- play_arrow Customer Portal
- play_arrow Introduction
- Unified Administration and Customer Portal Overview
- Customer Portal Overview
- Switching the Tenant Scope
- Accessing Customer Portal
- Setting Up Your Network with Customer Portal
- Changing the Password on First Login
- Changing the Customer Portal Password
- Resetting the Password
- Extending the User Login Session
- play_arrow Using the Dashboard
- play_arrow Managing Objects
- play_arrow Monitoring Security Alerts and Alarms
- play_arrow Monitoring Security and Device Events
- About the All Security Events Page
- About the Firewall Events Page
- About the Web Filtering Events Page
- About the IPsec VPNs Events Page
- About the Content Filtering Events Page
- About the Antispam Events Page
- About the Antivirus Events Page
- About the IPS Events Page
- About the Device Events Page
- About the Screen Events Page
- play_arrow Monitoring SD-WAN Events
- play_arrow Monitoring Applications
- play_arrow Monitoring Threats
- play_arrow Monitoring Jobs
- play_arrow Managing Devices
- play_arrow Managing Device Images
- play_arrow Configuring Network Services in a Distributed Deployment
- Network Service Overview
- About the Network Services Page
- About the Service Overview Page
- About the Service Instances Page
- Configuring VNF Properties
- vSRX VNF Configuration Settings
- LxCIPtable VNF Configuration Settings
- Cisco CSR-1000v VNF Configuration Settings
- Riverbed Steelhead VNF Configuration Settings
- play_arrow Managing Firewall Policies
- Firewall Policy Overview
- About the Firewall Policy Page
- Creating Firewall Policy Intents
- Editing, Cloning, and Deleting Firewall Policy Intents
- Selecting Firewall Source
- Selecting Firewall Destination
- Firewall Policy Examples
- Firewall Policy Schedules Overview
- About the Firewall Policy Schedules Page
- Creating Schedules
- Editing, Cloning, and Deleting Schedules
- play_arrow Unified Threat Management
- UTM Overview
- Configuring UTM Settings
- About the UTM Profiles Page
- Creating UTM Profiles
- Editing, Cloning, and Deleting UTM Profiles
- About the Web Filtering Profiles Page
- Creating Web Filtering Profiles
- Editing, Cloning, and Deleting Web Filtering Profiles
- About the Antivirus Profiles Page
- Creating Antivirus Profiles
- Editing, Cloning, and Deleting Antivirus Profiles
- About the Antispam Profiles Page
- Creating Antispam Profiles
- Editing, Cloning, and Deleting Antispam Profiles
- About the Content Filtering Profiles Page
- Creating Content Filtering Profiles
- Editing, Cloning, and Deleting Content Filtering Profiles
- About the URL Patterns Page
- Creating URL Patterns
- Editing, Cloning, and Deleting URL Patterns
- About the URL Categories Page
- Creating URL Categories
- Editing, Cloning, and Deleting URL Categories
- play_arrow Managing SD-WAN
- play_arrow Managing NAT Policies
- NAT Policies Overview
- About the NAT Policies Page
- Creating NAT Policies
- Editing and Deleting NAT Policies
- About the Single NAT Policy Page
- Creating NAT Policy Rules
- Editing, Cloning, and Deleting NAT Policy Rules
- Deploying NAT Policy Rules
- Selecting NAT Source
- Selecting NAT Destination
- NAT Pools Overview
- About the NAT Pools Page
- Creating NAT Pools
- Editing, Cloning, and Deleting NAT Pools
- play_arrow Managing SSL Proxies
- SSL Forward Proxy Overview
- About the SSL Proxy Policy Page
- Creating SSL Proxy Policy Intents
- Editing, Cloning, and Deleting SSL Proxy Policy Intents
- Understanding How SSL Proxy Policy Intents Are Applied
- About the SSL Proxy Profiles Page
- Creating SSL Forward Proxy Profiles
- Editing, Cloning, and Deleting SSL Forward Proxy Profiles
- Configuring and Deploying an SSL Forward Proxy Policy
- play_arrow Managing Shared Objects
- Addresses and Address Groups Overview
- About the Addresses Page
- Creating Addresses or Address Groups
- Editing, Cloning, and Deleting Addresses and Address Groups
- Services and Service Groups Overview
- About the Services Page
- Creating Services and Service Groups
- Creating Protocols
- Editing and Deleting Protocols
- Editing, Cloning, and Deleting Services and Service Groups
- Application Signatures Overview
- About the Application Signatures Page
- Creating Application Signature Groups
- Editing, Cloning, and Deleting Application Signature Groups
- About the Departments Page
- Creating a Department
- Modifying a Department
- Deleting a Department
- play_arrow Managing Deployments
- play_arrow Managing Sites
- About the Sites Page
- Local Breakout Overview
- Multihoming Overview
- Device Redundancy Support Overview
- Upgrading Sites Overview
- Creating Spoke Sites for Hybrid WAN Deployment
