ubiqube poc test plandepot.ubiqube.com/docsinterwiki/ubiqube_poc_test_plan.pdf · ubiqube poc test...

UBIqube POC Test Plan

1 / 37


Customer Name :

Release :

November 09


2 / 37

Contents

UBIqube POC Test Plan ................................................................................. 1

Customer Name : ................................................................................... 1

Release : ........................................................................................... 1

1. Introduction ........................................................................................ 4

1.1. Objective ...................................................................................... 4

1.2. Scope ........................................................................................... 4

2. Test Setups......................................................................................... 5

2.1. Test bed ....................................................................................... 5

2.2. Hardware/ Firmware ....................................................................... 5

2.3. Test Tools ..................................................................................... 5

3. Executive Summary ............................................................................. 6

3.1. Summary of Test Result .................................................................. 6

3.2. Installation and Accounts Creation ................................................... 6

3.3. Managed Router Services ................................................................ 6

3.4. Firewall Service Profile .................................................................... 6

3.5. IPsec VPN Service Profile ................................................................. 7

3.5.1. Site to Site VPN ........................................................................ 7

3.5.2. Remote access VPN .................................................................. 7

3.6. IPS Service Profile .......................................................................... 7

3.7. Content Filtering Service Profile ....................................................... 8

3.8. VoIP Service Profile ........................................................................ 8

3.9. Monitoring Service Profile ................................................................ 9

3.10. Vulnerability Assessment Service Profile ............................................ 9

4. Product Test Results .......................................................................... 10

4.1. Problem Report ............................................................................ 10

5. Detailed Test Cases............................................................................ 11

5.1. Installation and Contexts Creation .................................................. 11

5.2. Managed Router Services .............................................................. 13

5.3. Firewall Service Profile .................................................................. 17

5.4. IPsec VPN Service Profile ............................................................... 19

5.4.1. Site to site VPN ......................................................................... 19

5.4.1. Remote access VPN ................................................................... 21


3 / 37

5.5. IPS Service Profile ........................................................................ 24

5.6. Content Filtering Service Profile ..................................................... 25

5.7. VoIP Service Profile ...................................................................... 28

5.8. Monitoring Service Profile .............................................................. 35

5.9. Vulnerability Assessment Service Profile .......................................... 37


4 / 37

1. Introduction

This document is the detailed POC test Report for UBIqube Service Delivery Platform. It

defines the scope, approach, resources, schedule, risks/mitigations, and entry/exit criteria

for testing.

1.1. Objective

The principle objective of the POC test Report is to provide UBIqube customers and

partners with an approved, consistent, and comprehensive verification methodology for

delivering managed services based on the UBIqube Service Profile Library (SPL).

1.2. Scope

This document provides the test strategy and test case procedures to validate the delivery

of managed services using the UBIqube MSActivator Software. This will help customer and

partners understanding the profile based approach and the Service Profile Library

paradigm.

This test determines whether the product performs as required and inter-operates on a

pass/fail basis. The test suite therefore emphasizes customer’s needs allowing UBIqube to

enhance the Service Profile Library (SPL) accordingly.


5 / 37

2. Test Setups

2.1. Test bed

Please paste here a drawing of you test bed network.

2.2. Hardware/ Firmware

Component Hardware Firmware

Eg : Cisco router Cisco C871 12.4(11)T

2.3. Test Tools

Component Vendor Version

Eg : Sniffer Wireshark 0.99.5


6 / 37

3. Executive Summary

3.1. Summary of Test Result

The results of the summary are taken from the Test Cases section. The purpose of this is for Partner Program Team to review without the need of going into the full detail of the report. � = Pass x = Fail �* = See Defect Tracking Information/Problem Reporting and Severity Levels section. N/A = If any section is not applicable to your product please state N/A.

3.2. Installation and Accounts Creation

Tested Test ID Item

INST01 Connect to your VSOC context with your privilege manager

credentials.

INST02 Create a customer.

INST03 Create a manager account

INST04 Add the customer to the manager.

INST05 Create a delegation profile to restrict the access to only Firewall

management.

INST06 Select the customer to access the customer home page.

3.3. Managed Router Services

Tested Test ID Item

MRS01 Create a managed device accordingly to the starter guide. Note:

enter the device location and enable all the monitoring services.

MRS02 Stage the device with the console port.

MRS03 Perform initial provisioning.

MRS04 Check monitoring information: device status, default KPIs

(availability, CPU load, etc.).

MRS05 Check weekly security event reports (log collection and analysis,

gold monitoring service).

MRS06 Check the asset information (collected automatically at least once

per day)

MRS07 Check the running configuration on the GUI.

3.4. Firewall Service Profile

Tested Test ID Item


7 / 37

FW01 Create a firewall profile. Soho use case (2 interfaces template from

the Service Profile Library).

FW02 Check the status of update.

FW03 Modify your profile to redirect the mail (SMTP) traffic to an internal

mail server.

FW04 Modify your profile to allow TCP port 546 traffic from the LAN zone.

FW05 Check the security event reports for firewall events.

FW06 Check the detailed reports.

3.5. IPsec VPN Service Profile

3.5.1. Site to Site VPN

Tested Test ID Item

VPN01 (If needed) create and deploy another managed device

VPN02 Create a local VPN

VPN03 Check the update of each site attached to the VPN

VPN04 Launch a VPN Status from the VPN home page, and check the

result

VPN05 Launch a connection status from one of the device attached to the

VPN, and check the result

VPN06 (optional) Check the running configuration of one of the site

attached to the VPN

3.5.2. Remote access VPN

Tested Test ID Item

RAVPN01 Modify one of the existing managed device to support VPN Client

RAVPN02 Create in one click the VPN Client sites and the associate Remote

access VPN

RAVPN03 Check the VPN Creation and the VPN Client sites creation

RAVPN04 (optional) deploy the VPN Client site on a remote computer

RAVPN05 (optional) test the VPN Client connection to the LAN of the

managed router through the VPN tunnel

3.6. IPS Service Profile

Tested Test ID Item

IPS01 Create an IPS profile.

IPS02 Check the status of update. And check the asset information.

IPS03 Modify your profile to activate the client pack.

