Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: 408 526-4000
800 553-NETS (6387)
Fax: 408 527-0883
Text Part Number: OL-28826-01
Page 2
THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL
STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT
WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT
SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE
OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH
ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT
LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF
DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING,
WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO
OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this
URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership
relationship between Cisco and any other company. (1110R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display
output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in
illustrative content is unintentional and coincidental.
Obtaining Documentation, Obtaining Support, and Security Guidelineslviii
CHAPTER
1Getting Started with Security Manager1-1
Product Overview 1-1
Primary Benefits of Cisco Security Manager 1-2
Security Manager Policy Feature Sets1-4
Security Manager Applications Overview1-6
Device Monitoring Overview1-6
IPv6 Support in Security Manager 1-7
Policy Object Changes in Security Manager 4.4 1-9
Logging In to and Exiting Security Manager1-9
Understanding User Permissions 1-10
Logging In to the Cisco Security Management Suite Server1-10
Logging In to and Exiting the Security Manager Client1-11
Edit Menu (Configuration Manager)1-29
View Menu (Configuration Manager)1-30
Policy Menu (Configuration Manager)1-30
Map Menu (Configuration Manager)1-31
Manage Menu (Configuration Manager)1-32
Tools Menu (Configuration Manager)1-33
Activities Menu (Configuration Manager)1-34
Tickets Menu (Configuration Manager)1-34
Launch Menu (Configuration Manager)1-35
Help Menu (Configuration Manager)1-36
Toolbar Reference (Configuration Manager)1-36
Using Global Search1-39
Using Selectors1-42
Filtering Items in Selectors1-42
Create Filter Dialog Box1-43
Using Wizards1-44
Using Tables 1-45
Filtering Tables1-45
Table Columns and Column Heading Features1-46
Using Text Fields1-46
Understanding ASCII Limitations for Text1-46
Finding Text in Text Boxes1-47
Navigating Within Text Boxes1-47
Selecting or Specifying a File or Directory in Security Manager1-47
Troubleshooting User Interface Problems 1-48
CHAPTER
iv
Accessing Online Help1-49
2Preparing Devices for Management2-1
Understanding Device Communication Requirements 2-1
Setting Up SSL (HTTPS)2-3
Setting Up SSL (HTTPS) on PIX Firewall, ASA and FWSM Devices 2-3
Setting Up SSL on Cisco IOS Routers 2-4
Setting Up SSH2-5
Critical Line-Ending Conventions for SSH 2-5
Testing Authentication2-5
Setting Up SSH on Cisco IOS Routers, Catalyst Switches, and Catalyst 6500/7600 devices2-6
Preventing Non-SSH Connections (Optional)2-7
Setting Up AUS or Configuration Engine2-7
Setting Up AUS on PIX Firewall and ASA Devices 2-8
User Guide for Cisco Security Manager 4.4
OL-28826-01
Page 5
Setting Up CNS on Cisco IOS Routers in Event-Bus Mode 2-9
Setting Up CNS on Cisco IOS Routers in Call-Home Mode 2-10
Configuring Licenses on Cisco ASA Devices 2-11
Configuring Licenses on Cisco IOS Devices 2-12
Initializing IPS Devices2-12
Contents
CHAPTER
3Managing the Device Inventory3-1
Understanding the Device Inventory3-1
Understanding the Device View3-1
Understanding Device Names and What Is Considered a Device3-3
Understanding Device Credentials3-4
Understanding Device Properties3-6
Adding Devices to the Device Inventory3-6
Working with Generically Supported Devices3-8
Working with Device Clusters3-9
Adding Devices from the Network3-11
Device Information Page – Add Device from Network3-13
Service Module Credentials Dialog Box 3-18
IPS Module Discovery Dialog Box 3-19
Adding Devices from Configuration Files3-20
Device Information Page—Configuration File3-22
Adding Devices by Manual Definition3-25
Device Information Page—New Device3-26
Adding Devices from an Inventory File3-29
Device Information Page—Add Device from File 3-31
OL-28826-01
Working with the Device Inventory3-34
Adding, Editing, or Deleting Auto Update Servers or Configuration Engines 3-35
Server Properties Dialog Box3-36
Available Servers Dialog Box3-38
Adding or Changing Interface Modules 3-39
Viewing or Changing Device Properties3-39
Image Version Changes That Do Not Change the Feature Set in Security Manager 3-50
Changes That Change the Feature Set in Security Manager 3-51
User Guide for Cisco Security Manager 4.4
v
Page 6
Contents
Showing Device Containment3-53
Cloning a Device3-54
Deleting Devices from the Security Manager Inventory3-55
Device Delete Validation Dialog Box 3-56
Working with Device Groups3-57
Understanding Device Grouping 3-57
Edit Device Groups Dialog Box3-58
Creating Device Group Types3-59
Creating Device Groups3-60
Deleting Device Groups or Group Types3-60
Adding Devices to or Removing Them From Device Groups3-60
Working with Device Status View3-61
CHAPTER
4Managing Activities4-1
Understanding Activities4-1
Benefits of Activities4-2
Activity Approval4-3
Activities and Locking4-3
Activities and Multiple Users4-4
Understanding Activity/Ticket States4-4
Working with Activities/Tickets4-7
Accessing Activity Functions in Workflow Mode4-8
Accessing Ticket Functions in Non-Workflow Mode4-9
Activity/Ticket Manager Window4-10
Creating an Activity/Ticket4-14
Responding to the Activity/Ticket Required Dialog Box4-14
Opening an Activity/Ticket4-15
Closing an Activity/Ticket4-16
Viewing Change Reports4-16
Selecting a Change Report in Non-Workflow Mode with Ticket Management Disabled4-18
Validating an Activity/Ticket4-18
Submitting an Activity for Approval (Workflow Mode with Activity Approver)4-20
Approving or Rejecting an Activity (Workflow Mode)4-21
Discarding an Activity/Ticket4-22
Viewing Activity/Ticket Status and History4-23
CHAPTER
vi
5Managing Policies5-1
Understanding Policies5-1
Settings-Based Policies vs. Rule-Based Policies5-2
User Guide for Cisco Security Manager 4.4
OL-28826-01
Page 7
Service Policies vs. Platform-Specific Policies5-2
Local Policies vs. Shared Policies5-3
Understanding Rule Inheritance5-4
Inheritance vs. Assignment5-6
Policy Management and Objects5-7
Understanding Policy Locking5-7
Understanding Locking and Policies5-9
Understanding Locking and VPN Topologies5-9
Understanding Locking and Objects5-10
Customizing Policy Management for Routers and Firewall Devices5-10
Discovering Policies5-12
Discovering Policies on Devices Already in Security Manager5-15
Understanding Policy Object Overrides for Individual Devices6-17
Allowing a Policy Object to Be Overridden6-18
Creating or Editing Object Overrides for a Single Device 6-18
Creating or Editing Object Overrides for Multiple Devices At A Time 6-19
Deleting Device-Level Object Overrides 6-21
Importing and Exporting Policy Objects6-21
viii
Understanding AAA Server and Server Group Objects6-24
Supported AAA Server Types6-25
Additional AAA Support on ASA, PIX, and FWSM Devices6-26
Predefined AAA Authentication Server Groups6-28
Default AAA Server Groups and IOS Devices6-28
Creating AAA Server Objects6-29
Add or Edit AAA Server Dialog Box6-30
AAA Server Dialog Box—RADIUS Settings 6-32
AAA Server Dialog Box—TACACS+ Settings 6-35
AAA Server Dialog Box—Kerberos Settings 6-36
User Guide for Cisco Security Manager 4.4
OL-28826-01
Page 9
AAA Server Dialog Box—LDAP Settings 6-37
AAA Server Dialog Box—NT Settings 6-40
AAA Server Dialog Box—SDI Settings 6-40
AAA Server Dialog Box—HTTP-FORM Settings 6-41
Add and Edit LDAP Attribute Map Dialog Boxes6-43
Add and Edit LDAP Attribute Map Value Dialog Boxes6-44
Add and Edit Map Value Dialog Boxes 6-44
Creating AAA Server Group Objects6-45
AAA Server Group Dialog Box6-46
Creating Access Control List Objects6-49
Creating Extended Access Control List Objects6-50
Creating Standard Access Control List Objects6-51
Creating Web Access Control List Objects6-52
Creating Unified Access Control List Objects6-54
Add or Edit Access List Dialog Boxes 6-55
Add and Edit Extended Access Control Entry Dialog Boxes6-56
Add and Edit Standard Access Control Entry Dialog Boxes6-59
Add and Edit Web Access Control Entry Dialog Boxes6-60
Add and Edit Unified Access Control Entry Dialog Boxes6-62
Contents
Configuring Time Range Objects6-66
Recurring Ranges Dialog Box6-67
Understanding Interface Role Objects6-67
Creating Interface Role Objects6-68
Interface Role Dialog Box6-69
Specifying Interfaces During Policy Definition6-70
Using Interface Roles When a Single Interface Specification is Allowed6-71
Handling Name Conflicts between Interfaces and Interface Roles6-72
Understanding Map Objects6-72
Understanding Networks/Hosts Objects 6-74
Contiguous and Discontiguous Network Masks for IPv4 Addresses6-75
Creating Networks/Hosts Objects6-76
Add or Edit Network/Host Dialog Box 6-77
Using Unspecified Networks/Hosts Objects6-80
Specifying IP Addresses During Policy Definition 6-81
Understanding Pool Objects6-83
Add or Edit IPv4 Pool Dialog Box6-83
Add or Edit IPv6 Pool Dialog Box6-84
Add or Edit MAC Address Pool Dialog Box6-85
OL-28826-01
Understanding and Specifying Services and Service and Port List Objects6-86
User Guide for Cisco Security Manager 4.4
ix
Page 10
Contents
Configuring Port List Objects6-87
Configuring Service Objects6-89
How Policy Objects are Provisioned as Object Groups6-91
How Network/Host, Port List, and Service Objects are Named When Provisioned As Object
Groups
How Service Objects are Provisioned as Object Groups 6-92
6-92
CHAPTER
7Managing FlexConfigs7-1
Understanding FlexConfig Policies and Policy Objects7-2
Using CLI Commands in FlexConfig Policy Objects7-2
Using Scripting Language Instructions7-3
Scripting Language Example 1: Looping7-3
Scripting Language Example 2: Looping with Two-Dimensional Arrays 7-3
Example 3: Looping with If/Else Statements 7-4
Understanding FlexConfig Object Variables 7-5
Example of FlexConfig Policy Object Variables 7-6
FlexConfig System Variables7-7
Predefined FlexConfig Policy Objects7-19
Configuring FlexConfig Policies and Policy Objects7-24
A FlexConfig Creation Scenario7-24
Creating FlexConfig Policy Objects7-27
Add or Edit FlexConfig Dialog Box7-29
Create Text Object Dialog Box7-31
Add or Edit Text Object Dialog Box7-31
FlexConfig Undefined Variables Dialog Box7-32
Property Selector Dialog Box 7-33
Working with Deployment and the Configuration Archive8-26
Viewing Deployment Status and History for Jobs and Schedules 8-27
Tips for Successful Deployment Jobs8-28
Deploying Configurations in Non-Workflow Mode8-29
Edit Deploy Method Dialog Box8-31
Warning - Partial VPN Deployment Dialog Box8-32
Deployment Status Details Dialog Box8-33
Deploying Configurations in Workflow Mode8-35
Creating and Editing Deployment Jobs8-36
Submitting Deployment Jobs8-39
Approving and Rejecting Deployment Jobs8-39
Deploying a Deployment Job in Workflow Mode8-40
Discarding Deployment Jobs8-41
Deploying Configurations Using an Auto Update Server or CNS Configuration Engine8-42
Deploying Configurations to a Token Management Server8-43
Previewing Configurations8-45
Detecting and Analyzing Out of Band Changes8-46
OOB (Out of Band) Changes Dialog Box8-48
Redeploying Configurations to Devices8-49
Aborting Deployment Jobs8-51
Creating or Editing Deployment Schedules8-52
Schedule Dialog Box8-53
Add Other Devices Dialog Box8-54
OL-28826-01
User Guide for Cisco Security Manager 4.4
xi
Page 12
Contents
Suspending or Resuming Deployment Schedules8-55
Adding Configuration Versions from a Device to the Configuration Archive 8-55
Viewing and Comparing Archived Configuration Versions8-56
Configuration Version Viewer8-56
Viewing Deployment Transcripts8-58
Rolling Back Configurations 8-59
Understanding Configuration Rollback 8-59
Understanding Rollback for Devices in Multiple Context Mode 8-61
Understanding Rollback for Failover Devices 8-61
Understanding Rollback for Catalyst 6500/7600 Devices 8-61
Understanding Rollback for IPS and IOS IPS 8-62
Commands that Can Cause Conflicts after Rollback 8-64
Commands to Recover from Failover Misconfiguration after Rollback 8-65
Rolling Back Configurations to Devices Using the Deployment Manager8-65
Using Rollback to Deploy Archived Configurations8-66
Performing Rollback When Deploying to a File8-67
CHAPTER
9Troubleshooting Device Communication and Deployment9-1
Testing Device Connectivity9-1
Device Connectivity Test Dialog Box 9-3
Managing Device Communication Settings and Certificates9-4
