Brocade Network OS NETCONF Operations Guide v4.1.1 - Manual (Page 187)

Network OS NETCONF Operations Guide 155
53-1003231-02
Security monitoring
12
Displaying security monitoring default values
To display the default values of security threshold and alert options, issue the <security> custom
action located in the <threshold> node in the urn:brocade.com:mgmt:brocade-threshold-monitor
namespace. The <threshold> node is, in turn, located by augmentation under the
<show>/<defaults> node hierarchy in the urn:brocade.com:mgmt:brocade-common-def
namespace.
<rpc xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" message-id="1116">
<nca:action xmlns:nca="http://tail-f.com/ns/netconf/actions/1.0">
<nca:data>
<show xmlns="urn:brocade.com:mgmt:brocade-common-def">
<defaults>
<threshold
xmlns="urn:brocade.com:mgmt:brocade-threshold-monitor-ext"/>
<security/>
</threshold>
</defaults>
</show>
</nca:data>
</nca:action>
</rpc>
Configuring security monitoring
Use the following procedure to configure security monitoring on a standalone switch. For a Fabric
Cluster configuration, you must first identify the routing bridge with the <rbridge-id> element in the
urn:brocade.com:mgmt:brocade-rbridge namespace.
1. Issue the <edit-config> RPC to configure the <threshold-monitor-hidden> node in the
urn:brocade.com:mgmt:brocade-threshold-monitor workspace.
2. Under the <threshold-monitor-hidden> node, include the <threshold-monitor>/<security>
hierarchy of node elements.
3. Under the <security> node, include the <policy> node element to specify that the system will
monitor the security parameters using custom settings rather than the default settings.
4. Under the <policy> node, include the <sec_policy_name> leaf element, and specify “custom.”
5. Under the <policy> node, specify the <area> node element.
6. Under the <area> node, specify the following elements.
a. In the <sec_area_value> leaf element, specify “telnet-violation,” or “login-violation.”
b. In the <timebase> element, specify the allotted amount of time that can pass since the
previous reading. Polling values are taken at different intervals depending on the
configured time base.
c. Under the <threshold> node element, include the <high-threshold>, <low-threshold>, and
<buffer> leaf elements:
In the <sec-high-threshold> element, specify the high limit for the specified security
violation type.
In the <sec-low-threshold> element, specify the low limit for the specified security violation
type.