Administer > NNMi Security and Multi-Tenancy > NNMi Security and Multi-Tenancy Configuration > Configuring Tenants

Configuring Tenants

Note Any number of static Network Address Translation (NAT) instances can be monitored by one NNMi management server, as long as each instance is configured with a unique tenant. See Managing Overlapping IP Addresses in NAT Environments, and the NNMi help, for more information.

NNMi provides the following ways to configure multi-tenancy:

  • The Tenant form in the NNMi console is useful for working with individual tenants.
  • The nnmsecurity.ovpl command-line interface is useful for automation and bulk operations. The tool also provides reports of potential problems with the tenant configuration.

The process of defining and configuring NNMi multi-tenancy to assign each NNMi topology object to a tenant (organization) is a cyclical process. This high-level procedure describes one approach to configuring NNMi multi-tenancy.

Note the following about configuring NNMi multi-tenancy:

  • The security group that NNMi assigns to a discovered node is set by the value of the Initial Discovery Security Group for the tenant associated with that node.
  • When you use the NNMi security model without also configuring NNMi tenants, all nodes are assigned to the Default Tenant.
  • When you seed a node for NNMi discovery, you can specify the tenant to which that node belongs. When NNMi discovers a node through an auto-discovery rule, NNMi assigns that node to the Default Tenant. After discovery, you can change the tenant assignment for the node.

One high-level approach to planning and configuring NNMi multi-tenancy is as follows:

  1. Analyze your customer requirements to determine how many tenants are required in the NNMi environment.

    It is recommended that tenants be used only when managing multiple separate networks with a single NNMi management server.

  2. Analyze the managed network topology to determine which nodes belong to each tenant.
  3. Analyze the topology of each tenant to determine the groups of nodes to which NNMi users need access.

  4. Remove the default associations between the predefined NNMi user groups and the Default Security Group and the Unresolved Incidents security group.

    Doing this step assures that users do not inadvertently obtain access to nodes they should not be managing. At this point, only NNMi administrators can access objects in the NNMi topology.

  5. Configure the identified tenants.

    1. Create the identified security groups.

    2. Create the identified tenants.

      For each tenant, set the Initial Discovery Security Group to either the Default Security Group or a tenant-specific security group with restricted access. This approach ensures that new nodes for the tenant are not generally visible until the NNMi administrator configures access.

  6. Prepare for discovery by assigning tenants to seeds.

    Tip After discovering a group of nodes, you can change the value of the Initial Discovery Security Group. Using this approach limits the manual re-assignment of nodes to security groups.

  7. After discovery completes, do the following:

    • Verify the tenant for each node and make changes as necessary.
    • Verify the security group for each node and make changes as necessary.

    See Verifying the Configuration.

Send Help Center feedback