Manually Adding SSL Certificates for Devices that Use HTTPS Communications 9-4
Security Certificate Rejected When Discovering Device 9-6
Invalid Certificate Error During Device Discovery 9-6
Troubleshooting SSH Connection Problems 9-7
Troubleshooting Device Communication Failures 9-7
Resolving Red X Marks in the Device Selector9-8
Troubleshooting Deployment 9-9
Changing How Security Manager Responds to Device Messages 9-10
Memory Violation Deployment Errors for ASA 8.3+ Devices9-11
Security Manager Unable to Communicate With Device After Deployment 9-12
Updating VPNs That Include Routing Processes 9-13
Mixing Deployment Methods with Router and VPN Policies 9-13
Deployment Failures for Routers 9-14
Deployment Failures for Catalyst Switches and Service Modules9-15
Changing How Security Manager Deploys Configurations to Multiple-Context FWSM 9-16
Deployment Failures to Devices Managed by AUS 9-17
Troubleshooting the Setup of Configuration Engine-Managed Devices 9-18
xii
User Guide for Cisco Security Manager 4.4
OL-28826-01
Page 13
Contents
CHAPTER
10Managing the Security Manager Server10-1
Overview of Security Manager Server Management and Administration10-1
Managing a Cluster of Security Manager Servers10-2
Overview of Security Manager Server Cluster Management10-2
Splitting a Security Manager Server10-3
Synchronizing Shared Policies Among Security Manager Servers10-4
Exporting the Device Inventory10-5
Exporting the Device Inventory from the Security Manager Client10-6
Supported CSV Formats for Inventory Import/Export10-9
Exporting the Device Inventory from the Command Line10-10
Exporting Shared Policies10-11
Importing Policies or Devices10-13
Installing Security Manager License Files 10-16
Certificate Trust Management10-17
Working with Audit Reports10-19
Understanding Audit Reports10-19
Generating the Audit Report10-20
Using the Audit Report Window10-20
Purging Audit Log Entries10-22
CHAPTER
Taking Over Another User’s Work10-23
Changing Passwords for the Admin or Other Users 10-23
Backing up and Restoring the Security Manager Database 10-24
Backing Up the Server Database10-24
Restoring the Server Database10-26
Generating Data for the Cisco Technical Assistance Center 10-27
Creating a Diagnostics File for the Cisco Technical Assistance Center 10-27
Generating Deployment or Discovery Status Reports10-28
Generating a Partial Database Backup for the Cisco Technical Assistance Center10-29
Verifying IPS Devices for License Update or Redeployment11-43
Selecting IPS License Files11-43
License Update Status Details Dialog Box11-43
Logs Page11-44
Policy Management Page11-45
Policy Objects Page11-47
Rule Expiration Page11-48
Server Security Page11-49
Take Over User Session Page11-50
Ticket Management Page11-51
Token Management Page11-52
VPN Policy Defaults Page11-53
Workflow Page11-54
Wall Settings Page11-56
CHAPTER
xiv
12Introduction to Firewall Services12-1
Overview of Firewall Services12-1
Understanding the Processing Order of Firewall Rules 12-2
Understanding How NAT Affects Firewall Rules 12-3
ACL Names Preserved by Security Manager 12-4
User Guide for Cisco Security Manager 4.4
OL-28826-01
Page 15
ACL Naming Conventions 12-5
Resolving ACL Name Conflicts Between Policies 12-6
Managing Your Rules Tables 12-7
Using Rules Tables12-7
Adding and Removing Rules 12-9
Editing Rules12-9
Adding or Editing Address Cells in Rules Tables12-11
Adding or Editing User Cells in Rules Tables12-12
Adding or Editing Services Cells in Rules Tables12-12
Adding or Editing Interfaces or Zones Cells in Rules Tables12-13
Editing Category Cells in Rules Tables12-14
Editing Description Cells in Rules Tables12-14
Showing the Contents of Cells in Rules Tables12-14
Finding and Replacing Items in Rules Tables 12-16
Find and Replace Dialog Box 12-17
Moving Rules and the Importance of Rule Order 12-19
Enabling and Disabling Rules12-20
Using Sections to Organize Rules Tables12-20
Add and Edit Rule Section Dialog Boxes12-22
Combining Rules12-22
Combine Rules Selection Summary Dialog Box12-24
Interpreting Rule Combiner Results12-25
Example Rule Combiner Results12-27
Converting IPv4 Rules to Unified Rules 12-28
Generating Policy Query Reports12-28
Querying Device or Policy Dialog Box 12-29
Interpreting Policy Query Results12-32
Example Policy Query Result12-34
Optimizing Network Object Groups When Deploying Firewall Rules 12-35
Expanding Object Groups During Discovery12-35
Contents
CHAPTER
OL-28826-01
13Managing Identity-Aware Firewall Policies13-1
Overview of Identity-Aware Firewall Policies13-1
User Identity Acquisition13-2
Requirements for Identity-Aware Firewall Policies13-3
Configuring the Firewall to Provide Identity-Aware Services13-7
Configuring Identity-Aware Firewall Policies13-7
Enabling Identity-Aware Firewall Services13-8
Identifying Active Directory Servers and Agents13-8
User Guide for Cisco Security Manager 4.4
xv
Page 16
Contents
Configuring Identity Options13-15
Creating Identity User Group Objects13-19
Selecting Identity Users in Policies13-21
Configuring Identity-Based Firewall Rules 13-21
Configuring Cut-Through Proxy13-23
Collecting User Statistics13-25
Filtering VPN Traffic with Identity-Based Rules13-26
Monitoring Identity Firewall Policies13-27
CHAPTER
CHAPTER
14Managing TrustSec Firewall Policies14-1
Overview of TrustSec Firewall Policies14-1
Understanding SGT and SXP Support in Cisco TrustSec14-2
Roles in the Cisco TrustSec Solution14-2
Security Group Policy Enforcement14-3
About Speaker and Listener Roles14-6
Prerequisites for Integrating an ASA with Cisco TrustSec14-6
Understanding Global Access Rules16-3
Understanding Device Specific Access Rule Behavior 16-4
Understanding Access Rule Address Requirements and How Rules Are Deployed 16-5
Configuring Access Rules 16-7
Access Rules Page 16-9
Add and Edit Access Rule Dialog Boxes 16-13
Advanced and Edit Options Dialog Boxes 16-15
Hit Count Selection Summary Dialog Box16-18
Configuring Expiration Dates for Access Rules 16-19
Configuring Settings for Access Control 16-20
Access Control Settings Page16-21
Firewall ACL Setting Dialog Box16-23
Using Automatic Conflict Detection16-25
Understanding Automatic Conflict Detection16-25
Understanding the Automatic Conflict Detection User Interface16-27
Resolving Conflicts16-31
Optimizing Access Rules Automatically During Deployment 16-43
17Managing Firewall Inspection Rules17-1
Understanding Inspection Rules17-1
Choosing the Interfaces for Inspection Rules17-2
Selecting Which Protocols To Inspect 17-3
Understanding Access Rule Requirements for Inspection Rules17-4
User Guide for Cisco Security Manager 4.4
xvii
Page 18
Contents
Using Inspection To Prevent Denial of Service (DoS) Attacks on IOS Devices17-4
Configuring Inspection Rules 17-5
Inspection Rules Page 17-7
Add or Edit Inspect/Application FW Rule Wizard 17-10
Add or Edit Inspect/Application FW Rule Wizard, Step 2 17-12
Add or Edit Inspect/Application FW Rule Wizard, Inspected Protocol Page 17-16
Configure DNS Dialog Box17-18
Configure SMTP Dialog Box17-18
Configure ESMTP Dialog Box17-18
Configure Fragments Dialog Box17-19
Configure IMAP or POP3 Dialog Boxes17-19
Configure RPC Dialog Box17-20
Custom Protocol Dialog Box17-20
Configure Dialog Box 17-20
Configuring Protocols and Maps for Inspection17-21
Configuring Class Maps for Inspection Policies17-26
Configuring DCE/RPC Maps17-27
Configuring DNS Maps17-28
DNS Map Protocol Conformance Tab 17-30
DNS Map Filtering Tab 17-30
DNS Class and Policy Maps Add or Edit Match Condition (and Action) Dialog Boxes 17-31
Configuring ESMTP Maps17-34
ESMTP Policy Maps Add or Edit Match Condition and Action Dialog Boxes 17-35
Configuring FTP Maps 17-37
FTP Class and Policy Maps Add or Edit Match Condition (and Action) Dialog Boxes 17-38
Configuring GTP Maps 17-40
Add and Edit Country Network Codes Dialog Boxes17-42
Add and Edit Permit Response Dialog Boxes17-42
GTP Map Timeouts Dialog Box 17-43
GTP Policy Maps Add or Edit Match Condition and Action Dialog Boxes 17-43
Configuring H.323 Maps17-45
Add or Edit HSI Group Dialog Boxes17-47
Add or Edit HSI Endpoint IP Address Dialog Boxes17-48
H.323 Class and Policy Maps Add or Edit Match Condition (and Action) Dialog Boxes 17-48
Configuring HTTP Maps for ASA 7.1.x, PIX 7.1.x, FWSM 3.x and IOS Devices17-50
HTTP Map General Tab17-51
HTTP Map Entity Length Tab17-52
HTTP Map RFC Request Method Tab17-54
HTTP Map Extension Request Method Tab17-55
xviii
User Guide for Cisco Security Manager 4.4
OL-28826-01
Page 19
Contents
HTTP Map Port Misuse Tab 17-56
HTTP Map Transfer Encoding Tab 17-57
Configuring HTTP Maps for ASA 7.2+ and PIX 7.2+ Devices17-58
HTTP Class and Policy Map (ASA 7.2+/PIX 7.2+) Add or Edit Match Condition (and Action) Dialog
Boxes
Configuring IM Maps for ASA 7.2+, PIX 7.2+ Devices17-64
IM Class and Policy Map (ASA 7.2+/PIX 7.2+) Add or Edit Match Condition (and Action) Dialog
Boxes
Configuring IM Maps for IOS Devices17-67
Configuring IP Options Maps17-68
Configuring IPv6 Maps17-70
IPv6 Policy Maps Add or Edit Match Condition and Action Dialog Boxes 17-71
Configuring IPsec Pass Through Maps17-74
Configuring NetBIOS Maps 17-75
Configuring ScanSafe Maps17-76
Configuring SIP Maps17-77
SIP Class and Policy Maps Add or Edit Match Condition (and Action) Dialog Boxes 17-79
Configuring Skinny Maps17-81
Skinny Policy Maps Add or Edit Match Condition and Action Dialog Boxes 17-83
Configuring SNMP Maps17-84
Configuring Regular Expression Groups17-85
Configuring Regular Expressions for Inspection Maps17-86
Metacharacters Used to Build Regular Expressions17-87
17-59
17-65
CHAPTER
OL-28826-01
Configuring Settings for Inspection Rules for IOS Devices17-88
18Managing Firewall Web Filter Rules18-1
Understanding Web Filter Rules18-1
Configuring Web Filter Rules for ASA, PIX, and FWSM Devices 18-2
Web Filter Rules Page (ASA/PIX/FWSM)18-3
Add and Edit PIX/ASA/FWSM Web Filter Rule Dialog Boxes18-5
Edit Web Filter Type Dialog Box18-8
Edit Web Filter Options Dialog Box18-9
Configuring Web Filter Rules for IOS Devices 18-10
Web Filter Rules Page (IOS)18-11
IOS Web Filter Rule and Applet Scanner Dialog Box 18-13
IOS Web Filter Exclusive Domain Name Dialog Box18-14
Task Flow for Configuring the Botnet Traffic Filter19-2
Configuring the Dynamic Database19-4
Adding Entries to the Static Database19-5
Enabling DNS Snooping19-6
Enabling Traffic Classification and Actions for the Botnet Traffic Filter19-6
BTF Enable Rules Editor19-12
BTF Drop Rules Editor19-13
Whitelist/Blacklist Tab19-14
Device Whitelist or Device Blacklist Dialog Box19-15
20Working with ScanSafe Web Security20-1
Configuring ScanSafe Web Security20-2
ScanSafe Web Security Page20-4
Add and Edit Default User Groups Dialog Box20-6
CHAPTER
ScanSafe Web Security Settings Page 20-6
21Managing Zone-based Firewall Rules21-1
Understanding the Zone-based Firewall Rules21-3
The Self Zone 21-5
Using VPNs with Zone-based Firewall Policies21-5
Zones and VRF-aware Firewalls 21-6
Understanding the Relationship Between Permit/Deny and Action in Zone-based Firewall Rules 21-7
Understanding the Relationship Between Services and Protocols in Zone-based Firewall Rules 21-10
General Recommendations for Zone-based Firewall Rules 21-11
Developing and Applying Zone-based Firewall Rules21-12
Adding Zone-Based Firewall Rules21-12
Configuring Inspection Maps for Zone-based Firewall Policies 21-15
Configuring Class Maps for Zone-Based Firewall Policies21-17
Zone-based Firewall IM Application Class Maps: Add or Edit Match Condition Dialog Boxes
21-20
Zone-based Firewall P2P Application Class Maps: Add or Edit Match Condition Dialog Boxes
21-20
H.323 (IOS) Class Maps Add or Edit Match Criterion Dialog Boxes 21-21
xx
User Guide for Cisco Security Manager 4.4
OL-28826-01
Page 21
HTTP (IOS) Class Add or Edit Match Criterion Dialog Boxes 21-21
IMAP and POP3 Class Maps Add or Edit Match Criterion Dialog Boxes 21-23
SIP (IOS) Class Add or Edit Match Criterion Dialog Boxes 21-24
SMTP Class Maps Add or Edit Match Criterion Dialog Boxes 21-25
Sun RPC Class Maps Add or Edit Match Criterion Dialog Boxes 21-28
Local Web Filter Class Add or Edit Match Criterion Dialog Boxes21-28
N2H2 and Websense Class Add or Edit Match Criterion Dialog Boxes 21-29
Configuring Inspect Parameter Maps 21-29
Configuring Protocol Info Parameter Maps 21-32
Add or Edit DNS Server for Protocol Info Parameters Dialog Box 21-33
Configuring Policy Maps for Zone-Based Firewall Policies21-33
Add or Edit Match Condition and Action Dialog Boxes for Zone-Based Firewall and Web Filter
Policies
Configuring Content Filtering Maps for Zone-based Firewall Policies 21-35
Configuring Local Web Filter Parameter Maps 21-37
Configuring N2H2 or WebSense Parameter Maps 21-38
