# NeDi 1.0.7 configuration file
#============================================================================
# Device Access
#============================================================================

# Set SNMP communities (preferred ones first).
# If authentication protocol is set, it will be treated as v3
#
#	name	aprot	apass		pprot	ppass
comm	public
comm	private
;comm	initial	md5	ver3pa55	des	ver3pa55
;comm	initial	md5	ver3pa55

# Set SNMP policy for write access:
# 3		= requires SNMP v3 for write access
# 2		= also allow SNMP v2 write access
# commented	= disable write access
snmpwrite	2

# Timeout for SNMP and telnet communication. Extra time will be added
# for certain tasks (e.g. building the config).
timeout		2

# If you have difficulties reaching devices, due to your setup or compatibility
# issues, you can map ip addresses [mapip] and telnet ports [maptp].
# If you map the ip to 0.0.0.0, the device will be ignored.
# In case device names or locations cant be set on a device, they may be mapped as well.
;mapip		192.168.1.1	0.0.0.0
;maptp		192.168.2.1	2323
;mapna		192.168.3.1	preferredname
;maplo		192.168.3.1	preferredlocation

# The users for telnet and ssh access:
# - Put most frequent ones first.
# - Leave enablepass empty, if the user is priviledged already.
# - Use a dummy pass (and proper enablepass) if no login is required to connect.
# - Append ;1 ;2 etc. to user, if different pw are used.
# - Nortel CLI capable devices may require to configure cmd-interface cli to avoid menus!
# 	user	pass	enablepass
;usr	nedi	pa55	enpa55
;usr	admin	Enpa55
;usr	edmin	enterasys
;usr	xmin	extreme

# Regexp to match username prompts (useful if you set something else on auth server):
# The cryptic stuff at the end are escape sequences for ProCurve
uselogin	(User|username|login|Login\sName)\s?:\s?(\x1b\[[;\?0-9A-Za-z]+)*$

# Set ssh policy for CLI access:
# always	= only explicitly mapped ports will be used with telnet
# never  	= never try ssh
# known		= only connects when hostkey is known (add with nedi.pl -k, keyscan or manually with ssh)
# commented	= try whatever will work
;usessh		always-known
;usessh		never

# Set policy how poe delivery should be tracked. Comment to ignore it,
# use the discovery protocol or get real value from the interfaces.
# disprot, ifmib
usepoe		disprot

# Use IP address based on order of the following letters per device type,
# or default for all (will only be assigned if pingable and unique):
# e		ethernet
# l		loopback
# v		virtual (vlan)
# n		resolve DNS name
# commented	always use original IP
;useip		default	lev

# Skip IF counters (just like -S) based on the following letters
# per device type, or default for all:
# t		traffic
# e		errors
# d		discard
# b		broadcast
# w		poe (only matters with usepoe=ifmib)
# A		adminstatus
# O		operstatus
# commented	collects all of the above
#
# This complies with older NeDi versions:
;skipif	default	dbO

#============================================================================
# Discovery
#============================================================================

# Only discover devices where ip address matches this regular expression.
# This way NeDi will not send any login credentials to rogue/evil devices.
;netfilter	192.168.0|172.16
# To avoid networks
;netfilter	^(?!192.168.1).*$
netfilter	.

# Regular expression to match discovery protocol description of non-SNMP
# platforms (like lightweight/controlled APs).
nosnmpdev	IP\s(Phone|Telephone)|^ATA|AIR-[CL]AP|MAP-|AP(\s|_)Controlled|armv5tejl/Linux

# Define OUI vendor strings which NeDi should try to discover on MAC based discovery.
# Make sure you do not include CDP devices here, if you are using CDP discovery as well.
ouidev		bay|nortel|netics|xylogics|foundry|XYLAN|Netgear|RUBY

# Do not discover devices containing these strings in the description (e.g. Printers etc.)
;descfilter	LaserJet|JETDIRECT|HP-UX|Linux

# You can specify a pattern to match discovery protocoll IDs, vendors or MAC addresses
# (for oui discovery) where the discovery should stop.
;border		WAN-router

# This value needs to be set to the discovery interval in seconds. Make sure it
# corresponds to the NeDi crontab entry (e.g. hourly 1 * * *  => 3600).
rrdstep		3600