IPS04 Check the activated signatures by downloading the running

configuration on the GUI


8 / 37

3.7. Content Filtering Service Profile

Tested Test ID Item

CF01 Create a Content Filtering profile. Activate the Antivirus option and

attach devices(s) to this profile

CF02 Check the update of the devices (s) attached to the profile

CF03 Modify the already existing Content Filtering profile and activate

the Anti-spam option


CF05 Modify the already existing Content Filtering profile and activate

URL filtering option

CF06 Activate the category filtering, and modify the default category

according the your device type


3.8. VoIP Service Profile

Tested Test ID Item

VOIP01 Create a “voice enabled” device; specify separate voice and data

vlans

VOIP02 Create a voip profile; attach the voice enabled device; save the

profile as is, i.e. with no further configuration

VOIP03 Check the effect on the conf using menu entry ‘get the running

conf’

VOIP04 Edit the voip profile to add 5 phones and 4 call numbers; create a

shared line

VOIP05 Save the profile; Connect the phones; Check that you can place

calls between phones

VOIP06 Edit the voip profile to add a Hunt group with e.g. 3 members

VOIP07 Edit the voip profile to define a site prefix dial plan

VOIP08 Edit the voip profile to configure and inbound/outbound PSTN

connection

VOIP09 Check that the hunt group works; check that you can place

incoming / outgoing PSTN calls

VOIP10 Update the “voice enabled” device to specify that it has a CUE

VOIP11 Edit the voip profile to define voice mail accounts

VOIP12 Check that you can reach the voice mail from all phones

VOIP13 Leave a voice-mail message on one of the defined voice-mail

accounts

VOIP14 Check that the message-waiting indicator works on relevant phone


9 / 37

3.9. Monitoring Service Profile

Tested Test ID Item

MON01 Create a monitoring profile to monitor the packet loss by polling

the following counters :

ipInDiscards 1.3.6.1.2.1.4.8.0

ipOutDiscards 1.3.6.1.2.1.4.11.0

MON02 Check the graphs on device home pages.

MON03 Modify the profile to raise thresholds alerts if the loss is higher

than 10 packets.

MON04 Export the profile in XML.

MON05 Import a profile from an XML file.

3.10. Vulnerability Assessment Service Profile

Tested Test ID Item

VUL01 Create a Scan profile; schedule the scan for today, 10 minutes

ahead of now. Attach an existing and live device to the profile.

VUL02 Check that Scan reports are generated – a scan takes 5 to 20

minutes


10 / 37

4. Product Test Results

Product Test Result S0 S1 S2 S3

Date

Installation and Accounts Creation

Managed Router Services

IPsec VPN Service Profile

Firewall Service Profile

IPS Service Profile

Content Filtering Service Profile

VoIP Service Profile

Monitoring Service Profile

Vulnerability Assessment Service Profile

4.1. Problem Report

The following table highlights all problems discovered and their date resolved, if any.

Related

Test Case

Problem

Description

Date Found

Resolution

Description

Date Resolved

Severity /

Priority

Origin of

Issue


11 / 37

5. Detailed Test Cases

This section details the tests that will be performed during the testing period.

5.1. Installation and Contexts Creation

Test Case Details

Title INST01 - Connect to your VSOC context with your privilege manager

credentials.

Description Use your browser to connect to the VSOC web portal and log in using your

credentials.

Test Setup Have your privilege manager credentials and IP connectivity to the

MSActivator. Note to access the graphical monitoring console too, you

must use a FQDN. Eg : https://smartsoc.ubiqube.net.

Procedure Get you privilege manager credentials

Launch you web browser and enter the MSActivator URL.

On the login page enter your login and password.

Expected

Results

You should see the privilege manager home page.

Observation (PASS or FAIL)

Test Case Details

Title INST02 - Create a customer.

Description Create a customer environment which will contain devices and profiles.

Test Setup Be connected as a privilege manager.

Procedure On the privilege manager home page select the management menu.

Select create a customer.

Enter the name of the company.

Enter the name of the contact and his email.

Click Next.

Click Confirm.

Expected

Results

You should see the customer credentials :

Login

Password

Customer identifier

Observation

Test Case Details

Title INST03 - Create a manager account

Description Delegate the administration by creating a manager account.



Select create a manager.

Enter the name of the manager.


12 / 37

Do not check the “manage all customers” checkbox.

Click Validate.

Make a note of the login and password for this manager

Expected

Results

You should see the manager credentials :

Login

Password

Manager identifier

Observation

Test Case Details

Title INST04 - Add the customer to the manager.

Description Control the number of customer that a manager can see and manage.


Procedure On the privilege manager home page select the manager tab.

Select the manager to access the manager home page.

On the manager home page select the management menu.

Select attach customers.

Attach the customer to the manager.

Click finish.

Expected

Results

You should see the newly attached customer on the manager home page.

Observation

Test Case Details

Title INST05 - Create a delegation profile to restrict the access to only Firewall

management

Description Delegation profile provides Role Based Access Control features. You can

restrict the management rights per manager.



Select create delegation.

Enter a name for your delegation profile.

Select only the firewall related functions under the profiles frame.

Click Validate.

Attach the manager account to the profile.

Click Next

On the privilege manager home page, select the delegation tab.

Look for your delegation profile, click the '+' icon.

Expected

Results

You should have a delegation profile and a manage attached to it.

Observation

Test Case Details

Title INST06 - Select the customer to access the customer home page.

Description Deep dive to the customer environment.

Test Setup Be connected as a privilege manager or manager.


13 / 37

Procedure On the privilege manager or manager home page select the customer.

Expected

Results

You should see the customer home page.

Observation

5.2. Managed Router Services

Test Case Details

Title MRS01 - Create a managed device accordingly to the starter guide. Note:

enter the device location and enable all the monitoring services.

Description Create a device on the GUI. You can follow the starter guide that illustrates

the device creation, staging and provisioning processes of a Cisco ISR

router.

Test Setup Be connected as a manager.

Select the customer to access the customer home page.

Procedure On the customer home page select the management menu.

Select Create a managed device.

Enter information about the site, a Name, address, zip, country and any

remarks. Then add administrator information, name, address, email and

phone (last name, email or phone is required).

Click Next.

Next select the equipment type, manufacturer and model (eg Cisco IOS

security).

Enter the username and password, as well as enable password for the

router.

Select 'NAT enabled' if NAT should be applied to the device, as well as the

connectivity type: Ethernet-ADSL, Ethernet-Ethernet, Ethernet-ISDN Next

select logging types for the subscriber: Silver and/or Gold Monitoring,

Email Alerts, Detailed Reports.