Understanding Mandatory and Optional Policies for Site-to-Site VPNs24-6
Overview of Site-to-Site VPN Policies24-8
Understanding Devices Supported by Each IPsec Technology24-9
Including Unmanaged or Non-Cisco Devices in a VPN24-11
User Guide for Cisco Security Manager 4.4
OL-28826-01
Page 23
Understanding and Configuring VPN Default Policies24-12
Using Device Overrides to Customize VPN Policies 24-13
Understanding VRF-Aware IPsec24-14
VRF-Aware IPsec One-Box Solution 24-14
VRF-Aware IPsec Two-Box Solution 24-15
Enabling and Disabling VRF on Catalyst Switches and 7600 Devices 24-17
Accessing Site-to-Site VPN Topologies and Policies24-17
Site-to-Site VPN Manager Window24-18
Configuring VPN Topologies in Device View24-19
Site-To-Site VPN Discovery24-19
Supported and Unsupported Technologies and Topologies for VPN Discovery24-20
Prerequisites for VPN Discovery24-21
VPN Discovery Rules24-21
Discovering Site-to-Site VPNs24-24
Defining or Repairing Discovered VPNs with Multiple Spoke Definitions 24-25
Rediscovering Site-to-Site VPNs24-26
Contents
Creating or Editing VPN Topologies24-28
Defining the Name and IPsec Technology of a VPN Topology24-30
Selecting Devices for Your VPN Topology24-32
Defining the Endpoints and Protected Networks24-33
Configuring VPN Interface Endpoint Settings24-35
Configuring Dial Backup24-39
Dial Backup Settings Dialog Box24-40
Configuring VPNSM or VPN SPA/VSPA Endpoint Settings24-41
Identifying the Protected Networks for Endpoints24-45
Configuring a Firewall Services Module (FWSM) Interface with VPNSM or
VPNSPA/VSPA
24-45
Configuring VRF Aware IPsec Settings24-46
Configuring High Availability in Your VPN Topology24-49
Defining GET VPN Group Encryption24-51
Add Certificate Filter Dialog Box24-54
Add New or Edit Security Association Dialog Box24-55
Defining GET VPN Peers24-57
Assigning Initial Policies (Defaults) to a New VPN Topology24-58
Viewing a Summary of a VPN Topology’s Configuration24-59
OL-28826-01
Creating or Editing Extranet VPNs24-63
Deleting a VPN Topology24-67
User Guide for Cisco Security Manager 4.4
xxiii
Page 24
Contents
CHAPTER
25Configuring IKE and IPsec Policies25-1
Overview of IKE and IPsec Configurations25-2
Comparing IKE Version 1 and 225-4
Understanding IKE25-5
Deciding Which Encryption Algorithm to Use25-6
Deciding Which Hash Algorithm to Use25-6
Deciding Which Diffie-Hellman Modulus Group to Use25-7
Deciding Which Authentication Method to Use25-8
Configuring an IKE Proposal25-9
Configuring IKEv1 Proposal Policy Objects25-10
Configuring IKEv2 Proposal Policy Objects25-13
Understanding IPsec Proposals25-17
Understanding IPsec Proposals for Site-to-Site VPNs25-18
Configuring IPsec Proposals in Site-to-Site VPNs25-21
Selecting the IKE Version for Devices in Site-to-Site VPNs25-25
Configuring IPSec IKEv1 or IKEv2 Transform Set Policy Objects25-25
Configuring VPN Global Settings25-29
Configuring VPN Global ISAKMP/IPsec Settings25-30
Configuring VPN Global IKEv2 Settings25-34
Understanding NAT in VPNs25-37
Configuring VPN Global NAT Settings25-38
Configuring VPN Global General Settings25-40
Understanding IKEv1 Preshared Key Policies in Site-to-Site VPNs25-43
Configuring IKEv1 Preshared Key Policies25-44
Understanding Public Key Infrastructure Policies25-47
Requirements for Successful PKI Enrollment25-48
Configuring IKEv1 Public Key Infrastructure Policies in Site-to-Site VPNs25-50
Defining Multiple IKEv1 CA Servers for Site-to-Site VPNs25-51
Configuring Public Key Infrastructure Policies for Remote Access VPNs25-52
PKI Enrollment Dialog Box25-54
PKI Enrollment Dialog Box—CA Information Tab 25-55
PKI Enrollment Dialog Box—Enrollment Parameters Tab 25-59
PKI Enrollment Dialog Box—Certificate Subject Name Tab 25-61
PKI Enrollment Dialog Box—Trusted CA Hierarchy Tab 25-62
xxiv
Configuring IKEv2 Authentication in Site-to-Site VPNs25-62
IKEv2 Authentication Policy25-64
User Guide for Cisco Security Manager 4.4
OL-28826-01
Page 25
IKEv2 Authentication (Override) Dialog Box25-66
Contents
CHAPTER
26GRE and DM VPNs26-1
Understanding the GRE Modes Page26-1
GRE and Dynamic GRE VPNs26-2
Understanding GRE26-2
Advantages of IPsec Tunneling with GRE26-3
How Does Security Manager Implement GRE?26-3
Prerequisites for Successful Configuration of GRE26-3
Understanding GRE Configuration for Dynamically Addressed Spokes 26-5
Configuring IPsec GRE VPNs26-5
Configuring GRE Modes for GRE or GRE Dynamic IP VPNs26-6
Dynamic Multipoint VPNs (DMVPN)26-9
Understanding DMVPN26-10
Enabling Spoke-to-Spoke Connections in DMVPN Topologies26-10
Advantages of DMVPN with GRE26-11
Configuring DMVPN26-12
Configuring GRE Modes for DMVPN26-12
Configuring Large Scale DMVPNs26-16
Configuring Server Load Balancing in Large Scale DMVPN26-17
Edit Load Balancing Parameters Dialog Box26-17
CHAPTER
27Easy VPN27-1
Understanding Easy VPN27-1
Easy VPN with Dial Backup27-2
Easy VPN with High Availability27-2
Easy VPN with Dynamic Virtual Tunnel Interfaces27-2
Easy VPN Configuration Modes27-3
Easy VPN and IKE Extended Authentication (Xauth)27-4
Overview of Configuring Easy VPN27-5
Important Notes About Easy VPN Configuration27-6
Configuring Client Connection Characteristics for Easy VPN27-7
Configuring Credentials Policy Objects27-9
Configuring an IPsec Proposal for Easy VPN27-10
Configuring Dynamic VTI for Easy VPN27-12
Configuring a Connection Profile Policy for Easy VPN27-13
Configuring a User Group Policy for Easy VPN27-14
OL-28826-01
User Guide for Cisco Security Manager 4.4
xxv
Page 26
Contents
CHAPTER
28Group Encrypted Transport (GET) VPNs28-1
Understanding Group Encrypted Transport (GET) VPNs28-2
Understanding the GET VPN Registration Process28-4
Choosing the Rekey Transport Mechanism28-6
Configuring Redundancy Using Cooperative Key Servers28-7
Configuring Fail-Close to Protect Registration Failures28-8
Understanding the GET VPN Security Policy and Security Associations28-10
Understanding Time-Based Anti-Replay28-11
Configuring GET VPN28-12
Generating and Synchronizing RSA Keys28-13
Configuring the IKE Proposal for GET VPN28-15
Configuring Global Settings for GET VPN28-16
Configuring GET VPN Key Servers28-18
Add Key Server, Group Member Dialog Box28-19
Edit Key Server Dialog Box28-19
Creating User Groups with the Create Group Policy Wizard29-19
xxvi
User Guide for Cisco Security Manager 4.4
OL-28826-01
Page 27
Contents
Create Group Policy Wizard—Full Tunnel Page29-20
Create Group Policy Wizard—Clientless and Thin Client Access Modes Page29-22
Creating IPSec VPNs Using the Remote Access VPN Configuration Wizard (ASA and PIX 7.0+
Devices)
Creating SSL VPNs Using the Remote Access VPN Configuration Wizard (IOS Devices)29-31
Creating IPSec VPNs Using the Remote Access VPN Configuration Wizard (IOS and PIX 6.3
Devices)
Configuring an ASA Device as a Shared License Client30-64
Configuring an ASA Device as a Shared License Server30-65
CHAPTER
Customizing Clientless SSL VPN Portals 30-65
Configuring ASA Portal Appearance Using SSL VPN Customization Objects 30-66
Localizing SSL VPN Web Pages for ASA Devices30-68
Creating Your Own SSL VPN Logon Page for ASA Devices 30-70
Configuring SSL VPN Bookmark Lists for ASA and IOS Devices 30-70
Using the Post URL Method and Macro Substitutions in SSL VPN Bookmarks30-72
Configuring SSL VPN Smart Tunnels for ASA Devices 30-73
Configuring WINS/NetBIOS Name Service (NBNS) Servers To Enable File System Access in SSL VPNs
Configuring High Availability in Remote Access VPNs (IOS)32-11
Configuring User Group Policies32-13
Configuring an SSL VPN Policy (IOS)32-14
SSL VPN Context Editor Dialog Box (IOS) 32-15
General Tab32-16
Creating Cisco Secure Desktop Configuration Objects32-18
33Configuring Policy Objects for Remote Access VPNs33-1
ASA Group Policies Dialog Box33-1
ASA Group Policies Client Configuration Settings 33-4
ASA Group Policies Client Firewall Attributes33-5
ASA Group Policies Hardware Client Attributes33-7
ASA Group Policies IPSec Settings33-8
Add or Edit Client Access Rules Dialog Box33-10
ASA Group Policies SSL VPN Clientless Settings33-10
Add or Edit VDI Server Dialog Box33-12
ASA Group Policies SSL VPN Full Client Settings33-13
ASA Group Policies SSL VPN Settings33-17
Add or Edit Auto Signon Rules Dialog Box33-19
ASA Group Policies DNS/WINS Settings33-20
ASA Group Policies Split Tunneling Settings 33-21
ASA Group Policies Connection Settings33-22
OL-28826-01
Add or Edit Secure Desktop Configuration Dialog Box 33-23
Add and Edit File Object Dialog Boxes33-25
File Object — Choose a file Dialog Box33-27
Add or Edit Port Forwarding List Dialog Boxes33-28
Add or Edit A Port Forwarding Entry Dialog Box 33-30
Add or Edit Single Sign On Server Dialog Boxes33-30
Add or Edit Bookmarks Dialog Boxes33-32
Add and Edit Bookmark Entry Dialog Boxes33-33
User Guide for Cisco Security Manager 4.4
xxix
Page 30
Contents
Add and Edit Post Parameter Dialog Boxes33-36
Add and Edit SSL VPN Customization Dialog Boxes33-37
Add and Edit A Smart Tunnel Entry Dialog Boxes33-53
Add and Edit Smart Tunnel Auto Signon List Dialog Boxes33-55
Add and Edit Smart Tunnel Auto Signon Entry Dialog Boxes33-56
Add or Edit User Group Dialog Box 33-58
User Group Dialog Box—General Settings 33-60
User Group Dialog Box—DNS/WINS Settings 33-61
User Group Dialog Box—Split Tunneling 33-62
User Group Dialog Box—IOS Client Settings33-63
User Group Dialog Box—IOS Xauth Options 33-64
User Group Dialog Box—IOS Client VPN Software Update 33-65
Add/Edit Client Update Dialog Box 33-65
User Group Dialog Box—Advanced PIX Options 33-66
User Group Dialog Box—Clientless Settings 33-67
User Group Dialog Box—Thin Client Settings33-68
User Group Dialog Box—SSL VPN Full Tunnel Settings33-69
User Group Dialog Box—SSL VPN Split Tunneling33-70
User Group Dialog Box—Browser Proxy Settings33-72
User Group Dialog Box—SSL VPN Connection Settings 33-73
xxx
Add or Edit WINS Server List Dialog Box33-74
Add or Edit WINS Server Dialog Box33-74
User Guide for Cisco Security Manager 4.4
OL-28826-01
Page 31
Contents
CHAPTER
34Using Map View34-1
Understanding Maps and Map View34-1
Understanding the Map View Main Page34-2
Map Toolbar34-4
Using the Navigation Window34-4
Maps Context Menus34-5
Creating New or Default Maps34-9
Opening Maps34-10
Saving Maps34-10
Deleting Maps34-10
Exporting Maps34-11
Arranging Map Elements34-11
Panning, Centering, and Zooming Maps34-11
Selecting Map Elements34-12
Searching for Map Nodes34-12
Using Linked Maps34-13
Setting the Map Background Properties 34-13
OL-28826-01
Displaying Your Network on the Map34-14
Understanding Map Elements34-14
Displaying Managed Devices on the Map34-16
Showing Containment of Catalyst Switches, Firewalls, and Adaptive Security Appliances34-16
Using Map Objects To Represent Network Topology34-17
Creating and Managing Layer 3 Links on the Map34-19
Select Interfaces and Link Properties Dialog Boxes34-20
Add Link Dialog Box34-20
Managing VPNs in Map View34-20
Displaying Existing VPNs on the Map34-21
Creating VPN Topologies in Map View34-21
User Guide for Cisco Security Manager 4.4
xxxi
Page 32
Contents
Editing VPN Policies or Peers From the Map34-22
Managing Device Policies in Map View34-22
Performing Basic Policy Management in Map View34-22
Managing Firewall Policies in Map View34-23
Managing Firewall Settings in Map View34-23
CHAPTER
35Getting Started with IPS Configuration35-1
Understanding IPS Network Sensing35-1
Capturing Network Traffic35-2
Correctly Deploying the Sensor35-4
Tuning the IPS35-4
Overview of IPS Configuration35-5
Identifying Allowed Hosts35-7
Configuring SNMP35-8
General SNMP Configuration Options35-10
SNMP Trap Configuration Tab35-11
SNMP Trap Communication Dialog Box35-12
Managing User Accounts and Password Requirements35-13
Understanding IPS User Roles35-13
Understanding Managed and Unmanaged IPS Passwords35-14
Understanding How IPS Passwords are Discovered and Deployed35-15
Configuring IPS User Accounts35-16
Add User and Edit User Credentials Dialog Boxes35-17
Configuring User Password Requirements35-18
Configuring AAA Access Control for IPS Devices35-19
Advantages and Restrictions of Virtualization37-3
Inline TCP Session Tracking Mode37-3
Understanding Normalizer Mode37-4
Assigning Interfaces to Virtual Sensors37-4
Identifying the Virtual Sensors for a Device37-5
Defining A Virtual Sensor37-5
Virtual Sensor Dialog Box37-7
Editing Policies for a Virtual Sensor37-9
Deleting A Virtual Sensor37-10
38Defining IPS Signatures38-1
Understanding Signatures38-1
Obtaining Detailed Information About a Signature38-2
Understanding Signature Inheritance38-3
IPS Signature Purge38-3
Target Value Rating Dialog Box39-16
Understanding Passive OS Fingerprinting39-17