# This value lets you adjust how many samples you want within an RRD. With the default of
# 1000 and hourly discoveries you get 1000h ~ 42 days worth of samples. Those will be aggregated
# by a factor of 10, and stored again in 1000 spots, providing more than a year of long term data.
rrdsize		1000

#============================================================================
# Backend & Libraries
#============================================================================

# Set backend to MSQ for MySQL (others not implemented yet).
backend		MSQ
;backend	PSQ
;backend	ORC

# DB params
dbname		nedi
dbuser		nedi
dbpass		dbpa55
dbhost		localhost

# CLI library to use
clilib		IoPty

# Points to executable (leave empty to disable graphs)
rrdcmd		rrdtool

# Location of NeDi
nedipath	/var/www/nedi

# Prefix to call Cacti CLI tools for adding graphs in Topology-Graph
;cacticli	/usr/bin/php /usr/share/cacti/site/cli

# Cacti integration. Uncomment, if you want Devices-Status to link to Cacti.
# You will need to have the NeDi device names as host (or description) in cacti,
# with that a link can be established.
;cactihost	localhost
;cactidb	cacti
;cactiuser	cacti
;cactipass	cactipa55
;cactiurl	/cacti

# Redirect NeDi events into nagios
;nagpipe	/Data/nagios/rw/nagios.cmd

#============================================================================
# Messaging & Monitoring
#============================================================================

# Generate events during discovery (uppercase also sends mail where shown)
# a/A	IF admin status change
# b/B	Backup new configs, changes & errors
# d/D	Discovery related (D sends mails on loops & new devices)
# e/E	Interface errors (excluding radios)
# f/F	Firstseen nodes
# l/L	Link related (discovery protocol, speed- duplexchange, no traffic and discards > 1s)
# m/M	Module related (includes supplies and stacks)
# n/N	Stolen nodes, flood & ARP tracking
# o/O	IF oper status change
# p	Scanning change in open ports
# s/S	System and environment based events, see thresholds below
# t/T	Traffic	based on traf-alert and traf-warn below
# i/I	New, changed or duplicate IP addresses on devices
# j/J	Changed or duplicate IP addresses on nodes
# w/W	Average PoE exceeding poe-warn
notify		ABdefijLmnopstw

# Time in secondes between monitoring polls. Note its sequencial for now, due to new design.
# Should be threaded soon, but for now use a bigger pause...
pause		180

# Thresholds for monitored values:
# - lost-alert specifies how many checks need to be lost to trigger alert
# - latency-warn in ms for monitoring checks
# - mem-alert if below kBytes/percent free
# - temp-alert in degrees Celsius
# - cpu-alert % usage
# - traffic-alert and traffic-warn in % of speed
# - errors alert when > 1/s or warn when > 1/min)
# - poe-warn relative poe load in %
# - supply-alert relative print supply level in %

check-alert	2
latency-warn	100
cpu-alert	55
mem-alert	1024/20
temp-alert	50
traf-alert	75
traf-warn	50
poe-warn	80
supply-alert	5

# Smtpserver to send notification emails to
smtpserver	sendmail

# Address where notification emails are sent from
mailfrom	info@nedi.ch

#============================================================================
# Nodes Related
#============================================================================

# Read MAC address tables from switches:
# dyn  = Dynamic forwarding on supported devices
# sec  = Read Port Security entries in addition
# snmp = Use SNMP only (will be used as fallback as well)
getfwd		dyn

# A regular expression matching the vlanids which should not be checked for nodes.
# If you are unsure leave the default ^100[0-5]$
ignoredvlans	^10[01][0-9]$

# Ignore special MAC addresses
# HSRP 00-00-0c-07-ac-{HSRP group number (0 to 255)}
# GLBP 00-07-b4-00-01
# VRRP (RFC 2338) 00-00-5e-00-01-{VRID}
# Microsoft WLBS 02bf-{last four octets are IP address}
# Ethernet broadcast ffffffffffff
ignoredmacs	^(0000c07ac|0007b40001|00005e0001|02bf|[f]{12})

# regular expression matching the vlids where independant vlan learning is desired.
# This can be very useful, when the same MAC address appears in different vlans.
# Since MAC and vlanid will be used as primary key, the Router needs to return
# the vlanid in its ARP table or IP resolution will fail!
;useivl		^2[012]0$