Advanced configuration can be added, specific rules or commands can be

added. VPN client support can also be enabled using the Advanced

configuration options. If VPN client support is added, information gathered

such as Xauth, IP address pool, certificate information, DNS and WINS

servers.

Click Next.

Interface configuration is next; configure both the internal and external IP

addresses, as well as gateway ip address. External configuration allows for

a static IP on the router, DHCP addressing for the router, and also a

'behind NAT' configuration, in case the device is not directly configured

with a public IP address, but is behind a device with a static translation to

the router.

Advanced configuration at this stage includes Enabling DHCP on the router,

sub-networks available via VPN, WAN backup configuration and any static

routes required on the router.

Click Next.

Summary information is now displayed based on information given. A


14 / 37

check is run against the device to verify if it is ready for deployment. The

following items are checked:

• Equipment class

• Internal IP address

• External IP address

• External gateway

• Number of static routes

• Number of sub-networks accessible via VPN

• Sub-network accessible via VPN

If there are any issues with any of the items, a warning will be listed with

a brief description of the problem. Otherwise an 'OK' is shown for each

item.

If everything is ok, you can click confirm to finalize the settings.

A final summary is shown that can be printed or you can now continue to

site administration.

Expected

Results

You should have the Device identifier and be able to access the device

home page.


Test Case Details

Title MRS02 - Stage the device with the console port.

Description At site administration, you can select 'Staging' which will give a base

configuration to apply to the device so it can be provisioned. If there is an

existing configuration, it is erased to avoid conflicts, then the staging

configuration can be applied. Test Setup Connect to the console port of the device.

On the Web portal, be connected as a manager.


Select the device tab.

Select the device

Procedure On the device home page select the General menu.

Select Staging.

Erase the existing configuration of the device.

Copy paste the minimum set of command from the VSOC console to the

router console.

Expected

Results

The device identifier is configured as the hostname of the device. You

should see it on the prompt of the device.

Observation

Test Case Details

Title MRS03 - Perform initial provisioning.

Description The configuration of the device and its own certificate are pushed remotely

by the MSActivator during the initial provisioning process.

Test Setup The staged device must be reachable from the MSActivator.

Be connected as a manager.




15 / 37

Select the device

Procedure On the device home page select the General menu.

Select Initial Provisioning.

Click Confirm.

The following is then displayed as provisioning is in progress:

Initial provisioning in progress :

• Initial Connection

• Network Configuration

• Security Policies Configuration

• Certificates Generation

• DNS Update

• Database Update

Each item in the preceding list is completed, once all are done initial

provisioning is complete. Expected

Results

After completing the site creation and initial provisioning, the router should

be in service and functional with the basic configuration. Additional options

will be covered later in testing.

Observation

Test Case Details

Title MRS04 - Check monitoring information: device status, default KPIs

(availability, CPU load, etc.).

Description Devices, with the silver monitoring option enabled, are polled

automatically every minute. The MSActivator uses SNMP to collect default

health and performances statistics.




Select a provisioned device.

Device must have be up and running for a sufficient amount of time in

order to have enough data.

Procedure On the device home page select the status tab.

Check the ping status.

Check the last updates status.

Select the day period.

Select the availability, traffic, uptime, CPU and RRT/TTL metrics.

Expected

Results

You should see charts and information of the device status.

Observation

Test Case Details

Title MRS05 - Check weekly security event reports (log collection and analysis,

gold monitoring service).

Description The MSActivator collects all the events of the managed devices with the

gold monitoring option enabled. It classifies them and compute dashboard

and security reports.




16 / 37


Select the device.

Procedure On the device home page select the Supervision menu.

Select Weekly Security Events.

Expected

Results

You should see the weekly log summary page where you can filter the

aggregated events per type and level.

Observation

Test Case Details

Title MRS06 - Check the asset information (collected automatically at least once

per day)

Description The MSActivator automatically gather the asset management information

from the devices. It offers up to date hardware, software and licenses

inventories.




Select the device.

Procedure On the device home page select the Asset tab.

Check the hardware inventory.

Check the firmware inventory and license management.

On the device home page select the Asset Management menu.

Check the history of the inventories.

Go back to the customer home page.

Check the assets of all the managed devices on the Asset tab.

Expected

Results

You should see the detailed asset information of the customer’s managed

devices.

Observation

Test Case Details

Title MRS07 - Check the running configuration on the GUI.

Description In addition to the daily archiving of the device configuration, the actual

running configuration can be downloaded from the device and displayed on

the GUI.




Select the device (it must be up and running).

Procedure Select the Supervision menu.

Select Get the Running Configuration.

Expected

Results

You should see the actual running configuration of the device.

Observation


17 / 37

5.3. Firewall Service Profile

Test Case Details

Title FW01 - Create a firewall profile. Soho use case (2 interfaces template from

the Service Profile Library).

Description The creation of a firewall rule set and then applied to the test devices. This

use case will demonstrate the restriction of the outgoing traffic to WEB

traffic only.

Test Setup On the Web portal, be connected as a manager.


Procedure Select the Management menu.

Select Create a Firewall profile.

Name the profile and determine the type of profile to create:

• 2 interfaces

• 2 interfaces, 1 private DMZ

• 2 interfaces, 1 public DMZ

In this test, 2 interfaces is selected.

Click Next.

Select the Outgoing Rules tab.

Permit Web traffic only by selecting HTTP and DNS under Customized

protocols and rules.

Once done with configuration, click Finish and then Confirm.

Finally you can select the devices to apply the firewall rule set to.

Each device may have only one Firewall rule set applied to it.

Click Confirm and the firewall rule set is then applied to all devices

included.

Expected

Results

After creating and applying the profiles, the router configuration should be

updated with the appropriate configuration for Firewall.


Test Case Details

Title FW02 - Check the status of update.

Description The verification of the automatic update process.



Select the Firewall tab

Select the profile.

Procedure On the firewall profile home page select the Status of updates tab.

This tab is automatically refreshed every 30 seconds.

Check the results.

Modify the firewall profile to trigger an update (see next test case).

Expected

Results

You should see that all the devices attached to the profile are updated

automatically by the MSActivator. You can also check the running

configuration (cf managed router services use case).