Configuring OS Identification (Cisco IPS 6.x and Later Sensors Only)39-18
OS Map Dialog Box39-20
Configuring Settings for Event Actions39-21
40Managing IPS Anomaly Detection40-1
xxxiv
Understanding Anomaly Detection40-1
Worm Viruses40-2
Anomaly Detection Modes40-2
Anomaly Detection Zones40-3
Knowing When to Turn Off Anomaly Detection40-4
Configuring Anomaly Detection Signatures40-4
Configuring the IPS Update Server 43-4
Checking for IPS Updates and Downloading Them43-5
Automating IPS Updates43-6
User Guide for Cisco Security Manager 4.4
xxxv
Page 36
Contents
Manually Applying IPS Updates43-7
Managing IPS Certificates43-10
Rebooting IPS Sensors43-11
CHAPTER
CHAPTER
44Configuring IOS IPS Routers44-1
Understanding Cisco IOS IPS44-1
Understanding IPS Subsystems and Support of IOS IPS Revisions44-2
Cisco IOS IPS Signature Scanning with Lightweight Signatures44-2
Router Configuration Files and Signature Event Action Processor (SEAP)44-3
Cisco IOS IPS Limitations and Restrictions44-3
Overview of Cisco IOS IPS Configuration44-3
Initial Preparation of a Cisco IOS IPS Router44-5
Selecting a Signature Category for Cisco IOS IPS44-6
Configuring General Settings for Cisco IOS IPS44-7
Configuring IOS IPS Interface Rules44-8
IPS Rule Dialog Box44-9
Pair Dialog Box44-10
45Managing Firewall Devices45-1
Firewall Device Types45-1
Default Firewall Configurations45-2
Configuring Firewall Device Interfaces45-2
Understanding Device Interfaces45-3
Interfaces in Routed and Transparent Modes45-4
Interfaces in Single and Multiple Contexts45-5
About Asymmetric Routing Groups45-5
Understanding ASA 5505 Ports and Interfaces45-6
Configuring Subinterfaces (PIX/ASA)45-7
Configuring Redundant Interfaces45-7
Configuring EtherChannels45-8
Managing Device Interfaces, Hardware Ports, and Bridge Groups 45-14
55Configuring Security Policies on Firewall Devices55-1
General Page55-1
Configuring Floodguard, Anti-Spoofing and Fragment Settings55-2
Add/Edit General Security Configuration Dialog Box55-3
Configuring Timeouts55-4
56Configuring Service Policy Rules on Firewall Devices56-1
About Service Policy Rules56-1
About TCP State Bypass56-3
Priority Queues Page56-4
Priority Queue Configuration Dialog Box56-4
IPS, QoS, and Connection Rules Page56-5
Insert/Edit Service Policy (MPC) Rule Wizard56-6
Step 1. Configure a Service Policy56-6
Step 2. Configure the traffic class56-7
Step 3. Configure the MPC actions 56-8
About IPS Modules on ASA Devices56-14
About the ASA CX 56-15
ASA CX Auth Proxy Configuration 56-16
CHAPTER
xlii
Configuring Traffic Flow Objects56-16
Default Inspection Traffic 56-18
Configuring TCP Maps56-20
Add and Edit TCP Option Range Dialog Boxes56-22
57Configuring Security Contexts on Firewall Devices 57-1
Enabling and Disabling Multiple-Context Mode57-1
Checklist for Configuring Multiple Security Contexts57-2
CPU Utilization Settings on Cisco IOS Routers60-25
Defining CPU Utilization Settings60-25
CPU Policy Page60-26
HTTP and HTTPS on Cisco IOS Routers60-28
Defining HTTP Policies60-29
HTTP Policy Page60-31
HTTP Page—Setup Tab60-31
HTTP Page—AAA Tab60-32
Command Authorization Override Dialog Box60-34
Line Access on Cisco IOS Routers60-35
Defining Console Port Setup Parameters60-35
Defining Console Port AAA Settings60-37
Defining VTY Line Setup Parameters60-38
Defining VTY Line AAA Settings60-40
Hostnames and Domain Names on Cisco IOS Routers60-77
Defining Hostname Policies60-77
Hostname Policy Page60-78
Memory Settings on Cisco IOS Routers60-78
Defining Router Memory Settings60-78
Memory Policy Page60-79
Secure Device Provisioning on Cisco IOS Routers60-81
Contents of Bootstrap Configuration60-82
Secure Device Provisioning Workflow60-82
Defining Secure Device Provisioning Policies60-83
Configuring a AAA Server Group for Administrative Introducers60-84
Adding and Editing NetFlow Interface Settings62-15
CHAPTER
63Configuring Quality of Service63-1
Quality of Service on Cisco IOS Routers63-1
Quality of Service and CEF63-2
Understanding Matching Parameters63-2
Understanding Marking Parameters63-3
Understanding Queuing Parameters63-4
Tail Drop vs. WRED63-4
Low-Latency Queuing63-5
Default Class Queuing63-6
Understanding Policing and Shaping Parameters63-6
Understanding the Token-Bucket Mechanism63-7
Understanding Control Plane Policing63-9
Defining QoS Policies63-10
Defining QoS on Interfaces63-10
Defining QoS on the Control Plane63-12
Defining QoS Class Matching Parameters63-13
Defining QoS Class Marking Parameters63-15
Defining QoS Class Queuing Parameters63-16
Defining QoS Class Policing Parameters63-17
Defining QoS Class Shaping Parameters63-18
CHAPTER
xlviii
Quality of Service Policy Page63-19
QoS Policy Dialog Box63-21
QoS Class Dialog Box63-23
QoS Class Dialog Box—Matching Tab63-24
Edit ACLs Dialog Box—QoS Classes63-25
QoS Class Dialog Box—Marking Tab63-26
QoS Class Dialog Box—Queuing and Congestion Avoidance Tab63-27
QoS Class Dialog Box—Policing Tab63-29
QoS Class Dialog Box—Shaping Tab63-31
64Configuring Routing Policies64-1
BGP Routing on Cisco IOS Routers64-1
Defining BGP Routes64-2
Redistributing Routes into BGP64-3
65Managing Cisco Catalyst Switches and Cisco 7600 Series Routers65-1
Discovering Policies on Cisco Catalyst Switches and Cisco 7600 Series Routers65-1
Viewing Catalyst Summary Information65-2
Viewing a Summary of Catalyst Interfaces, VLANs, and VLAN Groups65-3
Interfaces65-5
Creating or Editing Ports on Cisco Catalyst Switches and Cisco 7600 Series Routers65-5
Deleting Ports on Cisco Catalyst Switches and Cisco 7600 Series Routers65-7
Interfaces/VLANs Page—Interfaces Tab65-7
Create and Edit Interface Dialog Boxes—Access Port Mode65-9
Create and Edit Interface Dialog Boxes—Routed Port Mode65-12
Create and Edit Interface Dialog Boxes—Trunk Port Mode65-14
Create and Edit Interface Dialog Boxes—Dynamic Mode65-18
Create and Edit Interface Dialog Boxes—Subinterfaces65-22
Create and Edit Interface Dialog Boxes—Unsupported Mode65-24
VLANs65-25
Creating or Editing VLANs65-26
Deleting VLANs65-27
Interfaces/VLANs Page—VLANs Tab65-27
Create and Edit VLAN Dialog Boxes65-28
Access Port Selector Dialog Box65-30
Trunk Port Selector Dialog Box65-31
User Guide for Cisco Security Manager 4.4
l
OL-28826-01
Page 51
VLAN Groups65-31
Creating or Editing VLAN Groups65-32
Deleting VLAN Groups65-33
Interfaces/VLANs Page—VLAN Groups Tab65-33
Create and Edit VLAN Group Dialog Boxes65-34
Service Module Slot Selector Dialog Box65-35
VLAN Selector Dialog Box65-36
VLAN ACLs (VACLs)65-36
Creating or Editing VACLs65-37
Deleting VACLs65-39
VLAN Access Lists Page65-39
Create and Edit VLAN ACL Dialog Boxes65-41
Create and Edit VLAN ACL Content Dialog Boxes65-42
IDSM Settings65-44
Creating or Editing EtherChannel VLAN Definitions65-45
Deleting EtherChannel VLAN Definitions65-46
Creating or Editing Data Port VLAN Definitions65-46
Deleting Data Port VLAN Definitions65-48
IDSM Settings Page65-48
Create and Edit IDSM EtherChannel VLANs Dialog Boxes65-49
Create and Edit IDSM Data Port VLANs Dialog Boxes65-50
Contents
CHAPTER
66Viewing Events66-1
Introduction to Event Viewer Capabilities66-1
Historical View66-2
Real-Time View66-2
Views and Filters66-3
Policy Navigation66-3
Understanding Event Viewer Access Control66-3
Scope and Limits of Event Viewer66-4
Deeply Parsed Syslogs66-6
Event Table Toolbar66-14
Columns in Event Table66-16
Time Slider66-23
OL-28826-01
User Guide for Cisco Security Manager 4.4
li
Page 52
Contents
Event Details Pane66-24
Preparing for Event Management66-24
Ensuring Time Synchronization66-25
Configuring ASA and FWSM Devices for Event Management66-25
Configuring IPS Devices for Event Management66-26
Managing the Event Manager Service66-27
Starting, Stopping, and Configuring the Event Manager Service66-27
Monitoring the Event Manager Service66-28
Selecting Devices to Monitor66-31
Monitoring Event Data Store Disk Space Usage66-31
Archiving or Backing Up and Restoring the Event Data Store66-32
Using Event Viewer66-33
Using Event Views66-33
Opening Views66-34
Floating and Arranging Views66-34
Customizing the Event Table Appearance66-35
Switching Between Source/Destination IP Addresses and Host Object Names66-36
Configuring Color Rules for a View66-36
Creating Custom Views66-37
Editing a Custom View Name or Description66-38
Switching Between Real-Time and Historical Views66-38
Saving Views66-38
Deleting Custom Views66-39
Filtering and Querying Events66-39
Selecting the Time Range for Events66-39
Using the Time Slider with Filtering66-40
Refreshing the Event Table66-40
Creating Column-Based Filters66-41
Filtering Based on a Specific Event’s Values66-43
Filtering on a Text String66-44
Clearing Filters66-44
Performing Operations on Specific Events66-45
Event Context (Right-Click) Menu66-45
Examining Details of a Single Event66-47
Copying Event Records66-48
Saving Events to a File66-48
Looking Up a Security Manager Policy from Event Viewer66-48
lii
Examples of Event Analysis66-50
Help Desk: User Access To a Server Is Blocked By the Firewall66-50
User Guide for Cisco Security Manager 4.4
OL-28826-01
Page 53
Monitoring and Mitigating Botnet Activity66-52
Understanding the Syslog Messages That Indicate Actionable Events66-53
Monitoring Botnet Using the Security Manager Event Viewer66-53
Monitoring Botnet Using the Security Manager Report Manager66-55
Monitoring Botnet Activity Using the Adaptive Security Device Manager (ASDM)66-56
Mitigating Botnet Traffic66-56
Removing False Positive IPS Events from the Event Table66-58
Contents
CHAPTER
67Managing Reports67-1
Understanding Report Management67-1
Understanding the Types of Reports Available in Security Manager67-2
Preparing Devices for Report Manager Reporting67-3
Understanding Report Manager Data Aggregation67-4
Understanding Report Manager Access Control67-5
Overview of Report Manager67-6
Report Manager Menus67-8
Understanding the Report List in Report Manager67-9
Understanding the Report Settings Pane67-10
Understanding the Generated Report Pane and Toolbar67-11
Understanding the Predefined System Reports in Report Manager67-13
Understanding Firewall Traffic Reports67-13
Understanding Firewall Summary Botnet Reports67-14
Understanding VPN Top Reports67-15
Understanding General VPN Reports67-16
Understanding IPS Top Reports67-16
Understanding General IPS Reports67-17
Trend Information 68-2
Monitoring Multiple Contexts 68-3
HPM Access Control68-3
Preparing for Health and Performance Monitoring 68-4
Launching the Health and Performance Monitor 68-4
Managing Monitored Devices 68-5
HPM Window 68-6
Working with Table Columns68-8
Showing and Hiding Table Columns 68-8
Column-based Filtering 68-15
Using The List Filter Fields 68-17
Monitoring Devices 68-19
Managing Device Views 68-19
Views: Opening and Closing 68-21
Views: Tiling Horizontally or Vertically 68-21
Views: Floating and Docking 68-22
Views: Custom 68-22
HPM Window: Monitoring Display 68-23
Monitoring Views: Devices or VPNs Summary 68-25
Monitoring Views: Device or VPN Status List68-25
Monitoring Views: Device or VPN Details 68-26
Monitoring Views: VPN, RA and S2S 68-27
Exporting HPM Data 68-27
69Using External Monitoring, Troubleshooting, and Diagnostic Tools69-1
Viewing Inventory Status69-1
Inventory Status Window69-2
Starting Device Managers69-4
Troubleshooting Device Managers69-5
Access Rule Look-up from Device Managers69-6
Navigating to an Access Rule from ASDM69-7
Navigating to an Access Rule from SDM69-8
Launching Cisco Prime Security Manager 69-9
Detecting ASA CX Modules 69-10
Sharing Device Inventory and Policy Objects with PRSM 69-11
Analyzing an ASA or PIX Configuration Using Packet Tracer69-12
Analyzing Connectivity Issues Using the Ping, Trace Route, or NS Lookup Tools69-14
Analyzing Configuration Using Ping69-15
Analyzing Configuration Using TraceRoute69-17
Analyzing Configuration Using NS Lookup69-18
Using the Packet Capture Wizard69-18
Integrating CS-MARS and Security Manager69-22
Checklist for Integrating CS-MARS with Security Manager69-23
Configuring the Security Manager Server to Respond to CS-MARS Policy Queries69-24
Registering CS-MARS Servers in Security Manager69-24
Discovering or Changing the CS-MARS Controllers for a Device69-25
Troubleshooting Tips for CS-MARS Querying69-26
Looking Up CS-MARS Events for a Security Manager Policy69-27
Viewing CS-MARS Events for an Access Rule69-28
Viewing CS-MARS Events for an IPS Signature69-30
Looking Up a Security Manager Policy from a CS-MARS Event69-31
System Log Messages Supported for Policy Look-up69-32
NetFlow Event Reporting in CS-MARS69-33
CHAPTER
OL-28826-01
70Using Image Manager70-1
Getting Started with Image Manager70-1
Image Manager Supported Platforms and Versions70-2
