Admin🔗

The Admin section provides high-level system configuration, user management, security, operational management tools, and settings.

VNFs🔗

The VNFs section manages virtual machine installations of the vNetC and SDLC, including the ACS, Backend Service(s), and AI Service.

vNetC Commander🔗

This section is composed of important processes working within the vNetC virtual machine.

System Applications🔗

System Applications are:

ACS
DHCP Server
Backend Service(s)
AI Service

Installing System Applications🔗

Go to Admin.
Select VNFs.
Click Add a System Application button ()
In the window that appears, click the desired System Application ()

The example below demonstrates how to install Backend Service(s); the steps are applicable to the other System Applications.

How to Install or Update Backend Service(s)🔗

Backend Service(s) is a System Application that increases UI performance. To add Backend Service(s) to your application do the following:

Go to Admin/VNFs and navigate to the section of the window titled System Applications .
Click the create button () .
Choose Add a Backend Service(s) from the prompt ( ).
In the window that appears, enable the application by clicking the enable button ()and fill out the fields with the relevant IP information.
Save your work by clicking the checkbox icon().
The yellow Status box text will read Awaiting Status. When it changes to Connected, the process is complete. ()

Licensing🔗

Licensing displays the license expiration date, support contact information, and reports on license and physical port usage.

Reserved Ranges🔗

The Reserved Ranges are a set of editable value ranges for networking identifiers used in the provisioning process. On a new system, it populates with system-wide working default values, so the user doesn't need to perform any custom configuration to have a working system.

Read about Reserved Ranges Per Fabric here..

AI Provider Config🔗

These setting allow you to choose your AI provider.

How to Configure AI Ops🔗

AI Ops is Verity's AI-powered messaging assistant. To add AI Ops to your application, set the AI Provider Config values by doing the following:

Go to Admin → AI Provider Config.
In the Provider Configuration form, set the AI Provider.
In the API Key field, click the Edit Encrypted Field icon and, in the form that appears, paste your API key.
Click Save.

How to Disable AI Ops🔗

Go to Admin → AI Provider Config.
In the Provider Configuration form, set the AI Provider to None.

Users🔗

Users provides tools for authentication, user settings, and role assignment.

Roles🔗

Verity supports role based access (RBAC) permissions scheme to partition the various workflows to operational personnel.

The Roles settings are found under Admin → User Roles. Use them to grant or remove editing access to specific features for each role (also called a User Type).

User Types are created by clicking the Create a New User Type button, creating a name for the User Type and submitting the form.

The Roles window contains a collection of checkboxes with each User Type (role) listed as a column item and each Permission is listed as a row item. You enable and disable checkboxes to determine what Permissions are accessible to each Role.

**User Types **(roles) have titles like Admin, Admin Tech and Read Only.
Permissions have titles like Fabric Panel, Admin Panel and Tenancy Panel.

User Permission Roles🔗

Permission	Parameters	Department / Team
Specific Fabrics	Limits the Fabric Permissions below to the fabrics assigned in Admin > User Fabric Permissions.	Scope setting (not a role)
Fabric Permissions
[DEV] Device Management	Capability to manage Devices.	Device Operations
[FP] Fabric Panel	Capability to edit Fabrics, PODS, Planes, fabric-level objects and both types of Bundles (locked and unlocked)	Fabric Architecture
[UB] Unlock Bundle	Edit unlocked Bundles	Service Provisioning
Global Permissions
[AP] Admin	Grants access to edit all features in the GUI	Super Administrator
[OP] Operations Panel	Capability to Import/Export. Manage Badges, Views and Time Traveler	Change & Release Management
[TP] Templates Panel	Edit Tenants, Bundles and Provisioning objects	Network Engineering
[TNP] Tenancy Panel	Edit Tenants, Services and Tenant Gateways	Tenant & Routing Services
Idle Time Logout (min)	Number of minutes a user can remain inactive before they are logged out	Any

Specific Fabrics🔗

When Specific Fabrics is enabled on a User Type, users with that type can access only the Fabrics an administrator assigns to them in Admin → User Fabric Permissions.

User Fabric Permissions🔗

Admin → User Fabric Permissions is where administrators assign individual Fabrics to User Types.

In the image below, a User Type titled Net Specialist is granted editing privileges for a Fabric named Traffic Collection.

How Fabric Permissions work🔗

In a User Type, Fabric Permissions and Specific Fabrics work together:

Fabric Permissions: what the user can edit (the features you check).
Specific Fabrics: where they can edit (every fabric, or only the fabrics you pick).

Specific Fabrics	Result
Unchecked	The user can edit the selected features on all fabrics.
Checked	The user can edit the selected features only on the fabrics assigned to them in Admin > User Fabric Permissions.

Note: Selecting Specific Fabrics alone does not grant any access. You must also select at least one feature under Fabric Permissions; otherwise, the user cannot edit anything on their assigned fabrics.

The Read/Write example below meets this requirement. However, if no fabrics are selected in Admin → User Fabric Permissions, the Read/Write role behaves as Read Only.

Considerations🔗

Specific Fabrics needs Fabric Permissions. Checking Specific Fabrics grants nothing by itself, the User Role must select at least one Fabric Permissions option.
Operations is nearly as powerful as Admin. Time Traveler and Import/Export can roll back or replace the configuration for the whole network. NOS image updates can reboot many switches at once. Give this panel only to trusted staff.
Authentication settings are in two panels. RADIUS is in Operations. TACACS, LDAP and Device AAA Profiles are in Templates. Anyone with either panel can change how users log in to the switches.
Templates and Tenancy depend on each other. Route maps are created in Templates and assigned in Tenancy. A Tenancy-only user can attach route maps but can't create or edit them.