Observation


18 / 37

Test Case Details

Title FW03 - Modify your profile to redirect the mail (SMTP) traffic to an internal

mail server.

Description Use of firewall profile to set redirect (NAT) rules. Redirect rules applied can

be done using PAT for individual port redirection or full one to one

translations using NAT.




Select the profile.

Procedure On the firewall profile home page select the Management menu

Select Edit Firewall rules

Select the Redirect rules tab

Add a rule to redirect SMTP (TCP port 25) traffic from the WAN zone to one

IP address on the LAN zone.


The firewall rule set is then applied to all devices included.

Expected

Results

You should see (status of update tab) that all the devices attached to the

profile are updated automatically by the MSActivator.

Observation

Test Case Details

Title FW04 - Modify your profile to allow TCP port 546 traffic from the LAN zone.

Description Use of firewall profile to modify rules.




Select the profile.

Procedure On the firewall profile home page select the Management menu

Select Edit Firewall rules

Select the Outgoing rules tab

Add a custom rule to allow TCP port 546 traffic from the LAN zone to the

WAN zone.


The firewall rule set is then applied to all devices included.

Expected

Results


profile are updated automatically by the MSActivator.


Test Case Details

Title FW05 - Check the security event reports for firewall events.

Description View the firewall event management dashboards and associated event

reports.



Devices must have be up and running for a sufficient amount of time in



19 / 37

Procedure On the customer home page check the Firewall history graph (number of

firewall events received from the customer devices).

Check the top 5 for firewall event (devices that sent the most number of

firewall event or most common event per week or per month).

On the top5 of the week per device select the 1st one to access its event

summary report.

Expected

Results

You should see the dashboards and the event summary report.

Observation

Test Case Details

Title FW06 - Check the detailed reports.

Description View the detailed security report of the device.



Devices must have be up and running for more than 24h in order to have

enough data and detailed reports.

Devices must have the "Detailed reports" monitoring option activated (see

e.g. MRS01).

Procedure Select the device tab.

Select the device.

On the device home page select the Supervision menu.

Select Detailed Reports.

Download the detailed daily report in PDF.

Navigate into the report.

Expected

Results

You should have a PDF file detailing the firewall activity of the managed

device.

Observation

5.4. IPsec VPN Service Profile

5.4.1. Site to site VPN

Test Case Details

Title VPN01 - (If needed) create and deploy another managed device.

Description To be able to test a real VPN tunnel, You need 2 devices deployed in the

UBIqube MSActivator.



Procedure Refer to “Managed Router Services” test case to deployed a new device

Expected

Results

You should have 2 different devices created and deployed on the UBIqube

MSActivator



20 / 37

Test Case Details

Title VPN02 - Create a local VPN

Description Site to site VPN creation between 2 devices of the same customer.



2 devices should have been created in the UBIqube MSActivator.

Procedure On the customer home page, click on “create a local VPN” in the

management menu.

Fill the “name”, enter “Site to site VPN” for example.

(optional) fill the description.

Select the 2 previous created devices from the left box and click on the “-

>” button, the 2 devices should appears in the right box.

Click on “Meshed” option.

Click on “Next”.

Check if there is any warning or error on the confirm page.

Click on “Confirm”.

Expected

Results

In a few click you have create a site to site VPN between 2 already

deployed devices, and the SOC would automatically update the devices

configuration according to this settings.

Observation

Test Case Details

Title VPN03 - Check the update of each devices attached to the VPN

Description On the VPN home page, there is a special tab that displays the last

updates of all the devices attached to the VPN.

Test Setup You should have created the VPN in the previous step.

Procedure Once you have created the VPN, click on the “status of updates” tab on the

home page of the VPN.

Expected

Results

You should see that all the devices attached to the VPN are updated

automatically by the SOC to reflect the VPN creation done in the previous

step.

This tab is automatically refreshed every 30 seconds, so that you can

eventually see an ongoing update.

Observation

Test Case Details

Title VPN04 - Launch a VPN Status from the VPN home page, and check the

result

Description The SOC have a special tool to test in real time all the VPN tunnels of a

VPN.

Test Setup The VPN should have been created in the previous step, and the device

attached to the VPN should be up and running.

Procedure In the VPN home page, click on the “Get VPN status” from the monitoring

menu.

Wait a couple of minutes while the SOC checks, on each device, the VPN

tunnel availability.


21 / 37

Expected

Results

The vSOC should display a tab with all the devices attached to the VPN,

and for each couple, the SOC try to setup and test (via ping and ICMP

protocol) the availability of each tunnel in both directions.

After a couple of minutes, you should have for each one-way VPN tunnel

an icon that gives you its status: green the tunnel is up.

Observation

Test Case Details

Title VPN05 - Launch a connection status from one of the device attached to the

VPN, and check the result

Description The same “VPN status” tool is available from the device home page. You

can check in one click all the VPN tunnels configured on that device.

Test Setup The VPN should have been created in the previous step, and the device

attached to the VPN should be up and running.

Procedure Go to the home page of one device of the VPN, by clicking on the UBIqube

device’s id in the information tab of the VPN home page

Click on the “Connection status” in the “supervision” menu

Wait a couple of minutes while the MSActivator checks, on the device, the

VPN tunnels availability

Expected

Results

The vSOC should display a tab with all the devices reachable through a

VPN tunnel from the selected device.

The MSActivator tries to setup and test (via ping and ICMP protocol) the

availability of each tunnel.

After a couple of minutes, you should have for each one-way VPN tunnel

an icon that gives you its status: green the tunnel is up.

Observation

Test Case Details

Title VPN06 - (optional) Check the running configuration of one of the site

attached to the VPN

Description It could be interesting to compare the running configuration that you get

previously in the “Managed Router Services” use case, with the actual

one when the VPN tunnels have been setting up.

Test Setup The selected device should be up and running

Procedure Click on “Get the running configuration” in the supervision menu on the

device home page.

Expected

Results

The MSActivator retrieves and displays the actual running configuration of

the device.

Observation

5.4.1. Remote access VPN

Test Case Details

Title RAVPN01 - Modify one of the exiting managed device to support VPN Client


22 / 37

Description For setting up a remote access VPN, you should first configure a managed

devices as a VPN concentrator for VPN clients..

Test Setup A managed device should have been created trough the previous use

cases. If not, please refer to “Managed Router Services” test case to

deploy a new device.

On the Web portal, be connected as a manager.