# Remove nodes (force IP, DNS and IF update) if inactive longer than this many days
retire		30

# Uncomment and specify path, if you want to use arpwatch for address resolution
# Use wildcard, if you want to use several files (e.g. in case of several vlans/IF)
;arpwatch	/var/arpwatch/arp*

# ARP entries per IP to detect poisoning on routers
arppoison	1

# MACs per interface  threshold to detect switch flooding
macflood	50

#============================================================================
# GUI Settings
#============================================================================

# Define the modules you wish to include in the menu and
# assign groups if you want.
#		Section		Module			Icon	Group
module	Devices		List			dev	net
module	Devices		Modules			cubs	net
module	Devices		Interfaces		port	net
module	Devices		Vlans			vlan	net
module	Devices		Status			sys	net
module	Devices		Config			conf	net
module	Devices		Doctor			cinf	net
module	Devices		Graph			grph	net
module	Devices		Write			wrte	adm
module	Devices		Stock			pkg	net

module	Topology	Routes			rout	net
module	Topology	Multicast		cam	net
module	Topology	Spanningtree		traf	net
module	Topology	Networks		net	net
module	Topology	Locations		home	net
module	Topology	Map			paint	net
module	Topology	Table			icon	net
module	Topology	Links			link	net
module	Topology	Linked			ncon	adm
module	Topology	Loced			ncfg	adm

module	Nodes		List			nods	dsk
module	Nodes		Status			node	dsk
module	Nodes		Toolbox			dril	dsk
module	Nodes		Stolen			step	dsk
module	Nodes		Track			note	dsk
module	Nodes		Create			kons	adm

module	Reports		Combination		chrt	mgr
module	Reports		Devices			ddev	mgr
module	Reports		Modules			dcub	mgr
module	Reports		Interfaces		dif	mgr
module	Reports		Nodes			dnod	mgr
module	Reports		Monitoring		dbin	mgr
#module	Reports		Serials			key	net
module	Reports		Wlan			wlan	mgr

module	Monitoring	Health			hlth	mon
module	Monitoring	Events			bell	mon
module	Monitoring	Timeline		news	mon
module	Monitoring	Incidents		bomb	mon
#module	Monitoring	Master			hat3	mon
module	Monitoring	Setup			bino	adm

module	System		NeDi			radr	adm
module	System		Files			file	adm
# System-Export allows creating queries, which can circumvent currently used sanitization.
# Therefore the default is changed back to admin!
module	System		Export			flop	adm
module	System		Services		cog	adm
module	System		Snapshot		foto	adm

module	User		Accounts		ugrp	adm
#module	User		Guests			walk	dsk WIP
module	User		Profile			user
module	User		Chat			say
module	User		Logout			exit

module	Other		Noodle			find	oth
module	Other		Defgen			geom	net
module	Other		Calculator		calc	net
#module	Other		Plot			3d	oth
module	Other		Info			php	oth
#module	Other		Flower			fan	oth
module	Other		Invoice			cash	oth
#module	Other		Nagios			cinf	oth

# Authentication for GUI users can be set to MySQL or by PAM
# local, none, pam, radius, ldap or sso
# Append -pass to use GUI user for device access (e.g. in Devices-Write)
guiauth		local

# Set Radiusserver(s) parameters, if selected above
#		host		port	secret		timeout	retries
;radserver	localhost	1812	testing123	2	1

# Set Ldapserver parameters, if selected above:
#		host			port	rootpw		basedn		rootdn	loginattr
;ldapsrv	ldaps://host.domain	636	PASSWORD	DC=XX,DC=YYY	USER	uid

# Map attributes, if desired
#		adm	net	dsk	mon	mgr	oth	mail	phone
;ldapmap	cisco	cisco	cisco	support	manager	users	mail	telephoneNumber

# Disclaimer or what ever you want people to see upon login. The default is my statement to every NeDi user:
disclaimer	NeDi has not caused any damage yet! I will not take any responsibility, if you mess up your network with NeDi!

# Adds a footer to mails sent by NeDi
mailfooter	Visit http://www.nedi.ch NeDi for more information\n\nKind regards & lots of fun\n-Remo\n

# SNMP locations need to be formatted like this now:
# Region;City;Building;Floor;Room;Row (A-Z);Rack#;Height (e.g. 40-41)
# This separator defaults to a space if commented
locsep		;

# Pattern to match for buildings to be marked red (e.g. HQ|Main).
redbuild	HQ|Main