User Accounts🔗

Assigning Users to User Types (roles)🔗

In Admin → User Accounts, each user is assigned a User Type. The User Type is under the heading titled Access Level.

From the Admin window select the Users Accounts item box.
In the window that appears, click the Access Level menu item twice for the chosen user. You can also select the edit icon () in the upper right corner of the User Accounts window to edit the page.
Choose the Username you want to assign and set the Access Level to the desired User Type (role).
To complete the process, click the checkmark () in the upper right corner of the User Accounts window to save your work.

User RADIUS Logins🔗

Remote Authentication Dial-In User Service (RADIUS) is a networking protocol that provides centralized Authentication, Authorization, and Accounting (AAA or Triple A) management for users who connect and use a network service. RADIUS is a client/server protocol that runs in the application layer and can use either TCP or UDP as transport. The devices associated with Endpoints control access to a network as they contain a RADIUS client component that communicates with the RADIUS server. RADIUS is often the back end of choice for 802.1X authentication as well.

To access the RADIUS Logins settings:

Navigate to Admin.
In the Users column select User RADIUS Logins.

The Verity platform provides the option for RADIUS integration iVN-Authorization/Server IP/Port/Shared secret are required inputs. User permission level will be passed down according to the following levels:

Vendor IDs are assigned by IANA

| VENDOR | iPhotonix | 49683 |

RADIUS dictionary for Verity remote authentication provides the initial authorization level. Once authenticated, accounts are automatically created and updated with the iVN-Auth level. The "superuser" user does not actually exist within Verity, it is mapped to (same as) the "admin" user. The "authenticated" value indicates that the user is authenticated but that the authorization is based on internal records as managed by the Verity Admin page. The initial level is readonly. An authentication returned with no iVN-Auth entry will be ignored. Only the first iVN-Auth will be honored.

ATTRIBUTE	iVN-Auth	String
VALUE	iVN-Auth	superuser
VALUE	iVN-Auth	admin
VALUE	iVN-Auth	readwrite
VALUE	iVN-Auth	readonly
VALUE	iVN-Auth	authenticated

Optional authorization modifier This instructs the Verity Web UI to modify the operations and results available to the user. For example, the value "tech" modifies the web behavior for "admin" and "superusers" to include more technically-oriented features.

ATTRIBUTE	iVN-Auth-Modifier	string
VALUE	iVN-Auth-Modifier	tech

User Limits🔗

User Limits sets the number of simultaneous users that can access the website simultaneously

User SSH Keys🔗

Here you can view, upload and delete user SSH keys.

Certificates🔗

Certificates manages the import and revocation of application certificates. This is where you work with SSL certificates, certificate chains and certificate revocations.

Importing Certificates🔗

To import a Certificate:

Navigate to the Admin section and select Certificates ().
Double-click the tile that describes the certificate you want to upload.
Either drag the certificate to the drag and drop section or click the browse button and select your certificate file to upload it.

vNetC Server Certificate🔗

For the vNetC Server Certificate panel, certificate files must be in PEM format. The vNetC Server Certificate should include

Private Key File
Certificate File
Optional CA Intermediate Certificate

These should all be in PEM format, concatenated in that order. The CA Root Certificate should not be included.

Once uploaded, the vNetC Server Certificate is automatically added to the backend web path. Although this does reconfigure the backend process, this is done so that new connections will be handled using the new certificate but old connections will continue the operate as before, so there is no outage of the web service during a certificate update.

Information

Verity can be configured to support client certificate authentication. This operates in a "lockdown" mode that meets US DoD requirements. It does impose strict access requirements on all transports in the systems and demands client certificates for all users, devices, and external application access.

Software🔗

The Software section controls software lifecycle management including vNetC platform packages, hardware-specific firmware images, bundled image packages, configuration file management, and application package deployment.

Branding🔗

Branding customizes the user interface with white-label options, including the login banner, top navigation logo, browser favicon, splash screen, lower-right copyright text, the product documentation hyperlink destination and general application settings.

Network🔗

Network configures system-wide network behavior, management connectivity, WAN routing, and optional feature toggles.

Admin Settings🔗

Admin Settings is accessed from Admin/Admin Settings and lets you configure the following:

vNetc Address on Management VLAN
Permissible IP Address Ranges on Managed Devices
Customized Download Address/FQDN

Feature Flag🔗

Feature flags are used to enable or disable visibility of options in the UI and other system wide behaviors. Please consult with customer service regarding the usage of these settings beyond the defaults that are set upon installation.

Global🔗

Allow Dup VLANs

Services to allow duplicate VLNs

SONiC RESTCONF

Enable or disable SONiC RESTCONF support

Static Reports

Used for extremely large fabrics.Stops reports from dynamically updating unless requesting.

TLS Downloads external Use HTTPS instead of HTTP for firmware downloads.This causes extra vNetC load.

Zero-Touch Provisioning

Generates ZTP files.

Zero-Touch Provisioning: Connectivity Check

When unchecked, skips the post-provisioning connectivity check for in-band managed switches, where the management path may not be immediately reachable after ZTP completes.

Persistent🔗

Enhanced Password Security Enable or disable password constraints and expiration. Existing users are not affected until a password change takes place.

Prohibit SSH Password Logins

Disables password-based logins to the vNetC, Monitoring, and controller command-line prompts.
SSH access to the vNetC remains enabled, but only via keys registered under Admin → User SSH Keys.
SSH access to Monitoring and the controllers is permitted from the vNetC using ns_cli.
Restrictions may take up to an hour to apply to the Monitoring and controller targets.
If the change is required immediately, restart the target.

Per Fabric🔗

This section contains three fields per Fabric.

Allow all underlay connections

Allows underlay connection between PODS

Port admin polling interval

Polling intervals values in seconds, set if aggressive reporting is not enabled.

Port status polling interval