Select the device to access the device home page.

Procedure On the device home page, click on “device information” in the “General”

menu.

Click “Edit information”.

Click “Next”.

Click “Advanced configuration” .

In the “Enter information about VPN client support” part, check the

“Enable VPN client” option.

Select the “clients model”.

Fill the required red fields.

Click “Finish”.

Expected

Results

The device is automatically configured to support VPN client connection,

now you can continue by creating the Remote access VPN

Observation

Test Case Details

Title RAVPN02 - Create in one click the VPN Client sites and the associate

Remote access VPN

Description We are going to use the vSOC wizard that is able to create automatically a

remote access VPN profile and the attached VPN client sites.

Test Setup The previous step should have been completed correctly

Procedure Click on ‘attached profiles” in the “General” menu from the device’s home

page.

Click on “Create VPN client devices and the associated VPN”. If this button

didn’t appear please check if you have correctly completed the previous

step.

Enter the number of VPN clients you want to create (4 for example) in the

“Number of VPN client devices to create” field

Enter a prefix for the VPN client site name that will be created in the “User

login prefix” field. Enter “remote access-” for example.

Click “Next”.

Check that you have entered the correct data and click “validate”.

Expected

Results

The vSOC console displays the wizard results, showing the VPN profile

created, named by concatenate device name with client VPN prefix and “-

GENERATED-VPN” string.

The vSOC console prints also the VPN client sites generated with the

corresponding login and password of the VPN client sites.

Observation

Test Case Details


23 / 37

Title RAVPN03 - Check the VPN Creation and the VPN Client sites creation

Description You are going to check the VPN created by the wizard and the VPN client

sites that have been created too.

Test Setup The previous step should have been completed correctly

Procedure On the wizard result page click on the "manage” link associated to the

generated VPN profile.

Your are redirected to the VPN profile home page.

Expected

Results

You can verify that the VPN profile has been correctly created, with a

“star” topology and the managed device is the star center. The VPN client

sites are attached to the VPN profile.

Observation

Test Case Details

Title RAVPN04 - (optional) deploy the VPN Client site on a remote computer

Description Follow the UBIqube deployment guide of your VPN client type

Test Setup You should have a dedicated computer on which you are going to install

and configure the VPN client software. This computer should have access

to the MSActivator to be able to retrieve its configuration and enroll its

digital certificate.

Procedure Follow the UBIqube deployment guide of your VPN client software

Expected

Results

The VPN client software should have been install and configure with the

existing VPN tunnels.

A digital certificate is installed on the computer.

Observation

Test Case Details

Title RAVPN05 - (optional) test the VPN Client connection to the LAN of the

managed router through the VPN tunnel

Description Set up the VPN tunnel between your VPN client and the VPN concentrator.

Test Setup The VPN device created and deployed in the previous steps is up and

running.

The computer, on which you have installed the VPN client software from

the previous steps, should have its own network access independent from

the WAN network of the device.

Procedure Connect you VPN client (check the vendor VPN client guide).

Generate ICMP traffic from your test computer. You can for example try

first to “ping” the LAN IP address of the VPN device.

(Optional) if you have deployed another host on the LAN of the VPN

device, you can try to “ping” it too.

Expected

Results

After some seconds during which the VPN tunnel is setting up, you should

get ICMP echo reply from the LAN IP address of the VPN device and from

the IP address of the Host IP deployed on the LAN of the VPN device.

Observation


24 / 37

5.5. IPS Service Profile

Test Case Details

Title IPS01 - Create an IPS profile

Description The creation of an IPS rule set and then applied to the test devices.



Cisco ISR routers must run at least the 12.4(11)T version of the IOS.

Make sure the selected device has Gold Monitoring activated (see e.g.

MSR01)


Select Create an IDS/IPS profile.

Name the profile.

Activate the IPS features on the LAN and WAN zones.

Keep the default pack.

Once done with configuration, click Finish.

Finally you can select the devices to apply the firewall rule set to.

Each device may have only one IPS rule set applied to it.

Click Confirm and the IPS rule set is then applied to all devices included.

Expected

Results

After creating and applying the profiles, the router configuration should be

updated with the appropriate configuration for IPS.


Test Case Details

Title IPS02 - Check the status of update. And check the asset information.

Description The verification of the automatic update process.



Select the IPS tab

Select the profile.

Procedure On the IPS profile home page select the Status of updates tab.

This tab is automatically refreshed every 30 seconds.

Check the results.

Modify the IPS profile to trigger an update (see next test case).

Select the device.

On the device home page select the Asset tab.

Check the IPS license information.

Expected

Results

You should see that all the devices attached to the profile are updated

automatically by the MSActivator. You can also check the running

configuration (cf managed router services use case).

Observation

Test Case Details

Title IPS03 - Modify your profile to activate the client pack.

Description Use of the IPS profile to activate a new pack of signatures.



25 / 37


Select the IPS tab.

Select the profile.

Procedure On the IPS profile home page select the Management menu.

Select Edit IPS rules.

Select the client pack.

Once done with configuration, click Finish

Expected

Results


profile are updated automatically by the MSActivator

Observation

Test Case Details

Title IPS04 - Check the activated signatures by downloading the running

configuration on the GUI

Description View the activated signatures on a Cisco ISR router listed at the end of the

Get running configuration page.




Select the device (it must be up and running).

Procedure Select the Supervision menu.

Select Get the Running Configuration.

Expected

Results

You should see after the actual running configuration of the device, the list

of the IPS signatures handled by the device and their sattus.

Observation

5.6. Content Filtering Service Profile

Test Case Details

Title CF01 - Create a Content Filtering profile. Activate the Antivirus option and

attach devices(s) to this profile

Description You are going to create a content filtering profile with only the antivirus

option activated and apply it to your device

Test Setup You should have created a device that is declared to be able to support

content filtering feature (Cisco ASA with CSC module, Fortinet Fortigate or

Juniper SSG).

Procedure Click on “create a filtering profile” on the management menu of the

customer home page.

Enter a name for your profile in the “Security profile name” field. “myCTF

profile” for example.

(optional) enter a comment in the “Profile Comment” field

Click on “activated” option in the “Antivirus” tab

Select the “Type of antivirus” you want to activate. Let’s take “high” for

example.


26 / 37

Click “finish”.

Select your device on the left box, click on “->” button, your device should

appear in the right box.