- Creating Local Service Edge Sites for Hybrid WAN Deployment
- Creating Regional Service Edge Sites for Hybrid WAN Deployment
- Creating On-Premise Hub Sites for SD-WAN Deployment
- Creating On-Premise Spoke Sites for SD-WAN Deployment
- Creating Cloud Hub Sites for SD-WAN Deployment
- Creating Cloud Spoke Sites for SD-WAN Deployment
- Provisioning a Cloud Spoke Site in AWS VPC
- Importing Multiple Sites
- Managing a Single Site
- Configuring a Single Site
- Upgrading Sites
- Managing LAN Segments on a Tenant Site
- Activating a CPE Device
- Activating Dual CPE Devices (Device Redundancy)
- Viewing the History of Tenant Device Activation Logs
- Configuring VRFs and PNE Details for a Site in a Centralized Deployment
- play_arrow Managing Site Groups
- play_arrow Security Reports
- Reports Overview
- About the Security Report Definitions Page
- Performing Different Actions on Reports
- About the Security Generated Reports Page
- Creating Log Report Definition
- Creating Bandwidth Report Definition
- Editing and Deleting Log Report Definitions
- Editing and Deleting Bandwidth Report Definitions
- play_arrow SD-WAN Reports
- play_arrow Managing Tenant Users
- play_arrow Managing Audit Logs
- play_arrow Managing Tenant User Roles
- play_arrow Licenses
- play_arrow Signature Database
- play_arrow Managing Certificates
- play_arrow Managing Juniper Identity Management Service
-
- play_arrow Designer Tools
- play_arrow Configuration Designer
- Configuration Designer Overview
- Accessing the Configuration Designer
- Using the Configuration Designer
- Changing Your Password
- About the Requests Page for the Configuration Designer
- Creating Requests for Configuration Templates
- Designing Templates with a YANG Configuration
- Designing Templates with a Configuration
- Publishing Configuration Templates
- About the Designs Page for the Configuration Designer
- Cloning Configuration Templates
- Deleting Configuration Template Designs
- play_arrow Resource Designer
- Resource Designer Overview
- Using the Resource Designer
- Accessing the Resource Designer
- About the Requests Page for the Resource Designer
- VNF Overview
- Creating Requests for VNF Packages
- Designing VNF Packages
- Adding VNF Managers
- Publishing VNF Packages
- About the Designs Page for the Resource Designer
- Cloning VNF Packages
- Importing VNF Packages
- Exporting VNF Packages
- Deleting VNF Packages
- play_arrow Network Service Designer introduction
- play_arrow Creating Requests for Network Services
- play_arrow Creating Network Services
- About the Build Page for the Network Service Designer
- Viewing Information About VNFs
- Designing Network Services
- Connecting VNFs in a Service Chain
- Defining Ingress and Egress Points for a Service Chain
- Monitoring Performance Goals
- Configuring Network Services
- vSRX Configuration Settings
- LxCIPtable VNF Configuration Settings
- Cisco CSR-1000v VNF Configuration Settings
- Riverbed Steelhead VNF Configuration Settings
- Fortinet VNF Configuration Settings
- Ubuntu VNF Configuration Settings
- play_arrow Managing Network Services
-
- play_arrow Downloads
Adding a Single Tenant
You can use the Add Tenant page to add tenant data and other objects associated with a tenant, such as tenant user, network details, deployment scenario, service profiles, and custom properties. A single tenant supports centralized deployment, distributed deployment, SD-WAN deployment, and hybrid (both centralized and distributed) deployment scenarios.
In earlier versions of CSO, when a tenant user logs in to the Customer Portal for the first time, the user is assigned the Tenant Administrator role by default. With the introduction of object-based custom roles, the tenant user that logs in to Customer Portal for the first time might have customized roles and the role is not restricted to Tenant Administrator.
Begin by creating all the resources required for the network point of presence (POP).
The information listed on the Tenants page changes depending on the authentication mode configured:
Local Authentication—You can add the administrative user information as the first step from the Tenants page.
Authentication and Authorization with SSO Server—The Admin User information is not displayed on the Tenants page because users are not created in CSO and they are managed in the SAML identity provider. In addition, users are dynamically authorized to the CSO role based on the mapping rules configured in the SAML authentication.
Authentication with SSO Server—When you create the administrative user, the login page does not require you to configure a password because the user is created in the SSO without the password and you can enter only the username.
