This topic describes tasks and settings that can be enabled by a realm administrator. Each SCM has a realm that hosts one or more organizations. It includes these sections:

SCM is a hierarchical multitenant management portal with a deployed instance of SCM running in Amazon AWS, called a realm, at the top. The realm can host one or more organizations.

An organization represents an end customer. It contains the customer details, sites, devices, and zones associated with the devices, the uplinks, and so on.

Each realm has realm administrators and organization administrators.

A single Amazon instance could host 50 small organizations in production, whereas a larger organization might have one dedicated Amazon instance.

You can change settings associated with a realm after logging in to SCM with realm administrator credentials and using the tabs on the realm map. The procedures described in this topic require realm administrator credentials.

The Maintenance tab controls the centrally managed firmware upgrade process. A Riverbed appliance simply needs to be connected and registered, and the upgrade happens automatically when a new version of the firmware is available (unless you reschedule the upgrade or an upgrade schedule is customized for an organization within the realm). For details, see Upgrade overview.

The Settings tab is where you enable two-factor loopback authentication, allow access to the Riverbed Support team, enable APIs, add passwords to logins to improve security, and allow an organization administrator to reset their own password.

Realm administrators can set a password policy for all users, including organization administrators. The first time you enable a password policy, passwords for all users expire immediately and all users will need to create new passwords to log in to SCM. By default, password policy is disabled.

When password policy is enabled, a realm administrator can enter a temporary password in the Change password field that will allow a user to access SCM and reset their password. This is a one-time, temporary password that does not need to comply with the password policy criteria. The next time the user logs in, they must enter this temporary password. After they have correctly entered the temporary password, they must immediately create a new password that complies with the password policy criteria.

In SteelConnect 2.12, active user sessions will expire and require reauthentication when these account settings change:

A realm administrator can allow Riverbed Support to directly view and troubleshoot issues for an SCM instance.

SteelConnect features a powerful REST API for northbound traffic. When you enable REST API, it is enabled for all organizations within the realm. You can use the API to access many features that are also available through the SteelConnect Manager (SCM) graphical user interface (GUI). For details, see Accessing the API.

When two-factor authentication is enabled for the realm, all access to the realm GUI must be authenticated with a second authentication mechanism. The value of this setting is also the default setting for two-factor authentication when accessing individual organizations. You can override this default setting per organization.

The SNMP tab is where you enable SNMP operations (such as SNMP GET and SNMP WALK) as well as event reporting (in the form of traps) to the SNMP server.

SteelConnect provides support for these SNMP versions:

SteelConnect 2.10 and later support the standard device IF-MIB to monitor appliance interface statistics and SNMPv2 MIBs. IF-MIB statistics fetch information related to interfaces and monitor packet counters over these interfaces. For a list of SNMP events, see SNMP traps.

You can enable an on-premises network management system (NMS) to poll SteelConnect gateways for MIB objects related to IF-MIB and SNMPv2 MIB. Also, gateways will generate v1 and v2 traps asynchronously in case of some events: for example, interface down or up, authentication failure, and SNMP agent restart.

NetFlow collectors allow SNMP queries. For details, see Exporting NetFlow data.

When SNMP and NetFlow are enabled and NetFlow collectors are configured:

When direct SNMP reporting is enabled, your network management system (NMS) initiates the SNMP poll to all individual gateways in a realm. The gateways send SNMP data directly to the NMS. You can override this setting to limit the SNMP data to all gateways within an organization. To override the realm settings, see SNMP.

The direct SNMP reporting feature doesn’t support SNMPv3.

SCM forwards the configuration to the SteelConnect gateways, and the gateways use this configuration to set up the SNMP agent daemon. The SNMP agent services the GET and WALK requests from the NMS and also generates traps and sends them to the NMS.

To enable SNMP operations (such as SNMP GET and SNMP WALK or asynchronous traps from a SteelConnect appliance) you need to provide the NMS interface IP address through which the appliance is reachable.

The IP address of the appliance is required. For an SDI-2030 or SDI-5030 gateway, use the management IP address. For the SDI-130, SDI-330, and SDI-1030 gateways, use the local zone IP address.

The port number to query the appliance is the standard SNMP port 161. You need to specify this port if the NMS does not use it by default.

For midsize to large enterprises that require log exporting to a central server, an SCM appliance provides remote logging. With remote logging, all system logs (syslogs) from different appliances can be exported, aggregated, and stored in a single remote server located within the same enterprise network. Remote logging is configured for on-premise SteelConnect appliances sending logs to an on-premise syslog server to keep security, compliance, and audit requirements intact.

You can also export syslog messages to a local enterprise collector.

For details on the configuring a remote syslog server, the syslog message format, and a list of syslog messages, see Syslog overview.

NetFlow is a network protocol for the collection and monitoring of network traffic flow data generated by NetFlow-enabled appliances. Appliances running SteelConnect 2.12 can be enabled as flow exporters to export network flow information to a flow collector. In the flow exporter role, the appliances aggregate packet information into flows, and then export the flow records to one or more flow collectors using the IP Flow Information Export (IPFIX) protocol. For IPFIX details, see RFC5101.

The flow collector receives, stores, and preprocesses the flow data from the exporter.

NetFlow monitors all traffic flows that enter and exit the appliances, including flows on the underlay, overlay, and local flows. These flow records provide a central monitor with the SteelConnect view of the network.

You can enable NetFlow data export to a flow collector at the SCM realm, organization, or appliance level. When NetFlow is enabled for an organization, the organization settings take precedence over the realm settings.