Click “Confirm”

Expected

Results

You have created a content filtering profile and have attached at least on

device to this profile. Devices are updates automatically.


Test Case Details

Title CF02 - Check the update of the device(s) attached to the profile

Description On the content filtering profile home page, there is a special tab that

displays the last or running updates of the all devices attached to the

profile.

Test Setup You should have created the content filtering profile in the previous step.

Procedure Once you have created the content filtering profile, click on the “status of

updates” tab on the home page of the content filtering profile.

Expected

Results

You should see that all the devices attached to the profile have been, are

or would be updated automatically by the SOC to reflect the profile

creation done in the previous step.


eventually see the update running.

Observation

Test Case Details

Title CF03 - Modify the already existing Content Filtering profile and activate the

Anti-spam option

Description You are going to modify the existing content filtering profile to add

antispam features.


The device attached to the profile should declare as be able to support

anti-spam features.

Procedure Select “Edit content filtering rules” in the “management” menu.

Select the “Antispam” tab and click on “activated” option.

Select the “Detection level” you want to activate. “high” for example.

(optional) Modify the “notification message” to adapt it for your needs.

(optional) you can declare as spam some specific IP addresses, email or

domain name by adding them in the “Forbidden Addresses” box (black list)

(optional) you can declare some specific IP addresses, email or domain

name as sure by adding them in the “Forbidden Addresses” box (white list)

Click “finish”

Expected

Results

You have updated the existing content filtering profile with antispam

features and see what you can tune through the vSOC console on such

service.

Observation

Test Case Details


27 / 37




profile.




Expected

Results






Observation

Test Case Details

Title CF05 - Modify the already existing Content Filtering profile and activate

URL filtering option

Description You are going to modify the existing content filtering profile to add URL

filtring features


The device attached to the profile should declare as be able to support URL

filtering features.

Procedure Select “Edit content filtering rules” in the “management” menu

Select the “URL filtering” tab and click on “activated” option

(optional) you can block some specific URL by adding them in the

“Forbidden URL” box (black list)

Click on “finish” button

Expected

Results

You have completed the existing content filtering profile with URL filtering

features and see what you can tune through the vSOC console on such

service.

Observation

Test Case Details

Title CF06 - Activate the category filtering, and modify the default categories

according the your device type

Description You are going to modify default URL category to adapt them to your needs


The device attached to the profile should declare as be able to support URL

filtering features.

Procedure Select “Edit content filtering rules” in the “management” menu

Select the “URL filtering” tab.

Change the “Categories” option to activated.

Select the type of the device on which you want to tune the categories.

Select and deselect some categories to modify the profile’s behavior.

Click “finish”

Expected

Results

You have modified the existing content filtering profile with URL filtering

features by modifying the categories that would be filtered by the device


28 / 37

Observation

Test Case Details




profile.




Expected

Results






Observation

5.7. VoIP Service Profile

Test Case Details

Title VOIP01 - Create a “voice enabled” device

Description Create a “voice enabled” device with separate voice and data vlans

Test Setup

Procedure 1.) Create a Managed device using menu “Management > Create managed device”

2.) Fill in the required information (screen 1), click next 3.) Select a device type and model (screen 2), e.g.

manufacturer=Cisco, Model=IOS Security

4.) Enter information about the equipment (username, password, enable password), check that Connectivity is correct (Ethernet-

Ethernet)

5.) Tick the “VoIP activated” checkbox, click next 6.) Specify the DATA vlan in section ‘internal network’, use e.g. vlan

id=1 (native vlan). Note: interface name must be a sub-interface

specification, field should read e.g. “FastEthernet 0/0.1”

7.) Specify the WAN parameters in section ‘External network’ 8.) Click “Advanced configuration”, click “Add” in “Additional interface” 9.) Select “VoIP” from the “Interface type” dropdown. Specify the

VOICE vlan parameters. Use e.g. vlan 94 (tagged voice vlan)

10.) Click “Next” at the bottom of the page

11.) Check that all listed checks are green, Click “Confirm”.

12.) Click button “Back” at bottom of page

13.) Select tab “Devices” to show the devices list

14.) Select “on” from the “VoIP” filter dropdown (far right)

Expected 1.) Device is successfully created in the system


29 / 37

Results 2.) Device is listed with correct assets in the devices list


Test Case Details

Title VOIP02 - Create a ‘blank’ voip profile for one device

Description Create a default, blank voip profile and attach a voice enabled device with

no further configuration

Test Setup

Procedure 1.) Create a VoIP profile using menu “Management > Create a VoIP profile”

2.) Provide a name for the profile 3.) Tick a device from the left pane, section “Managed UC” 4.) Click the left arrow between the two panes 5.) Click “Save profile” 6.) Select tab “VoIP” 7.) Click the ‘+’ icon next to the profile you just created 8.) Click the Device ID 9.) Select tab ‘Equipment’ to see entry ‘VoIP Profile’

Expected

Results

1.) The profile is created in the system 2.) The profile is attached to the device


Test Case Details

Title VOIP03 - Inspect ‘blank’ voip configuration on device

Description Check the effect of attaching a ‘blank’ voip profile to a voip-device using

menu entry ‘get the running conf’

Test Setup 1.) Tests VOIP-01 and VOIP-02 completed 2.) Device is online and console access is available

Procedure 1.) Select the device e.g. in the profile view 2.) Select menu entry “General > Staging” 3.) Copy/paste staging info to the device console 4.) Click button “Back” at bottom of page 5.) Select menu entry “General > Initial provisioning” 6.) Click “Confirm” 7.) Wait for initial provisioning to complete successfully. Re-do steps 5

and 6 in case of failure

8.) Select menu entry “Supervision > Get the running configuration” 9.) Check the configuration that appears on the screen

Expected

Results

1.) Device provisioning is successful 2.) Default VoIP configuration show up in the configuration, e.g.

a.) voice service, voice register global, voice class b.) telephony-service c.) dhcp server for the voice vlan: ip dhcp pool UBI_VOICE d.) tftp server specs for IPphones loads directives



30 / 37

Test Case Details

Title VOIP04 - Add phones and call numbers to a VoIP profile

Description Edit the voip profile to add 5 phones and 4 call numbers; create a shared

line

Test Setup

Procedure 1.) Select the blank voip profile that was created in VOIP-02 2.) Select menu entry “Management > Edit profile” 3.) Select tab “IP Phones” 4.) Add 5 IP phones using the ‘+’ button (click 5 times) 5.) Fill in information about the phones. Note: if you do not have 5

phones at hand, use fake MAC addresses

6.) Select tab “Call Numbers” 7.) Add 4 call numbers using the ‘+’ button (click 4 times) 8.) Fill in required information about call numbers; use e.g. the

following call numbers: 1001, 1002, 1003, and 1004; assign the 4

call numbers to 4 different phones, in sequence, use button 1

(default) for the line/button associations.