Device Configurations supported by Image Manager70-2
Image Manager Supported Image Types70-3
User Guide for Cisco Security Manager 4.4
lv
Page 56
Contents
Administrative Settings for Image Manager70-4
Bootstrapping Devices for Image Manager70-6
Working with Images70-8
View All Images70-8
Download Images to the Repository70-10
Working with Bundles70-11
Creating Bundles70-12
View Images by Bundle70-13
Renaming Bundles70-13
Deleting Bundles70-13
Deleting Images from Bundles70-14
Working with Devices70-14
Viewing Device Inventory70-14
Manage Images on a Device70-15
View Device Memory70-17
Configuring the Image Install Location70-17
I
NDEX
About Image Updates on Devices Using Image Manager70-18
Validating a Proposed Image Update on a Device 70-20
Using the Image Installation Wizard to Install Images on Devices70-23
Install Bundled Images on Devices 70-27
Install Compatible Images on Devices70-28
Install Images on Selected Devices70-29
Working with Jobs70-30
Viewing Image Installation Job Summary70-30
Viewing Install Jobs70-31
Aborting an Image Installation Job70-32
Retry a Failed Image Install Job70-32
Roll Back a Deployed Job70-33
Image Installation Job Approval Workflow70-33
Troubleshooting Image Management70-34
lvi
User Guide for Cisco Security Manager 4.4
OL-28826-01
Page 57
Preface
Conventions
This document uses the following conventions:
ItemConvention
Commands, keywords, special terminology, and options that should
be selected during procedures
Variables for which you supply values and new or important
terminology
Displayed session and system information, paths and file names
Information you enterboldface screen font
Variables you enteritalic screen font
Menu items and button namesboldface font
Indicates menu items to select, in the order you select them.Option > Network Preferences
boldface font
italic font
screen font
OL-28826-01
TipIdentifies information to help you get the most benefit from your product.
NoteMeans reader take note. Notes identify important information that you should reflect upon before
continuing, contain helpful suggestions, or provide references to materials not contained in the
document.
CautionMeans reader be careful. In this situation, you might do something that could result in equipment
damage, loss of data, or a potential breach in your network security.
Warning
Identifies information that you must heed to prevent damaging yourself, the state of software, or
equipment. Warnings identify definite security breaches that will result if the information presented
is not followed carefully.
User Guide for Cisco Security Manager 4.4
lvii
Page 58
Obtaining Documentation, Obtaining Support, and Security
Guidelines
For information on obtaining documentation, obtaining support, providing documentation feedback,
security guidelines, and also recommended aliases and general Cisco documents, see the monthly What’s
New in Cisco Product Documentation, which also lists all new and revised Cisco technical
documentation, at:
Subscribe to the What’s New in Cisco Product Documentation as a Really Simple Syndication (RSS)
feed and set content to be delivered directly to your desktop using a reader application. The RSS feeds
are a free service and Cisco currently supports RSS Version 2.0.
Preface
lviii
User Guide for Cisco Security Manager 4.4
OL-28826-01
Page 59
P
ART
1
The Basics of Using Security Manager
Page 60
Page 61
Getting Started with Security Manager
The following topics describe Cisco Security Manager, how to get started with the application, and how
to complete its configuration.
• Product Overview, page 1-1
• Logging In to and Exiting Security Manager, page 1-9
• Using Configuration Manager - Overview, page 1-12
• Using the JumpStart to Learn About Security Manager, page 1-22
• Completing the Initial Security Manager Configuration, page 1-23
Cisco Security Manager (Security Manager) enables you to manage security policies on Cisco security
devices. Security Manager supports integrated provisioning of firewall, IPS, and VPN (site-to-site,
remote access, and SSL) services across:
• ASA and PIX security appliances.
• IPS appliances and various service modules for routers and ASA devices.
• IOS routers.
• Catalyst switches.
• Catalyst services modules related to firewall, VPN, and IPS.
NoteFor a complete list of devices and OS versions supported by Security Manager, please refer to Supported
Devices and Software Versions for Cisco Security Manager on Cisco.com.
Security Manager also supports provisioning of many platform-specific settings, for example, interfaces,
routing, identity, QoS, logging, and so on.
Security Manager efficiently manages a wide range of networks, from small networks consisting of a
few devices to large networks with thousands of devices. Scalability is achieved through a rich feature
set of shareable objects and policies and device grouping capabilities.
Security Manager supports multiple configuration views optimized around different task flows and use
cases.
OL-28826-01
User Guide for Cisco Security Manager 4.4
1-1
Page 62
Product Overview
The following topics provide an overview of Security Manager:
• Primary Benefits of Cisco Security Manager, page 1-2
These are the primary benefits of working with Security Manager:
• Scalable network management—Centrally administer security policies and device settings for
either small networks or large scale networks consisting of thousands of devices. Define policies and
settings once and then optionally assign them to individual devices, groups of devices or all the
devices in the enterprise.
• Provisioning of multiple security technologies across different platforms—Manage VPN,
firewall, and IPS technologies on routers, security appliances, Catalyst devices and service modules,
and IPS devices.
Chapter 1 Getting Started with Security Manager
• Provisioning of platform-specific settings and policies—Manage platform-specific settings on
specific device types. For example: routing, 802.1x, EzSDD, and Network Admission Control on
routers, and device access security, DHCP, AAA, and multicast on firewall devices.
• VPN wizards—Quickly and easily configure point-to-point, hub-and-spoke, full-mesh, and
Extranet site-to-site VPNs across different VPN device types. Quickly and easily configure remote
access IPsec and SSL VPNs on ASA, IOS, and PIX devices.
• Multiple management views—Device, policy, and map views enable you to manage your security
VPN parameters, and so on, then use them instead of manually entering values.
• Device grouping capabilities—Create device groups to represent your organizational structure.
Manage all devices in the groups concurrently.
• Policy inheritance—Centrally specify which policies are mandatory and enforced lower in the
organization.
• Role-based administration—Enable appropriate access controls for different operators.
• Workflow—Optionally allow division of responsibility and workload between network operators
and security operators and provide a change management approval and tracking mechanism.
• Ticket Management—Associate a ticket ID with policy changes, easily add and update comments
pertaining to those changes, and quickly navigate to an external change management system from
Security Manager.
• Single, consistent user interface for managing common firewall features—Single rule table for
all platforms (router, PIX, ASA, and FWSM).
• Image management—Complete image management for ASA devices. Facilitates at every stage of
image upgrade of devices by: downloading and maintaining image repository, evaluating images,
analyzing impact of upgrades, preparing and planning reliable and stable device upgrades, and
ensuring sufficient fallback and recovery mechanisms.
1-2
User Guide for Cisco Security Manager 4.4
OL-28826-01
Page 63
Chapter 1 Getting Started with Security Manager
• Intelligent analysis of firewall policies—The conflict detection feature analyzes and reports rules
that overlap or conflict with other rules. The ACL hit count feature checks in real-time whether
specific rules are being hit or triggered by packets.
• Sophisticated rule table editing—In-line editing, ability to cut, copy, and paste rules and to change
their order in the rule table.
• Discover firewall policies from device—Policies that exist on the device can be imported into
Security Manager for future management.
• Flexible deployment options—Support for deployment of configurations directly to a device or to
a configuration file. You can also use Auto-Update Server (AUS), Configuration Engine, or Token
Management Server (TMS) for deployment.
• Rollback—Ability to roll back to a previous configuration if necessary.
• FlexConfig (template manager)—Intelligent CLI configlet editor to manage features available on
a device but not natively supported by Security Manager.
• Integrated device monitoring and reporting—Features for monitoring events on IPS, ASA, and
FWSM devices and correlating them to the related configuration policies, and for creating security
and usage reports. These features include the following stand-alone Security Manager applications:
–
Event Viewer—Event Viewer monitors your network for system log (syslog) events from ASA
and FWSM devices, as well as security contexts and SDEE events from IPS devices and virtual
sensors. Event Viewer collects these events and provides an interface by which you can view
them, group them, and examine their details in near real time.
Product Overview
–
Report Manager—Report Manager lets you collect, display and export a wide variety of
network usage and security information for ASA and IPS devices, and for ASA-hosted
remote-access IPsec and SSL VPNs. These reports aggregate security data such as top sources,
destinations, attackers, victims, as well as security information such as top bandwidth, duration,
and throughput users. Data is available for hourly, daily, and monthly periods. (Report Manager
aggregates information collected from devices monitored by the Event Manager service. Thus,
to view reports about a device, you must be monitoring that device in Event Viewer.)
NoteReport Manager does not report FWSM events even though Event Viewer works with
FWSM.
–
Health and Performance Monitor—Health and Performance Monitor (HPM) periodically
polls monitored ASA devices, IPS devices, and ASA-hosted VPN services for key health and
performance data, including critical and non-critical issues, such as memory usage, interface
status, dropped packets, tunnel status, and so on. This information is used for alert generation
and email notification, and to display trends based on aggregated data, which is available for
hourly, daily, and weekly periods.
NoteHealth and Performance Monitor does not monitor FWSM devices.
Additional features let you monitor devices from Security Manager using other closely related
applications, including Cisco Security Monitoring, Analysis and Response System (CS-MARS),
Cisco Performance Monitor, and device managers such as ASDM (read-only versions of which are
included with Security Manager).
OL-28826-01
User Guide for Cisco Security Manager 4.4
1-3
Page 64
Product Overview
Security Manager Policy Feature Sets
Security Manager provides the following primary feature sets for configuration policies:
• Firewall Services
Configuration and management of firewall policies across multiple platforms, including IOS
routers, ASA/PIX devices, and Catalyst Firewall Service Modules (FWSMs). Features include:
–
Access control rules—Permit or deny traffic on interfaces through the use of access control lists
for both IPv4 and IPv6 traffic.
–
Botnet Traffic Filter rules—(ASA only.) Filter traffic based on known malware sites and
optionally drop traffic based on threat level.
–
Inspection rules—Filter TCP and UDP packets based on application-layer protocol session
information.
–
AAA/Authentication Proxy rules—Filter traffic based on authentication and authorization for
users who log into the network or access the Internet through HTTP, HTTPS, FTP, or Telnet
sessions.
–
Web filtering rules—Use URL filtering software, such as Websense, to deny access to specific
web sites.
–
ScanSafe Web Security—(Routers only.) Redirect HTTP/HTTPS traffic to the ScanSafe web
security center for content scanning and malware protection services.
–
Transparent firewall rules—Filter layer-2 traffic on transparent or bridged interfaces.
Chapter 1 Getting Started with Security Manager
–
Zone-based firewall rules—Configure access, inspection, and web filtering rules based on zones
rather than on individual interfaces.
For more information, see Chapter 12, “Introduction to Firewall Services”.
