Tenant Best Practices for Global Network Management

NNMi Global Manager administrators and NNMi Regional Manager administrators need to work together to synchronize Tenants and Security Groups for replicated Nodes.

See also About Multi-Tenancy and Global Network Management and Troubleshooting Tenants in Global Network Management.

Best practice procedure for establishing Tenants in a Global Network Management environment:

1. The NNMi administrators work together to agree on a naming strategy for the Tenants assigned to replicated Nodes and the Initial Discovery Security Group attribute value for those Tenants.

   When a Tenant is assigned to a particular Node, the associated Security Group for that Tenant can be different on the Regional Manager and Global Manager:

   Node Attribute	Original Node's Attribute Value on NNMi's Regional Manager	Replicated Node's Attribute Value on NNMi's Global Manager
   Tenant	Name: ABC	→ Same Name as Regional Setting.
   Security Group	Name: < strategy > (These names can be independent of the Security Group names required by the Global Manager. Use any logic that works for your team.)	Name: < strategy > (These names can be independent of the Security Group names required by any of the Regional Managers. For example, consider names that indicate which Regional Manager replicated the Node.)

2. The NNMi Global Manager's administrator does the following according to the new naming strategy (determined in step 1):

   • Defines all Security Groups required by the Global Manager.

     If your team plans to use certain Security Groups on multiple NNMi management servers (Regional Managers / Global Manager), defines all those shared Security Groups. This establishes the UUID assigned to each shared Security Group.

   • Defines all Tenants required by the Regional Managers and all Tenants required by the Global Manager. This establishes the UUID assigned to each Tenant. For each Tenant's Initial Discovery Security Group attribute value, use one of the Security Groups that are appropriate for the Global Manager (because this setting is independent of the Regional Manager's setting).
   • Uses the nnmconfigexport.ovpl command line tool to export the new Tenant object definitions and Security Group object definitions for importing into each Regional Manager's database. See the nnmconfigexport.ovpl Reference Page.

   • Updates each Node's Tenant assignment (to match the naming strategy determined in step 1):

     For non-replicated Nodes: Uses the nnmsecurity.ovpl command line tool to update Tenant assignments for each Node in the NNMi Global Manager's database to the newly created Tenants. See the nnmsecurity.ovpl Reference Page.

     For replicated Nodes: After completing step 3, each replicated Node's Tenant assignment is automatically updated in the NNMi Global Manager's database (to match the Regional Manager's assignment the next time the Regional Manager forwards information about discovery and monitoring results to the Global Manager).

   • Updates each Node's Security Group assignment (to match the naming strategy determined in step 1):

     Change existing Security Group assignments for all Nodes in the Global Manager's database using one of the following methods:

     • The Security Wizard. See Using the Security Wizard View.
     • The nnmsecurity.ovpl command line tool. See the nnmsecurity.ovpl Reference Page.

     Note These Security Group assignments can be different from the Regional Manager's assignments, and any changes to the Regional Manager's Security Group assignment for each Node are not replicated from Regional Managers to the Global Manager.

3. Each Regional Manager's NNMi administrator does the following according to the new naming strategy (determined in step 1):

   • Uses the nnmconfigimport.ovpl -c security command line tool to import the new Tenant object definitions and Security Group object definitions (the Global Manager's exported settings). See the nnmconfigimport.ovpl Reference Page.

   • Optional. Deletes any imported Tenants that are not relevant for this Regional Manager.
   • If not using shared Security Groups: Modifies each Tenant's Initial Discovery Security Group setting to one of the Security Groups that are appropriate for this Regional Manager.
   • Optional. Deletes any imported Security Groups that are not relevant for this Regional Manager.

   • Updates each Node's Tenant assignment (to match the naming strategy determined in step 1):

     Use the nnmsecurity.ovpl command line tool to change each Node's Tenant assignment to the appropriate imported Tenant. See the nnmsecurity.ovpl Reference Page.

   • Updates each Node's Security Group assignment (to match the naming strategy determined in step 1):

     Change existing Security Group assignments for all Nodes in the Regional Manager's database using one of the following methods:

     • The Security Wizard. See Using the Security Wizard View.
     • The nnmsecurity.ovpl command line tool. See the nnmsecurity.ovpl Reference Page.

     Note These Security Group assignments can be different from the Global Manager's assignments, and the changes to the Security Group assignments are not replicated to the Global Manager.

   • Repeat step 3 for each Regional Manager.