9.) Create a shared line using the last call number (1004) by clicking the ‘+’ button next to the phone assignment dropdown

10.) Assign the remaining phone to this line too

11.) Click “Save profile”

Expected

Results

1.) Profile is saved successfully 2.) Configuration eventually gets pushed onto the device

(asynchronous update of device happens within 2 minutes after

profile is saved)


Test Case Details

Title VOIP05 - Check that you can place calls between phones

Description Connect the phones; Check that you can place calls between phones

Test Setup 1.) Device is still up and running 2.) Voice VLAN infrastructure is ready (switch ports, vlans) 3.) IP phones are ready to be plugged (PoE ports, or power chords)

Procedure 1.) Connect the phones to the device or to the relevant switch ports 2.) Wait until they finish booting (ignore error messages on phones) 3.) Check on the phone that it has registered

Note: if phone does not register, check the VLAN ID setting on the

phone; the vlan ID on the phone should match the VOICE vlan

defined on the device.

4.) Pick-up an IP phone and dial another IP phone 5.) Talk to your party and hang-up

Expected

Results

1.) Phones register to the specified configuration (phone number, label) 2.) Calls can be placed normally between phones



31 / 37

Test Case Details

Title VOIP06 - Add a Hunt Group to a VoIP profile

Description Edit the voip profile to add a Hunt group with e.g. 3 members

Test Setup

Procedure 1.) Select the voip profile 2.) Select menu entry “Management > Edit profile” 3.) Select tab “Groups” 4.) Add a Hunt Group by clicking the ‘+’ icon in table “Hunt Groups” 5.) Define name, number and timeout, select type “Sequential” 6.) Add 3 group members using the ‘+’ icon in column “Members” (click

3 times)

7.) Select relevant extensions form members as needed 8.) Click “Save profile”

Expected

Results

1.) Profile is saved successfully 2.) Group definition eventually gets pushed onto device


Test Case Details

Title VOIP07 - Define a site prefix dial-plan

Description Edit the voip profile to define a site prefix dial plan

Test Setup In order to actually test this feature, a second device should be added to

the profile. The procedure below can however be executed successfully

without this device.

Procedure 1.) Select the voip profile 2.) Select menu entry “Management > Edit profile” 3.) Select tab “Dial Plans” 4.) Add a site-to-site dial-plan entry using the ‘+’ icon in table “Site to

Site” (note: the one-and-only device in the profile is selected in

column “Site” dropdown)

5.) Define the site prefix/pattern, e.g. 1… since all call numbers follow this pattern


Expected

Results

1.) Profile is saved successfully 2.) (optional) SIP trunk definition eventually gets pushed on OTHER

devices in the profile (note: requires other devices)


Test Case Details

Title VOIP08 - Configure an inbound/outbound PSTN connection

Description Edit the voip profile to configure and inbound/outbound PSTN connection

Test Setup In order to actually test this feature, the device should have an FXO or a

BRI card installed and connected to the PSTN/ISDN network. The

procedure below can however be executed successfully even if the device


32 / 37

does not have the card.

Procedure 1.) Select the voip profile 2.) Select menu entry “Management > Edit profile” 3.) Select tab “Dial Plans” 4.) Add an outgoing dial plan entry using the ‘+’ icon in table

“Outgoing”

5.) Select outgoing point type (FXO) and specify outgoing port number e.g. 0/1/0 – check your device hardware. Specify an access

pattern in field “prefix”, e.g. 9T

6.) Add and incoming dial plan entry using the ‘+’ icon in table “Incoming”

7.) Select incoming point type (FXO) and specify incoming port number as above e.g. 0/1/0 – since we are configuring the same port for

both in and out operations


Expected

Results

1.) Profile is saved successfully 2.) PSTN configuration eventually gets pushed onto device


Test Case Details

Title VOIP09 - Check that hunt groups and PSTN calls work

Description Check that the hunt group works; check that you can place incoming /

outgoing PSTN calls

Test Setup 1.) PSTN/ISDN card is installed and connected to the network 2.) Gather the external phone number for the PSTN/ISDN access

Procedure 1.) Pick up a phone and dial the Hunt Group extension number 2.) Wait till all members have rung 3.) Hang up the phone – or answer on the last phone and hang-up 4.) Pickup a phone and dial to a PSTN call number using prefix 9 – you

will need to enter 9<phone number>#

5.) Talk to your party and hang-up 6.) Use e.g. a mobile phone and dial the PSTN endpoint external call

number.

7.) Talk to your party and hang-up 8.) (optional) edit the voip profile and change the inbound port

destination to be the Hunt group. Repeat step 6.

Expected

Results

1.) Hunt group sequence works – phones ring and voice works 2.) Inbound PSTN call works – assigned phone/extension rings & talks 3.) Outbound PSTN call works – call can be placed


Test Case Details

Title VOIP10 - Defining that a device has a CUE

Description Update the “voice enabled” device to specify that it has a CUE

Test Setup In order to actually test this feature, the device should have a CUE module


33 / 37

installed. The procedure below can however be executed successfully even

if the device does not have a CUE module.

Procedure 1.) Select the device e.g. in the ‘Devices’ tab on the home page 2.) Select menu entry “General > Device information” 3.) Click “Edit information” 4.) Click “Next” 5.) Click “Next” 6.) Click “Advanced configuration” 7.) Select “CUE” in section “Optional card” and specify IP address 8.) Click “Finish” 9.) Click “Confirm”

Expected

Results

1.) Device definition is updated successfully 2.) CUE IP connectivity is eventually defined on the device


Test Case Details

Title VOIP11 - Defining voice mail accounts

Description Edit the voip profile to define voice mail accounts

Test Setup

Procedure 1.) Select the voip profile 2.) Select menu entry “Management > Edit profile” 3.) Select tab “Voice Mail” 4.) Define the voice mail service extention, e.g. 6999 5.) Define the CUE access pattern e.g. 69.. 6.) Add some mailboxes using the ‘+’ icon in table “Mail Boxes” 7.) Define mailboxes usernames and pincodes, assign extensions.