• Site-to-Site VPN
Setup and configuration of IPsec site-to-site VPNs. Multiple device types can participate in a single
VPN, including IOS routers, PIX/ASA devices, and Catalyst VPN Service Modules. Supported VPN
topologies are:
–
Point to point
–
Hub and spoke
–
Full mesh
–
Extranet (a point-to-point connection to an unmanaged device)
Supported IPsec technologies are:
–
Regular IPsec
–
GRE
–
GRE Dynamic IP
–
DMVPN
–
Easy VPN
–
GET VPN
For more information, see Chapter 24, “Managing Site-to-Site VPNs: The Basics”.
• Remote Access VPN
1-4
User Guide for Cisco Security Manager 4.4
OL-28826-01
Page 65
Chapter 1 Getting Started with Security Manager
Setup and configuration of IPsec and SSL VPNs between servers and mobile remote workstations
running Cisco VPN client or AnyConnect client software. For more information, see Chapter 29,
“Managing Remote Access VPNs: The Basics”.
• Intrusion Prevention System (IPS) Management
Management and configuration of Cisco IPS sensors (appliances and service modules) and IOS IPS
devices (Cisco IOS routers with IPS-enabled images and Cisco Integrated Services Routers).
For more information, see Overview of IPS Configuration, page 35-5 and Overview of Cisco IOS
IPS Configuration, page 44-3.
• Features Specific to Firewall Devices (PIX/ASA/FWSM)
Configuration of advanced platform-specific features and settings on PIX/ASA devices and Catalyst
FWSMs. These features provide added value when managing security profiles and include:
–
Interface configuration
–
Identity-aware firewall settings
–
Device administration settings
–
Security
–
Routing
Product Overview
–
Multicast
–
Logging
–
NAT
–
Bridging
–
Failover
–
Security contexts
For more information, see Chapter 45, “Managing Firewall Devices”.
• Features Specific to IOS Routers
Configuration of advanced platform-specific features and settings on IOS routers. These features
provide added value when managing security profiles and include:
–
Interface configuration
–
Routing
–
NAT
–
802.1x
–
NAC
–
QoS
–
Dialer interfaces
–
Secure device provisioning
OL-28826-01
For more information, see Chapter 58, “Managing Routers”.
• Features Specific to Catalyst 6500/7600 Devices and Catalyst Switches
Configuration of VLAN, network connectivity, and service module features and settings on Catalyst
6500/7600 devices and on other Catalyst switches.
For more information, Chapter 65, “Managing Cisco Catalyst Switches and Cisco 7600 Series
Routers”.
User Guide for Cisco Security Manager 4.4
1-5
Page 66
Product Overview
• FlexConfigs
Flexconfig policies and policy objects enable you to provision features that are available on the
device but not natively supported by Security Manager. They enable you to manually specify a set
of CLI commands and to deploy them to devices using Security Manager’s provisioning
mechanisms. These commands can be either prepended or appended to the commands generated by
Security Manager to provision security policies.
For more information, see Chapter 7, “Managing FlexConfigs”.
Security Manager Applications Overview
The Security Manager client includes five main applications:
• Configuration Manager—This is the primary application. You use Configuration Manager to
manage the device inventory, create and edit local and shared policies, manage VPN configurations,
and deploy policies to devices. Configuration Manager is the largest of the applications and most of
the documentation addresses this application. If a procedure does not specifically mention an
application, the procedure is using Configuration Manager. For an introduction to Configuration
Manager, see Using Configuration Manager - Overview, page 1-12.
• Event Viewer—This is an event monitoring application, where you can view and analyze events
generated from IPS, ASA, and FWSM devices that you have configured to send events to Security
Manager. For information about using Event Viewer, see Chapter 66, “Viewing Events”.
Chapter 1 Getting Started with Security Manager
• Report Manager—This is a reporting application, where you can view and create reports of
aggregated information on device and VPN statistics. Much of the information is derived from
events available through Event Viewer, but some of the VPN statistics are obtained by
communicating directly with the device. For information about using Report Manager, see
Chapter 67, “Managing Reports”.
• Health & Performance Monitor—The HPM application lets you monitor key health and
performance data for ASA (including ASA-SM) devices, IPS devices, and VPN services by
providing network-level visibility into device status and traffic information. This ability to monitor
key network and device metrics lets you quickly detect and resolve device malfunctions and
bottlenecks in the network. See Chapter 68, “Health and Performance Monitor Overview” for more
information about this application.
devices. It facilitates downloading, evaluating, analyzing, preparing, and planning image updates. It
assesses image availability, compatibility, and impact on devices and provides scheduling, grouping,
and change management of device updates. In addition, Image Manager includes capabilities for
maintaining an image repository as well as for ensuring stable fallback and recovery mechanisms
for image updates on ASA devices. For information about using Image Manager, see Chapter 70,
“Using Image Manager”.
You can open any of these applications directly from the Windows Start menu or a desktop icon, or you
can open them from within any of these applications through the application’s Launch menu. For
information on opening applications, see Logging In to and Exiting the Security Manager Client,
page 1-11.
Device Monitoring Overview
Security Manager includes several facilities for monitoring devices:
User Guide for Cisco Security Manager 4.4
1-6
OL-28826-01
Page 67
Chapter 1 Getting Started with Security Manager
• Event Viewer—This integrated tool allows you to view events on ASA, FWSM, and IPS devices
and correlate them to the related configuration policies. This helps you identify problems,
troubleshoot configurations, and then fix the configurations and redeploy them. For more
information, see Chapter 66, “Viewing Events”.
• Report Manager—This is a reporting application, where you can view and create reports of
aggregated information on device and VPN statistics. Much of the information is derived from
events available through Event Viewer, but some of the VPN statistics are obtained by
communicating directly with the device. For information about using Report Manager, see
Chapter 67, “Managing Reports”.
For information on all of the types of reports available in Security Manager, see Understanding the
Types of Reports Available in Security Manager, page 67-2.
• Health & Performance Monitor—The HPM application lets you monitor key health and
performance data for ASA (including ASA-SM) devices, IPS devices, and VPN services by
providing network-level visibility into device status and traffic information. See Chapter 68,
“Health and Performance Monitoring” for more information about this application.
• Packet Tracer—You can use this tool to test whether certain types of packets will be allowed to go
through an ASA device. For more information, see Analyzing an ASA or PIX Configuration Using
Packet Tracer, page 69-12.
Product Overview
• Ping, Trace route, and NS Lookup—You can use ping and traceroute on a managed device to
check whether there is a route between the device and a specific destination. You can use NS lookup
to resolve addresses to DNS names. For more information, see Analyzing Connectivity Issues Using
the Ping, Trace Route, or NS Lookup Tools, page 69-14.
• Cisco Prime Security Manager (PRSM) Integration—You can “cross launch” PRSM from the
Configuration Manager application. The PRSM application is used to configure and manage ASA
CX devices. For more information, see Launching Cisco Prime Security Manager, page 69-9.
• Device Manager Integration—Security Manager includes read-only copies of the various device
managers, such as Adaptive Security Device Manager (ASDM). You can use these tools to view
device status, but not to change the device configuration. For more information, see Starting Device
Managers, page 69-4.
• Cisco Security Monitoring, Analysis and Response System (CS-MARS) Integration—If you
use the CS-MARS application, you can integrate it with Security Manager and view events in
CS-MARS from Security Manager, and conversely, Security Manager policies related to events from
CS-MARS. For more information, see Integrating CS-MARS and Security Manager, page 69-22.
IPv6 Support in Security Manager
Security Manager provides increasing support for IPv6 configuration, monitoring, and reporting.
NoteTo manage a device that supports IPv6 addressing with Security Manager, you must configure the
device’s management address as an IPv4 address. All communications between the device and Security
Manager, such as policy discovery and deployment, use IPv4 transport. Also, if the IPv6 policies are not
appearing for a supported device, rediscover the device policies; if necessary, delete the device from the
inventory and add it again.
OL-28826-01
User Guide for Cisco Security Manager 4.4
1-7
Page 68
Product Overview
Chapter 1 Getting Started with Security Manager
In general, you can configure IPv6 policies on the following types of device. In addition, you can
monitor IPv6 alerts generated by IPS, ASA, and FWSM devices. For other types of devices, use
FlexConfig policies to configure IPv6 settings. For more specific information on IPv6 device support,
see the Supported Devices and Software Versions for Cisco Security Manager document on Cisco.com.
• ASA—Release 7.0+ when running in router mode; release 8.2+ when running in transparent mode.
Both single and multiple security context devices are supported.
• FWSM—Release 3.1+ when running in router mode. Not supported in transparent mode. Both
single and multiple security context devices are supported.
• IPS—Release 6.1+.
Following is a summary of the Security Manager features that support IPv6 addressing:
• Policy Objects—The following policy objects support IPv6 addresses:
–
Networks/Hosts. See Understanding Networks/Hosts Objects, page 6-74.
–
Services. This object includes predefined services for ICMP6 and DHCPv6, which you can use
only with IPv6 policies. The other services apply to both IPv4 and IPv6. For more information
on service objects, see Understanding and Specifying Services and Service and Port List
Objects, page 6-86.
• Firewall Services Policies—The following Firewall Services policies and tools support IPv6
configurations:
–
AAA Rules. See Chapter 15, “Managing Firewall AAA Rules”.
–
Access Rules. See Configuring Access Rules, page 16-7.
–
Inspection Rules. See Chapter 17, “Managing Firewall Inspection Rules”.
–
Settings > Access Control. See Configuring Settings for Access Control, page 16-20.
–
Tools:
Hit Count. See Viewing Hit Count Details, page 16-33.
Find and Replace. See Finding and Replacing Items in Rules Tables, page 12-16.
• ASA and FWSM Policies—The following ASA and FWSM policies support IPv6 configurations:
–
(ASA 7.0+ routed mode; ASA 8.2+ transparent mode; FWSM 3.1+ routed mode.) Interfaces:
IPv6 tab of the Add Interface and Edit Interface dialog boxes. See Configuring IPv6 Interfaces
(ASA/FWSM), page 45-29.
–
(ASA only.) Platform > Bridging > IPv6 Neighbor Cache. See Managing the IPv6 Neighbor
(ASA 8.4.2+ only.) Platform > Device Admin > Server Access > DNS. See DNS Page,
page 51-13.
• FlexConfig Policies—There are two Firewall system variables that you can use to identify IPv6
ACLs on a device. For more information, see FlexConfig System Variables, page 7-7.
1-8
There is also a predefined FlexConfig policy object that uses these variables,
ASA_add_IPv6_ACEs.
User Guide for Cisco Security Manager 4.4
OL-28826-01
Page 69
Chapter 1 Getting Started with Security Manager
• Event Viewer—Events that include IPv6 addresses are supported, and the addresses are displayed
in the same columns as IPv4 addresses: Source, Destination, and IPLog Address (for IPS alerts).
However, you must configure the device to use IPv4 for sending events to the Security Manager
server. All event communications use IPv4 transport. For more information on Event Viewer, see
Chapter 66, “Viewing Events”.
• Report Manager—Reports include statistics for IPv6 events collected by Event Management. For
more information on Report Manager, see Chapter 67, “Managing Reports”.
Policy Object Changes in Security Manager 4.4
Certain changes were made to a few policies and policy objects in Security Manager 4.4, in order to unify
previously separate IPv4 and IPv6 elements. The most important of these changes are to the
Networks/Hosts object (which itself represents a unification of the Networks/Hosts and the
Networks/Hosts-IPv6 objects):
• The new Networks/Hosts object “All-IPv4-Addresses” replaces the IPv4 “any” network policy
object. If you upgrade to Security Manager 4.4 from a previous version, all references to the IPv4
“any” network policy object will be changed to “All-IPv4-Addresses.”
• The new Networks/Hosts object “All-IPv6-Addresses” replaces the IPv6 “any” network policy
object. If you upgrade to Security Manager 4.4 from a previous version, all references to the IPv6
“any” network policy object will be changed to “All-IPv6-Addresses.”
Logging In to and Exiting Security Manager
• The new Networks/Hosts object “All-Addresses” does not have a corresponding policy object in
earlier versions of Security Manager. It is a new global “any” policy object, and it encompasses all
IPv4 and IPv6 address ranges.
Other related changes include unification of IPv4 and IPv6 versions of device-specific policies such as
Access Rules, Inspection Rules, and so on.
Further, when editing policies and objects, IPv4, IPv6, or mixed-mode (both IPv4 and IPv6) entries are
automatically filtered in elements, such as dialog boxes, in which one or more of those entries is not
appropriate to that element.
Related Topics
• Policy Object Manager, page 6-4
• Understanding Networks/Hosts Objects, page 6-74
Logging In to and Exiting Security Manager
Security Manager has two main interfaces:
• Cisco Security Management Suite home page—Use this interface to install the Security Manager
client and to manage the server. You can also access other CiscoWorks applications you installed,
such as Resource Manager Essentials (RME).
• Security Manager clients—Use these interfaces to perform most Security Manager tasks. You can
log directly into any of five client applications: Configuration Manager, Event Viewer, Report
Manager, Health & Performance Monitor, and Image Manager.
OL-28826-01
These topics describe how to log in to and exit these interfaces:
• Understanding User Permissions, page 1-10
• Logging In to the Cisco Security Management Suite Server, page 1-10
User Guide for Cisco Security Manager 4.4
1-9
Page 70
Logging In to and Exiting Security Manager
• Logging In to and Exiting the Security Manager Client, page 1-11
Understanding User Permissions
Cisco Security Manager authenticates your username and password before you can log in. After you are
authenticated, Security Manager establishes your role within the application. This role defines your
permissions (also called privileges), which are the set of tasks or operations that you are authorized to
perform. If you are not authorized for certain tasks or devices, the related menu items, items in tables of
contents, and buttons are hidden or disabled. In addition, a message tells you that you do not have
permission to view the selected information or perform the selected operation.
