Explanation of the different Telnet/SSH connection types under the user preferences -> Topology Tab.

Products

• Spectrum
• Network Observability

Issue/Introduction

We want understanding, or documentation if available, explaining the difference between the below 3 options under Spectrum OneClick User Preferences under the Topology tab section.

How can we control or block SSH from one OneClick while allowing it on another OneClick?

Planning to deploy two new landscapes (Primary & Secondary SpectroSERVERs, OneClick & CAPM Collector). All of our landscapes connect back to a "central" landscape where all of our backend components sit and also has OneClick consoles that can access all the landscapes. The new landscapes have security requirements that determine how their devices can be accessed from outside their local network.

These settings are accessed in the OneClick UI via the View -> Preferences menu option. Navigate to the Topology Tab and select the "Telnet/SSH Connection Type" option.

Environment

All supported Network Observability DX NetOps Spectrum Fault Management releases

Cause

Local security requirements are driving SSH connection requirements.

Resolution

NOTES:

• There is no current option allowing use of the OneClick web servers to initiate and run SSH connections to devices.
• Only SpectroSERVERS, or local workstations where OneClick is run from by a user, can be used to initiate and run SSH connections to devices.
• Only the SpectroSERVER managing a given device is capable of using SSH to connect to the device.
• Uses the device models "Network Address" attribute value (attribute ID 0x#####) to determine the IP to connect to.
• The systems involved are defined as:
  • OneClick Client Host: The local laptop, desktop or VM where the OC UI (thick client or browser WebApp) is running.
  • OneClick Web Server: The OneClick tomcat web server the users connect to to launch the OC UI (thick client or browser WebApp).
  • SpectroSERVER: The SpectroSERVER managing the device, the one capable of connections.
• Ensure network ACL's and Firewalls are properly configured to allow the Telnet or SSH TCP sessions between the host initiating them and the devices.

 

The Options presented in the OneClick UI are defined as follows.

• Option 1: "Connect to the device through OneClick web server and SpectroSERVER" (default)"
  • Starts at the OC client host making the request, then to the OC Web Server, then to the SpectroSERVER.
    • Client OC -> OC web server -> SS
  • The Telnet or SSH TCP sessions themselves are between the SS managing the device and the device.
• Option 2: "Connect to the device through SpectroSERVER"
  • Starts at the OC client host making the request. Goes direct to the SpectroSERVER to connect to the device.
  • OC Web Server is not involved.
  • The Telnet or SSH TCP sessions themselves are between the SS managing the device and the device.
• Option 3: "Connect to the device directly"
  • Goes direct from the OC client host making the request via the UI to the device.
  • Neither SpectroSERVER nor OC Web Server hosts are used.
  • The Telnet or SSH TCP sessions themselves are between the OC client host making the request via the UI direct to the device itself.

Additional Information

The following KB article discusses implementation options for configuring SSH session control. It's able to be controlled at individual user, User Group or Global levels in Spectrum.

• Article Title: How to Configure Telnet or SSH Connection Initiation Point in Spectrum OneClick

Please reference the "Set OneClick Preferences" section of the documentation for more information about the Topology Tab Preferences.