To add a tenant:
- Select Tenants > All Tenants > +.
The Add Tenant page appears.
- Update the tenant information. Complete the configuration according to the guidelines provided in Table 1.
- Click OK. If you want to discard your changes,
click Cancel instead.
If you click OK, the tenant that you configured appears on the Tenants page.
- If you use the tenant for a hybrid WAN centralized deployment,
access Contrail and add the following rule to the default security
group in the Contrail project.content_copy zoom_out_map
Ingress IPv4 network 0.0.0.0/0 protocol any ports any
This rule allows the network to accept traffic from all subnets.
Table 1: Fields on the Add Tenant Page
Field | Description |
|---|---|
Tenant Info | |
Name | Enter the name of the tenant. You can use an unlimited number of alphanumeric characters, including special characters. Example: test-tenant |
Admin user | |
First Name | Enter the first name of the user. |
Last Name | Enter the last name of the user. |
Username (Email) | Enter the e-mail ID of the user. The e-mail ID is also the username for the user. This field is automatically populated after you enter the tenant name. Example: test-tenant_admin@test-tenant.com |
Roles | Select one or more roles (both predefined and custom roles) that you want to assign to the tenant user. Note: In the Available column, all tenant scope roles are listed. Click the greater-than icon (>) to move the selected role or roles from the Available column to the Selected column. Note that you can use the search icon on the top right of each column to search for role names. Click the role name to preview the access privileges assigned to the user. |
Password Policy | |
User Password Expires | Select one of the following options:
|
Password Expiration Days | Specify the duration (in days) after which the password expires and must be changed. The range is from 1 through 365. The default value is 180 days. |
Topology Info | |
Deployment Type | Select at least one site type for the tenant.
Select both check boxes, if you want the tenant to create both SD-WAN site and Hybrid WAN site. Note: The options listed in Customer Portal > Sites > Add are filtered based on the site type that you have selected for a tenant. For example, if you have selected Hybrid WAN sites for a tenant, in Customer portal > Sites > Add, only the following options are listed:
|
Hub creation in full mesh | This toggle button is enabled by default if you selected the full mesh option for SD-WAN sites. You can create a hub for a full mesh topology. All sites are connected to the hub at least through one WAN link. |
Tenant Properties | |
SSL Settings Note: This setting is applicable only to the SD-WAN deployment scenario. | |
Default SSL Forward Proxy Profile | Click the toggle button to enable a default SSL proxy profile for the tenant. If you enable this option, the following items are created when a tenant is added:
This option is disabled by default. Note: You use this option to create a tenant-wide default profile; enabling or disabling this option does not mean that SSL is enabled or disabled. If you enable this option, you must add a root certificate. |
Root Certificate | You can add a root certificate (X.509 ASCII format) by importing the certificate content from a file or by pasting the certificate content:
After the tenant is successfully added, a default root certificate, a default SSL proxy profile, and a default SSL proxy profile intent are created. Note:
|
VPN Authentication Note: This setting is applicable only to the SD-WAN deployment scenario. | |
Authentication Type | Select the VPN authentication method to establish a secure IPsec tunnel:
|
Overlay Tunnel Encryption Note: This is applicable only to the SD-WAN deployment scenario. | |
Encryption Type | For security reasons, all data that passes through the VPN tunnel must be encrypted. Select the encryption type:
The default encryption type is AES-256-GCM. Note: The MX Series routers do not support encryption types, AES-128-GCM and AES-256-GCM. The default encryption type for MX Series routers is, AES-256-CBC. |
Network Segmentation | |
Network Segmentation | Enable network segmentation on the tenant. |
Service Profiles | |
VIM Name | If you use a dedicated OpenStack Keystone for Contrail Service Orchestration in a centralized deployment, then select the virtualized infrastructure manager (VIM) for the tenant. A tenant can be associated with multiple VIMs. Example: test-vim |
Service Profile Name | If you use a dedicated OpenStack Keystone for Contrail Service Orchestration in a centralized deployment, then select the service profile that specifies the authentication information for the tenant. You configure the service profile when you create the VIM. Example: service-profile-for-test-vim |
Custom Properties | If you have set up a third-party provider edge (PE) device by using software other than Contrail Service Orchestration, then configure settings on that router by specifying custom parameters and its corresponding values. |
Name | Specify any information about the site that you want to pass to a third-party router. Example: Location |
Value | Specify a value for the information about the site that you want to pass to a third-party device. Example: Boston |
SD-WAN Mode | Note: This field appears only if you selected the SD-WAN sites check box in Topology Info. Select the SD-WAN mode:
Click the Compare link in the UI to view more information about these modes. |