Authentication and authorization for Security Manager is managed either by the CiscoWorks server or
the Cisco Secure Access Control Server (ACS). By default, CiscoWorks manages authentication and
authorization, but you can configure Security Manager to use your Cisco Secure ACS setup.
When using ACS, if all of the ACS servers become unavailable, you cannot perform tasks in Security
Manager. If you are logged in, you might be abruptly logged out of the system (without an opportunity
to save changes) if you try to perform a task that requires ACS authorization. If this happens, you get a
message stating this is the reason you are getting logged off.
For more information about user permissions and AAA configuration, see the Installation Guide for
Cisco Security Manager.
For more information about authorization control in the Event Viewer and Report Manager applications,
see the following topics:
Logging In to the Cisco Security Management Suite Server
Use the Cisco Security Management Suite home page, and CiscoWorks Common Services, to install the
Security Manager client and to manage the server. You can also access other CiscoWorks applications
you installed, such as RME.
Step 1In your web browser, open one of these URLs, where SecManServer is the name of the computer where
Security Manager is installed. Click Yes on any Security Alert windows.
• If you are not using SSL, open http://SecManServer:1741
• If you are using SSL, open https://SecManServer:443
The Cisco Security Management Suite login screen is displayed. Verify on the page that JavaScript and
cookies are enabled and that you are running a supported version of the web browser. For information
on configuring the browser to run Security Manager, see Installation Guide for Cisco Security Manager.
Step 2Log in to the Cisco Security Management Suite server with your username and password. When you
initially install the server, you can log in using the username admin and the password defined during
product installation.
Step 3On the Cisco Security Management Suite home page, you can access at least the following features.
Other features might be available depending on how you installed the product.
• Cisco Security Manager Client Installer—Click this item to install the Security Manager client. The
client is the main interface for using the product.
1-10
User Guide for Cisco Security Manager 4.4
OL-28826-01
Page 71
Chapter 1 Getting Started with Security Manager
• Server Administration—Click this item to open the CiscoWorks Common Services Server page.
CiscoWorks Common Services is the foundation software that manages the server. Use it to
configure and manage back-end server features such as server maintenance and troubleshooting,
local user definition, and so on.
• CiscoWorks link (in the upper right of the page)—Click this link to open the CiscoWorks Common
Services home page.
Step 4To exit the application, click Logout in the upper right corner of the screen. If you have both the home
page and the Security Manager client open at the same time, exiting the browser connection does not exit
the Security Manager client.
Logging In to and Exiting the Security Manager Client
Use the Security Manager client to perform most Security Manager tasks.
TipYou must log into the workstation using a Windows user account that has Administrator privileges to
fully use the Security Manager client applications. If you try to operate the applications with lesser
privileges, you might find that some features do not work correctly.
Logging In to and Exiting Security Manager
Before You Begin
Install the client on your computer. To install the client, log into the Security Manager server as
described in Logging In to the Cisco Security Management Suite Server, page 1-10, and then click Cisco Security Manager Client Installer and follow the instructions in the installation wizard.
Step 1Select one of the following applications from the Start > All Programs > Cisco Security Manager
Client menu:
• Configuration Manager
• Event Viewer
• Report Manager
• Health & Performance Monitor
• Image Manager
TipIf the client was installed on the workstation, but it does not appear in your Start menu, it
probably was installed by another user. To make Security Manager Client visible in the Start
menu for every user of the client station, copy the Cisco Security Manager Client folder from
Documents and Settings\<user>\Start Menu\Programs\Cisco Security Manager to Documents
and Settings\All Users\Start Menu\Programs\Cisco Security Manager.
Step 2In the application’s login window, select the server to which you want to log in, and enter your Security
Manager username and password. Click Login.
OL-28826-01
The client logs in to the server and opens the application you selected based on the following conditions.
Note that these conditions are per application, for example, if you have Configuration Manager open on
one workstation, opening Event Viewer from a different workstation has no implications for your
Configuration Manager session unless or until you start Configuration Manager from Event Viewer.
User Guide for Cisco Security Manager 4.4
1-11
Page 72
Using Configuration Manager - Overview
• In both Workflow and non-Workflow mode, you cannot log into the same server from a single
workstation and have more than one active session using the same user account. You are reminded
that you are already logged in and asked to reuse the existing open application.
• In both workflow modes, you can log into different servers using the same (or different) user name
from the same workstation.
• In non-Workflow mode, for a given server, if the user name is logged in on a different workstation,
the client on the other workstation is automatically logged out, and any unsaved changes are lost.
Thus, do not share user accounts, and if you must log in from different workstations to the same
server, be sure to save your changes before leaving an active client.
• In Workflow mode, you can log in using the same user account multiple times but only from
different workstations. However, you cannot open the same activity in Configuration Manager at the
same time in more than one client; you must open different activities. Activities do not apply when
using Event Viewer or Report Manager.
TipThe client automatically closes if it is idle for 120 minutes. To change the idle timeout, in
Configuration Manager, select Tools > Security Manager Administration, select Customize
Desktop from the table of contents, and enter the desired timeout period. You can also disable
the feature so that the client does not close automatically. All applications use the same timeout
setting, and working in one application resets the timer for all other applications.
Chapter 1 Getting Started with Security Manager
Step 3To exit the application, select File > Exit.
Using Configuration Manager - Overview
These topics provide an overview of the different views in which you can work in Configuration
Manager, the basic task flow for defining and deploying policies to devices, and some basic concepts:
• Configuration Manager Overview, page 1-12
• Task Flow for Configuring Security Policies, page 1-17
• Policy and Policy Object Overview, page 1-18
• Workflow and Activities Overview, page 1-18
Configuration Manager Overview
The Configuration Manager application provides three views in which you can manage devices and
policies: Device view, Policy view, and Map view. You can switch between these views according to your
needs using toolbar buttons or the View menu.
• Device view—Provides a device-centric view, where you configure policies on specific devices. For
more information, see Device View Overview, page 1-13.
1-12
• Policy view—Provides a policy-centric view, where you can create device-independent shared
policies that you can assign to one or more devices. For more information, see Policy View
Overview, page 1-14.
User Guide for Cisco Security Manager 4.4
OL-28826-01
Page 73
Chapter 1 Getting Started with Security Manager
• Map view—Provides a visual representation of your network, which is primarily useful for
visualizing and configuring site-to-site VPNs. For more information, see Map View Overview,
page 1-16.
Each view presents a different way to access Configuration Manager functionality. What you can do, and
how you do it, are determined by the view you select. In the Device and Policy views you see two
selectors on the left and a work area on the right. In each of these, your selection in the upper selector
determines what you can select in the lower selector. Your selection in the lower selector determines
what you view in the work area. This design enables you to quickly and easily drill down to the network
details that you want to view or edit.
Besides the main views, there are several additional tools used for configuring other items such as
site-to-site VPNs and policy objects, or for monitoring devices. These tools are typically available from
the Manage menu, although some are available on the Policy, Activities, Tools, or Launch menus. Some
tools have related buttons in the toolbar. These tools open in a separate window so that you do not loose
your place in the main view that you are currently using.
The following topics provide reference information about the basic features of the user interface:
• Menu Bar Reference for Configuration Manager, page 1-27
Device view in Configuration Manager enables you to add devices to the Security Manager inventory
and to centrally manage device policies, properties, interfaces, and so on. The following figure identifies
the functional areas of the Device view.
This is a device-centric view in which you can see all devices that you are managing and you can select
specific devices to view their properties and define their settings and policies.
NoteSecurity Manager also provides the ability to see the status of the devices in the Security Manager
inventory. To access the Device Status View, select View > Device Status View or select one of the
folder nodes in the Device selector. For more information, see Working with Device Status View,
page 3-61.
In Device View, you can define security policies locally on specific devices. You can then share these
policies to make them globally available to be assigned to other devices.
For more information, see Understanding the Device View, page 3-1.
OL-28826-01
User Guide for Cisco Security Manager 4.4
1-13
Page 74
Using Configuration Manager - Overview
Figure 1-1Device View Overview
Chapter 1 Getting Started with Security Manager
1
3
5
The title bar displays the following information about Security Manager:
• Your login name.
• The name of the Security Manager server to which you are connected.
• If Workflow mode is enabled, the name of the open activity.
Policy View Overview
Policy view in Configuration Manager enables you to create and manage reusable policies that can be
shared among multiple devices. The following figure identifies the functional areas of the Policy view.
User Guide for Cisco Security Manager 4.4
1-14
Title bar
Toolbar (see Toolbar Reference
(Configuration Manager), page 1-36)
Policy selector
2
Menu bar (see Menu Bar Reference for
Configuration Manager, page 1-27)
4
6
Work area
Device selector (see Using Selectors,
page 1-42)
OL-28826-01
Page 75
Chapter 1 Getting Started with Security Manager
This is a policy-centric view in which you can see all the shareable policy types supported by Security
Manager. You can select a specific policy type and create, view, or modify shared policies of that type.
You can also see the devices to which each shared policy is assigned and change the assignments as
required.
For more information, see Managing Shared Policies in Policy View, page 5-47.
Figure 1-2Policy View Overview
Using Configuration Manager - Overview
OL-28826-01
1
Title bar
2
Menu bar (see Menu Bar Reference for
Configuration Manager, page 1-27)
3
Toolbar (see Toolbar Reference
(Configuration Manager), page 1-36)
5
7
Work a r e a
Policy filter
4
Policy type selector (see Using
Selectors, page 1-42)
6
Shared policy selector
User Guide for Cisco Security Manager 4.4
1-15
Page 76
Using Configuration Manager - Overview
Map View Overview
Map view in Configuration Manager enables you to create customized, visual topology maps of your
network, within which you can view connections between your devices and easily configure VPNs and
access control settings. The following figure identifies the functional areas of the Map view.
For more information, see Chapter 34, “Using Map View”.
Figure 1-3Map View Overview
Chapter 1 Getting Started with Security Manager
1-16
1
3
Title bar
Menu bar (see Map Menu
(Configuration Manager), page 1-31)
5
Map toolbar (see Map Toolbar,
page 34-4)
User Guide for Cisco Security Manager 4.4
2
4
Navigation window
Toolbar (see Toolbar Reference
(Configuration Manager), page 1-36)
6
Map
OL-28826-01
Page 77
Chapter 1 Getting Started with Security Manager
Task Flow for Configuring Security Policies
The basic user task flow for configuring security policies on devices involves adding devices to the
Security Manager inventory, defining the policies, and then deploying them to the devices. You perform
these tasks in Configuration Manager. The following briefly describes the steps in a typical user task
flow:
Step 1Prepare devices for management.
Before you can add a device to the Security Manager device inventory and manage it, you must configure
some minimal settings on the device to enable Security Manager to contact it. For more information, see
Chapter 2, “Preparing Devices for Management”.
Step 2Add devices to the Security Manager device inventory.
To manage a device with Security Manager, you must first add it to the Security Manager inventory.
Security Manager provides multiple methods to add devices: from the network (live devices), from an
inventory file exported from another Security Manager server or CiscoWorks Common Services Device
Credential Repository (DCR), or in Cisco Security Monitoring, Analysis and Response System
(CS-MARS) format, or from a device configuration file. You can also add a device that does not yet exist
in the network but which will be deployed in the future, by creating it in Security Manager.
Using Configuration Manager - Overview
When you add a device, you can also discover its interfaces and certain policies that were already
configured on the device. Discovery brings the information into the Security Manager database for
continued management with Security Manager in the future.
For more information, see Chapter 3, “Managing the Device Inventory”.
Step 3Define security policies.
After you have added your devices, you can define the security policies you require. You can use Device
view to define policies on specific devices. You can use Policy view to create and manage reusable
policies that can be shared by any number of devices. When you make a change to a shared policy, the
change is applied to all devices to which that policy is assigned.
To simplify and speed up policy definition, you can use policy objects, which are named, reusable
representations of specific values. You can define an object once and then reference it in multiple
policies instead of having to define the values individually in each policy.
NoteIf you are using Workflow mode, you must create an activity before you start defining policies.
For more information, see Workflow and Activities Overview, page 1-18.
For more information, see these topics:
• Chapter 5, “Managing Policies”
• Chapter 6, “Managing Policy Objects”
Step 4Submit and deploy your policy definitions.
Policy definition is done within your private view. Your definitions are not committed to the database
and cannot be seen by other Security Manager users until you submit them. When you submit your policy
definitions, the system validates their integrity. Errors or warnings are displayed to inform you of any
problems that need to be addressed before the policies can be deployed to the devices.
OL-28826-01
Security Manager generates CLI commands according to your policy definitions and enables you to
quickly and easily deploy them to your devices. You can deploy directly to live devices in the network
(including dynamically addressed devices) through a secure connection, or to files that can be transferred
to your devices at any time.
User Guide for Cisco Security Manager 4.4
1-17
Page 78
Using Configuration Manager - Overview
In non-Workflow mode, submitting and deploying your changes can be done in a single action. In
Workflow mode, you first submit your activity and then you create a deployment job to deploy your
changes.
For more information, see Chapter 8, “Managing Deployment”.
Policy and Policy Object Overview
A policy is a set of rules or parameters that define a particular aspect of network configuration. In
Configuration Manager, you define policies that specify the security functionality you want on your
devices. Security Manager translates your policies into CLI commands that can be deployed to the
relevant devices.
Security Manager enables you to configure local policies and shared policies.