SteelConnect supports NetFlow exporting on the SDI-130, SDI-330, SDI-1030, SDI-VGW, SDI-2030, and SDI-5030 gateways, and SteelHead SD appliances. NetFlow export is disabled by default at the realm and organization levels. NetFlow is enabled by default on appliances, and becomes active only when NetFlow is also enabled at the realm or organization level.

The NetFlow configuration levels are:

NetFlow export is typically enabled at the realm or organization level and you don't need to configure individual appliances. It can be useful to analyze NetFlow data for an appliance when you want to temporarily narrow the flows for troubleshooting..

If NetFlow monitoring is disabled on an appliance, or if an appliance is running SteelConnect 2.11.x or earlier, it will not export NetFlow data.

For details on configuring NetFlow at the organization level, see NetFlow.

NetProfiler or third-party collectors can be configured using an IPv4 address or fully qualified domain name (FQDN). You can configure a maximum of four NetFlow collectors (three collectors from either a realm or an organization and one from an appliance).

A collector is reachable over the overlay, the underlay, or the LAN.

Notes

SteelConnect pushes the NetFlow configuration to all of the organizations in the realm. When NetFlow monitoring is disabled on an appliance in the realm, or when an appliance is running SteelConnect 2.11.x or earlier, that appliance will not export NetFlow data.

The third-party integrations tab is where you integrate a third-party email service or alternative SMS provider with the realm.

By default, a SteelConnect realm uses the Riverbed hosted Amazon Simple Queue Service (SQS) email server and short message service (SMS) provider. A realm administrator can integrate a third-party email service or SMS relay into a realm for use in place of the Riverbed hosted services. While the Riverbed hosted services are reliable, integrating a third-party provider has the added benefits of easier tracking and improved security because the email addresses and phone numbers never leave the service provider domain, geography, country, or governing region (such as the European Union).

The Legal disclaimer tab provides a place to add a predefined legal disclaimer that appears each time a user logs in to SCM. For example, “This computer system is the private property of its owner, whether individual, corporate, or government. It is for authorized use only.”

The left menu provides realm administrators with ways to view organizations and administrators for the organizations. In addition, it provides a way to view a list of all appliances in every organization belonging to the realm.

Select this menu item to view a list of all organizations belonging to the realm, add an organization to a realm, edit an organization name, or select an organization to manage.

Select this menu item to assign administrative rights to individual administrator accounts per organization. You can also update the administrator’s contact information and change authentication settings.

SteelConnect uses role-based access control (RBAC) to enforce decisions regarding which administrators are authorized to access resources or perform actions. RBAC provides protection from unauthorized access and modification using fine-grained access controls. Permission to perform specific operations are assigned to specific roles, and admins are granted permission to perform specific operations only through their assigned roles. This simplifies system administration because you don’t need to assign admin permissions directly. The admins acquire them through their assigned roles.

You can create RBAC permissions that apply to an entire realm or by organization. When creating organization administrators, you can assign them a role that determines how much access they have to an organization and what tasks they can perform within an organization. Creating a role is easy because you select an existing role to use its permissions as the starting point for your new role. You can edit the rights after creating the role to fine-tune the permissions.

Role administration offers different types of SD-WAN by providing the ability to hide or expose different SteelConnect features, depending on permissions. For example, an organization admin might not have access to or be able to view the routing, AWS, Azure, and API features.

We recommend that you keep the number of realm administrators to a necessary minimum and create organization administrators to manage organizations. An administrator can be assigned to any number of organizations. An administrator can only be assigned one role per organization.

A realm administrator can provide authentication from the realm level, overriding organization settings.

When two-factor authentication is enabled for the realm, all access to the realm GUI must be authenticated with a second authentication mechanism, such as mobile messaging. The value of the realm setting is also the default setting for two-factor authentication when accessing individual organizations. This procedure overrides this default setting per organization.

Long-term session caching keeps an active session open indefinitely. To close an inactive session after 30 minutes, disable long-term session caching. By default, long-term session caching is disabled. This procedure overrides this default setting per organization. For details, see session expiration time under Password policy.

Choose Roles to assign a role to an administrator. A role is a set of permissions, or rights, that allow access to the ability to perform certain functions such as adding traffic rules. You can assign an administrator various roles across various organizations, but only one role can be assigned to an administrator per organization.

A role assignment includes selecting both a role and an organization for which an administrator will have that role. This is what determines:

These roles and permissions are predefined by default.

If the predefined roles don’t provide exact realm security requirements, a realm admin can create a custom role. Custom roles can be based on the permissions granted by one of the default roles and then fine-tuned. Or, the custom role can be empty with zero permissions and permissions can be added later.

If you would like to base the new role on a preexisting role, decide what type of role you are creating:

In SteelConnect 2.12, realm administrators can assign specific sites within an organization to an administrator to manage. Assigning a list of site tags to an administrator creates a Role-Based Access Control (RBAC) administrator. An RBAC administrator is an SCM administrator that has permission to manage specific sites within an organization, instead of all sites within an organization. An RBAC administrator cannot edit any entity not included in an assigned site. All entities that are outside of an assigned site are read-only, including the site tags.

An RBAC administrator cannot delete a site or change the site’s properties, even if they are given permission to manage the site.

Site-level permission always overrides the RBAC administrator permission in the event of a conflict. For example, for an administrator with site-level permission, the organization settings will always be read-only, irrespective of the role definition.

The role assignment table displays the site tags (if any) and the role for certain organizations.

This role provides access to top-level features not covered in the organization admin or network admin roles.

By default, all top-level menu items appear for admins with “other” rights. You can hide menu items and high-level access to services such as Riverbed support access.

To assign a role to an admin, see To assign a new role to an admin.

Choose Hardware to view a list of all appliances in every organization belonging to the realm. Select an appliance to view details about the appliance. Select the Organization tab to assign the appliance to another organization.