Define user and group mailboxes.


Expected

Results

1.) Voice mail configuration is setup successfully on the device 2.) Voice mail mailboxes are defined on the CUE 3.) (optional) other devices in the system have a dial peer to the CUE

defined


Test Case Details

Title VOIP12 - Check that you can reach the voice mail from all phones

Description

Test Setup

Procedure 1.) Pick up an IP phone 2.) Dial 6999 3.) Enter the pin code for the phone/extension, followed by # 4.) Listen to the CUE voice and hang up 5.) (optional) Repeat steps 1-4 for other phone(s) 6.) Pick up the IP phone of one of the Hunt Group members 7.) Repeat steps 1-4


34 / 37

8.) Press '5' to access the group mailbox (general delivery mailbox) 9.) Listen to the CUE voice and hang up

Expected

Results

1.) The voice mail service can be reached – dialed into 2.) The voice mail service is functional from phones – pin accepted 3.) The voice mail service is functional from phones belonging to

groups


Test Case Details

Title VOIP13 - Leave a voice-mail message on one of the defined voice-mail

accounts

Description

Test Setup

Procedure 1.) Pick up an IP phone 2.) Dial the extension of the voice-mail service (see Observation below) 3.) Leave a message for your party and hang-up

Expected

Results

1.) Leaving a message on a voice mail mailbox works


The current implementation of the voice-mail service is

limited. It is not possible to call one of the other IP phones and wait until the voice mail prompts. It is however possible

to leave a message on a voice-mail box using the following procedure:

1. dial the voice-mail extension from your phone 2. enter '<your pin-code>', followed by # 3. press '2' to choose menu "leave a message" 4. enter '## <extension> #' using the extension of the

party you wish to leave message to

5. confirm with '#' 6. press '#' to record the message 7. record your message 8. press '#' to finish the recording 9. press '#' to send the message

Test Case Details

Title VOIP14 - Check that the message-waiting indicator works on relevant

phone

Description

Test Setup


35 / 37

Procedure 1.) Look at the IP phone you have just called and left a message to 2.) Locate the “Message Waiting” indicator; check it is on 3.) Pickup this phone, dial in to the voice mail (6999), at the prompt,

enter the pin, followed by #

4.) Listen to the message that your party left and hang-up

Expected

Results

1.) Listening to the message works


5.8. Monitoring Service Profile

Test Case Details

Title MON01 - Create a monitoring profile to monitor the packet loss by polling

the following counters :

ipInDiscards 1.3.6.1.2.1.4.8.0

ipOutDiscards 1.3.6.1.2.1.4.11.0

Description The creation of a monitoring profile to monitor additional KPI. Monitoring

profiles can be map on any kind of devices (managed or monitored).




Select Create a Monitoring profile.

Name the profile.

Add the following OID under the SNMP polling :

Name OID Type

ipInDiscards 1.3.6.1.2.1.4.8.0 Counter

ipOutDiscards 1.3.6.1.2.1.4.11.0 Counter

Aggregate the metrics in one graph.

Graph Name : Packet Loss Y Axis Label : Packet Loss Number


Finally you can select the devices to monitor the KPI to.

Click Confirm and the MSActivator will start to monitor the new KPI on the

devices included.

Expected

Results

You should see the graphs on the profile home page.


Test Case Details

Title MON02 - Check the graphs device home page.

Description View the monitoring graphs of customs metrics.



Select the Devices tab.

Select the device.

Device must have be up and running for a sufficient amount of time in


36 / 37


Procedure On the device home page select the day view.

Select the Packet Loss metric.

Check the graph.

Expected

Results

You should see the graphs related to the monitoring of packet loss on the

device.

Observation

Test Case Details

Title MON03 - Modify the profile to raise thresholds alerts if the loss is higher

than 10 packets.

Description Define thresholds to raise alerts.



Select the Monitoring tab.

Select the profile.

Procedure On the monitoring profile home page select the Management menu

Select Edit profile

Set the thresholds of the ipInDiscards and ipOutDiscards metrics to > 10.

Select the frequency to 1 per day.


The MSActivator will now send email and SNMP traps alerts when the

packet loss will be higher than 10.

Expected

Results

If a threshold violation occur you can check your mail (need to have a

valid SMTP server configured) or see the alarm in the weekly event report.

Observation

Test Case Details

Title MON04 - Export the profile in XML.

Description Reuse the configured metrics by saving the monitoring profile in XML.



Select the Monitoring tab.

Select the profile.

Procedure On the monitoring profile home page select the Management menu

Select export profile.

Save the file on your computer.

Expected

Results

You should have an XML file. Use your XML editor to view the file.

Observation

Test Case Details

Title MON05 - Import a profile from an XML file.

Description Reuse existing custom metrics for another customer by importing the

monitoring profile in XML.



37 / 37


Procedure Select the Monitoring tab.

Click Browse to select the XML file.

Click on the import icon.

Enter a name for your imported monitoring profile eg : packetloss2.

Check the SNMP polling and Graphical Rendering.

Once done click Finish.

Expected

Results

You should have a new monitoring profile called packetloss2.

Observation

5.9. Vulnerability Assessment Service Profile

Test Case Details

Title VUL01 - Create a Scan profile; schedule the scan for today, 10 minutes

ahead of now. Attach an existing and live device to the profile.

Description The scheduling of a vulnerability assessment test.


Select the customer to access the customer home page


Select Create an IDS/IPS profile.

Name the profile.

Select the devices to test.

Select all days and 10 minutes ahead of now in the hour to run the scan.

Click save profile.

Expected

Results

You should have a new profile under the scan tab on the customer home

page.


Test Case Details

Title VUL02 - Check that Scan reports are generated – a scan takes 5 to 20

minutes.

Description View the vulnerability assessment report.



Procedure On the customer home page select the Scan tab.

Select the profile.

Select the device.

Select the report.

Expected

Results

You should see the results of a vulnerability assessment test.

Observation

ubiqube poc test plandepot.ubiqube.com/docsinterwiki/ubiqube_poc_test_plan.pdf · ubiqube poc test...

Documents