be monitored via Cisco Prime Infrastructure 1.2 as our monitoring & management solution is Cisco Prime Infrastructure 1.2 ?
if yes
Can you guide if following action would be possible to export the below logs from UPS unit to our Cisco Prime Infrastructure 1.2
   a) UPS fault status information
   b) UPS operational status(input power available Y/N)
   c) Battery fault status
   d) Battery charging current
   e) Battery charge level
   f) Output current
Conclusion is we need to confirm that would it be posible to achieve remote monitoring of these UPS units via our CPI 1.2
Thanks in Advance for your support & replies to this query.
Regards,
Muzammil N.

Prime Infrastructure 1.2 can manage non-Cisco devices in a limited fashion via SNMP query and trap processing. It cannot import logs and does not have a generic syslog server,
So if your devices have snmp read only support and can generate SNMP traps for the above you can add them to PI. Follow the manual add device procedure here.

Cisco Prime Infrastructure 1.3 Web Log Invalid user password

Hi,
I recently installed Cisco Prime Infrastructure 1.3 per the set up guide. I was able to login into the webinterface.
Then I insert the radius server and reload ncs. Since then I'm not able to login to the web interface. I get the following error message "Invalid Username or Password. Please try again". Even when I set the ncs root user with a new password. One issue could be that i forgot the enable fallback to local.
Is there a way to change the radius config back via cli?
Thanks a lot
Hansruedi

Hi Hansruedi,
Thanks you for your help and your time.
I followed your recomandation until the fourth step.
But after this step, I lost the web page connection.
I check nsc status but all is running :
NMS still stopped. NMS must be running to have an access by web page ?
I restart Prime (by reload command) but nothing changed.
Thanks

Cisco Prime Infrastructure patch 2.1.1 - HA issue

Hello,
I have a problem with the Cisco Prime Infrastructure patched to version 2.1.1. I did exactly what Installation Guidelines say:
http://www.cisco.com/c/en/us/td/docs/net_mgmt/prime/infrastructure/2-1-1/release/notes/cpi_rn.html
– Install the Prime Infrastructure 2.1.1 patch by using the Administration > Software Updates page on the primary server.
– Restart the primary server.
– Verify that the patch installation is complete. If you find the installation complete, decommission and reinstall the secondary server and add it back to the primary server.
I reinstalled HA server and I'm trying to add it to HA but I get "Failed to authenticate - Primary(xx.xx.xx.xx) and Secondary(xx.xx.xx.xy) PI version does not match"
Can you help me with that? What I'm doing wrong? or maybe this patch is not prepared to work in HA mode?
Regards

Symptom:
The installation instructions of PI 2.1.1 patch in a High Availability environment are not accurate and following these steps will result in the inability to re-pair the Primary and Secondary servers.
Conditions:
If the instructions are followed, then when the user attempts to re-pair the servers, an error will be encountered:
"High Availability Registration Failed - Failed to authenticate - Primary (x.x.x.1) and Secondary (x.x.x.2) PI version does not match".
Instead, the following steps have proved to work correctly:
1. Upload and install patch on primary.
2. Upload and install patch on secondary.
3. Stop NCS services on secondary
4. Stop NCS services on primary
5. Start services on secondary
6. Start services on primary
7. Re-pair HA servers from primary
Workaround:
Workaround 1:
On the secondary, go under root and issue:
# cd /opt/CSCOlumos/bin/
# ./hamode.sh primary
Answer 'yes' when prompted.
Go to admin user and execute
# ncs stop
After the services are stopped:
# ncs start
When the services are back up, login to the secondary GUI as you would login to a primary server
Go under Administration > Software update, upload the patch and install it.
Go to admin user and execute
# ncs stop
After the services are stopped:
# ncs start
When the services are up, go under root and issue:
# cd /opt/CSCOlumos/bin/
# ./hamode.sh secondary
Answer 'yes' when prompted.
Go to admin user and execute
# ncs stop
After the services are stopped:
# ncs start
After the message that services started successfully on the secondary, initiate a new High Availability configuration from the primary. Now the synchronization between the two servers should succeed.
Workaround 2:
Redeploy or reinstall the Primary server, restore the backup which was taken prior to applying the patch, reconfigure the High Availability and continue with the steps described in the Conditions section.
Further Problem Description:
Release Notes have been updated with more precise instructions.
Known Affected Releases:
(1)
2.1(0.0.85)

CISCO PRIME INFRASTRUCTURE 1.2 NCS ERROR

Hi everyone,
can anyone put through on this, i'm having issue starting the ncs server on cisco prime infrastructure 1.2 .below is the message i get when i do show ncs status:
NGPHC-CPR001/admin# ncs status
Health Monitor is running, with an error.
failed to start NCS on startup Health Monitor
Reporting Server is running
Ftp Server is running
Database server is running
Tftp Server is running
Matlab Server is running
NMS Server is stopped.
SAM Daemon is not running ...
DA Daemon is not running ...
Syslog Daemon is not running ...
status
thanks.

Hi Marvin,
Its has never worked. This is the first time i am installing it.
I haved done as you adviced but still getting the same error as stated above.
Please is there another way out.
thanks.

Cisco Prime Infrastructure 1.2 with Cisco Prime Network Control System Hardware Appliance

Hi Team,
I have following BOM
Cisco Prime Infrastructure
R-PI-1.2-K9
Cisco Prime Infrastructure 1.2
1
R-PI-1.1-500-K9
Prime Infrastructure 1.2 Software - 500 Device Base Lic
1
L-PILMS42-500
Prime Infrastructure LMS 4.2 - 500 Device Base Lic
1
L-PINCS12-500
Prime Infrastructure NCS 1.2 - 500 Device Base Lic
1
PRIME-NCS-APL-K9
Cisco Prime Network Control System Hardware Appliance
1
PI-APL-IMAGE-1.2
Cisco Prime Infrastructure 1.2 Appliance Software
1
Pls let me know if we have both NCS and LMS preinstalled with Cisco Prime Infrastructure 1.2 Appliance Software orwe need seperate appliance or server for LMS 4.2.
Regards

Hi Scott,
Thanks for the response but I got to know that LMS and NCS are combined in single ISO image from PI 1.2 and can be installed on the same physical NCS appliance.
Can you pls check this.
Regards

Install wildcard SSL on Cisco Prime Infrastructure 1.4

Similar Messages

Maybe you are looking for