• Local policies are confined to the device on which they are configured; they are automatically
assigned (applied) to the device when you configure them. Unconfigured policies (those whose
default settings you do not change) are not considered to be assigned or configured. To remove a
policy, you unassign it.
Chapter 1 Getting Started with Security Manager
• Shared policies are named, reusable policies that can be assigned to multiple devices at once. Any
changes you make to a shared policy are reflected on all devices to which that policy is assigned, so
you do not have to make the change on each device.
When you add a device to the inventory, you can discover the existing policies configured on the device.
Security Manager translates your device configuration into Security Manager policies, populates the
relevant local policies, and assigns them to the device. Policy discovery ensures that you do not need to
recreate your existing configurations in Security Manager terms. You can also rediscover policies on
devices after you add them to the inventory if you change their configuration through the CLI.
When you create policies, you often have the option to use policy objects, which are reusable definitions
of related sets of values. (Sometimes, you are required to use policy objects.) For example, you can
define a network object called MyNetwork that contains a set of IP addresses in your network. Whenever
you configure a policy requiring these addresses, you can simply refer to the MyNetwork network object
rather than manually entering the addresses each time. Furthermore, you can make changes to policy
objects in a central location and these changes will be reflected in all the policies that reference those
objects.
For more detailed information, see Understanding Policies, page 5-1 and Chapter 6, “Managing Policy
Objects”.
Workflow and Activities Overview
To provide flexible, secure policy management while allowing your organization to implement change
control processes, Security Manager provides three closely-related features in Configuration Manager:
• Workflow/Non-Workflow modes—Configuration Manager provides two modes of operation that
scale to different organizational working environments: Workflow mode and non-Workflow mode
(the default).
1-18
–
Workflow Mode —Workflow mode is for organizations that have division of responsibility
between users who define security policies and those who administer security policies. It
imposes a formal change-tracking and management system by requiring all policy configuration
to be done within the context of an explicitly-created activity. A user can create multiple
User Guide for Cisco Security Manager 4.4
OL-28826-01
Page 79
Chapter 1 Getting Started with Security Manager
activities so that a single activity contains only logically-related policy changes. You can
configure Workflow mode to require a separate approver, so that configuration changes cannot
be made without oversight. After approval, the user defines a separate deployment job to push
the policy changes to the devices. For more information, see Working in Workflow Mode,
page 1-19.
–
Non-Workflow Mode—In non-Workflow mode, you do not explicitly create activities. When
you log in, Configuration Manager creates an activity for you or opens the one you were
previously using if it was not submitted. You can define and save your policies, and then submit
and deploy them in one step. For more information, see Working in Non-Workflow Mode,
page 1-20.
For information on selecting a mode, see Changing Workflow Modes, page 1-26.
• Activities or Configuration Sessions—An activity (in non-Workflow mode, a configuration
session), is essentially a private view of the Security Manager database. In Configuration Manager,
you use activities to control changes made to policies and policy assignments. Adding devices to the
inventory does not involve an activity, however, unless you discover policies that define security
contexts (on multi-context firewall devices) or virtual sensors (on IPS devices). Isolating policy
changes in activities helps prevent “work in progress” from accidentally making it into active device
configurations. For more information about activities and configuration sessions, see Understanding
Activities, page 4-1 and Working with Activities/Tickets, page 4-7.
• Ticket Management—Ticket management allows you to associate a Ticket ID with policy
configuration changes made in Security Manager. Ticket management works in coordination with
activities or configuration sessions depending on whether you have workflow mode enabled or not.
If workflow mode is enabled, you can also enable ticket management so that a Ticket ID can
optionally be associated with a specific activity. If workflow mode is not enabled, using ticket
management makes it so that all changes must be done as part of a ticket and the ticket must be
submitted before those changes can be deployed. In this respect, ticket management with workflow
disabled is very similar to how activities function when workflow is enabled; however, no approval
of submitted tickets is required.
Using Configuration Manager - Overview
For a comparison of the various modes of operation, see Comparing Workflow Modes, page 1-20.
Working in Workflow Mode
Workflow mode is an advanced mode of operation that imposes a formal change-tracking and
change-management system. Workflow mode is suitable for organizations in which there is division of
responsibility among security and network operators for defining policies and deploying those policies
to devices. For example, a security operator might be responsible for defining security policies on
devices, another security operator might be responsible for approving the policy definitions, and a
network operator might be responsible for deploying the resulting configurations to a device. This
separation of responsibility helps maintain the integrity of deployed device configurations.
You can use Workflow mode with or without an approver. When using Workflow mode with an approver,
device management and policy configuration changes performed by one user are reviewed and approved
by another user before being deployed to the relevant devices. When using Workflow mode without an
approver, device and policy configuration changes can be created and approved by a single user, thus
simplifying the change process.
NoteWorkflow mode works in the same manner whether Ticket Management is enabled or not. Enabling
Ticket Management in Workflow mode simply enables the Ticket field for use with Activities. Entering
a ticket ID is not required, but if one is used, the Ticket field can be configured to link to an external
change management system. For more information, see Ticket Management.
OL-28826-01
User Guide for Cisco Security Manager 4.4
1-19
Page 80
Using Configuration Manager - Overview
For information about enabling or disabling Workflow mode or enabling or disabling Ticket
Management, see Changing Workflow Modes, page 1-26.
In Workflow mode:
• A user must create an activity before defining or changing policy configurations in Configuration
Manager. The activity is essentially a proposal to make configuration changes. The changes made
within the activity are applied only after the activity is approved by a user with the appropriate
permissions. An activity can either be submitted to another user for review and approval (Workflow
mode with an activity approver), or it can be approved by the current user (Workflow mode without
an activity approver). For detailed information about the process of creating, submitting, and
approving activities, see Chapter 4, “Managing Activities”.
• After the activity is approved, the configuration changes need to be deployed to the relevant devices.
To do this, a user must create a deployment job. A deployment job defines the devices to which
configurations will be deployed, and the deployment method to be used. A deployment job can either
be submitted to another user for review and approval (Workflow mode with a deployment job
approver), or it can be approved by the current user (Workflow mode without a job approver).
Deployment preferences can be configured with or without job approval. For more information, see
Chapter 8, “Managing Deployment”
Chapter 1 Getting Started with Security Manager
Working in Non-Workflow Mode
Some organizations have no division of responsibility between users when defining and administering
their VPN and firewall policies. These organizations can work in non-Workflow mode. When using
non-Workflow mode, you do not explicitly create activities. When you log in, Configuration Manager
creates an activity for you, also called a configuration session, or opens the activity you were using when
previously logged in (the configuration session is automatically closed when you log out of Security
Manager). This activity is transparent to the user and does not need to be managed in any way. When
you submit your configuration changes to the database, this is equivalent to submitting and approving
the activity in Workflow mode. In addition, when you submit and deploy configuration changes, Security
Manager creates a deployment job for you as well. Like activities, deployment jobs are transparent and
do not need to be managed.
When using non-Workflow mode, multiple users with the same username and password cannot be logged
into Security Manager at the same time. If another user logs in with the same username and password
while you are working, your session will be terminated and you will have to log in again.
Ticket Management in Non-Workflow Mode
If your organization uses a change management system, Security Manager can associate the changes
made to configurations with a ticket ID. Before making any configuration changes, you must open a
ticket and the ticket must be submitted before the changes associated with that ticket are available to be
deployed. Tickets can be opened and closed as needed, and you can discard a ticket if the changes
associated with that ticket are no longer desired. Entering a ticket ID is not required, but if one is used,
the Ticket field can be configured to link to an external change management system. For more
information, see Ticket Management.
Non-Workflow mode with Ticket Management enabled is the default mode for Security Manager. For
information about enabling or disabling Workflow mode or enabling or disabling Ticket Management,
see Changing Workflow Modes, page 1-26.
Comparing Workflow Modes
The following table highlights the differences between the workflow modes.
User Guide for Cisco Security Manager 4.4
1-20
OL-28826-01
Page 81
Chapter 1 Getting Started with Security Manager
NoteWorkflow mode works in the same manner whether Ticket Management is enabled or not. Enabling
Ticket Management in Workflow mode simply enables the Ticket field for use with Activities. Entering
a ticket ID is not required, but if one is used, the Ticket field can be configured to link to an external
change management system. For more information, see Ticket Management.
Table 1-1Comparison Between Workflow Mode and Non-Workflow Mode in Configuration
Manager
Using Configuration Manager - Overview
Question
What is the default
mode for Security
Manager?
How do I know which
mode is currently
selected?
Must I explicitly create
activities to make
configuration changes?
Must I explicitly create
deployment jobs to
deploy configurations to
devices?
How do I deploy my
configuration changes
to the devices?
Non-Workflow Mode
with Ticket
Management Enabled
Non-Workflow Mode
with Ticket
Management DisabledWorkflow Mode
DefaultNot DefaultNot default
Select Tools > Security Manager Administration > Workflow. If the Enable Workflow check box is selected, you are in Workflow mode.
Select Tools > Security Manager Administration > Ticket Management.
If the Enable Ticketing check box is selected, ticket management is
enabled.
You must explicitly
create a Ticket before
you can make
configuration changes.
Configuration Manager
automatically creates an
activity that is
No. Configuration
Manager automatically
creates an activity when
you log in, or opens the
previous session if you
did not submit it before
logging out.
Yes .
associated with that
ticket.
No. Configuration
Manager creates a
deployment job for you
when you deploy
configuration changes.
Do one of the following:
• Select File >
Deploy.
• Select Manage >
Deployments and
click Deploy on the
Deployment Jobs
tab.
No. Configuration
Manager creates a
deployment job for you
when you deploy
configuration changes.
Do one of the following:
• Click the Submit
and Deploy
Changes button in
the Main toolbar.
• Select File >
Submit and
Deploy.
• Select Manage >
Yes .
Select Manage > Deployments and
create a deployment job.
Deployments and
click Deploy on the
Deployment Jobs
tab.
OL-28826-01
User Guide for Cisco Security Manager 4.4
1-21
Page 82
Using the JumpStart to Learn About Security Manager
Table 1-1Comparison Between Workflow Mode and Non-Workflow Mode in Configuration
Manager (Continued)
Chapter 1 Getting Started with Security Manager
Question
At what stage are the
CLI commands for my
configuration changes
generated?
How do I delete my
current changes?
Can multiple users log
into Security Manager
at the same time?
What if another user is
configuring the devices
I want to configure?
Non-Workflow Mode
with Ticket
Management Enabled
When initiating
deployment.
Select Tickets > Discard Ticket to
discard the
currently-open ticket, or
select the ticket in the
Ticket Manager and
click Discard.
If you have already
started deploying
devices, abort the
deployment by selecting
the job in the
Deployment Manager
and clicking Abort.
Yes. Each user can open
a different ticket and
make configuration
changes. A single user
can log in multiple
times, but the user must
open separate tickets.
You will receive a message indicating that the devices are locked. See
Activities and Locking, page 4-3.
Non-Workflow Mode
with Ticket
Management DisabledWorkflow Mode
When initiating
deployment.
Select File > Discard.
If you have already
started deploying
devices, abort the
deployment by selecting
the job in the
Deployment Manager
and clicking Abort.
Yes, but only if each one
has a different
username. If a user with
the same username logs
into Security Manager,
the first user is
automatically logged
out.
When creating a
deployment job.
Select Activities > Discard Activity to
discard the
currently-open activity,
or select the activity in
the Activity Manager
and click Discard.
If you already created a
deployment job, select
the job in the
Deployment Manager
and click Discard. If the
job has already been
deployed, you can abort
the job by selecting
Abort.
Yes. Each user can open
a different activity and
make configuration
changes. A single user
can log in multiple
times, but the user must
open separate activities.
Using the JumpStart to Learn About Security Manager
The JumpStart is an introduction to Security Manager. It describes and illustrates the major concepts of
using the product. Use the jumpstart to explore Security Manager features and capabilities.
The JumpStart opens automatically when you first launch Security Manager. To get to the JumpStart
while you are working with Security Manager, select Help > JumpStart from the main menu in
Configuration Manager.
The JumpStart contains the following navigation features:
• A table of contents, which is always visible in the upper right corner. Click an entry to open its page.
User Guide for Cisco Security Manager 4.4
1-22
OL-28826-01
Page 83
Chapter 1 Getting Started with Security Manager
Completing the Initial Security Manager Configuration
• Links in the page enable you to drill down to more detailed information in the JumpStart or to
relevant information in the online help.
Completing the Initial Security Manager Configuration
After you install Security Manager, there are several configuration steps you might want to perform to
complete the installation. Although most of the features you initially configure have default settings, you
should familiarize yourself with the features and decide if the default settings are the best settings for
your organization.
The following list explains the features you might want to initially configure, with pointers to topics that
provide more detailed information where appropriate. You can configure these features in any order, or
delay configuring those that you do not yet need to use.
• Configure an SMTP server and default e-mail addresses. Security Manager can send e-mail
notifications for several actions that occur in the system. For example, you can get an e-mail when
your deployment job finishes reconfiguring network devices. For e-mail notifications to work, you
must configure an SMTP server.
For information on configuring an SMTP server and setting the default e-mail addresses, see
Configuring an SMTP Server and Default Addresses for E-Mail Notifications, page 1-25
• Create user accounts. Users must log into Security Manager to use the product. However, if a user
logs in with an account another user is already using, the first user is automatically disconnected.
Thus, each user should have a unique account. You can create accounts local to the Security Manager
server, or you can use your ACS system to manage user authentication. For more information, see
the Installation Guide for Cisco Security Manager
• Configure default deployment settings. When users deploy configurations to devices, they can select
how the configurations should be deployed and how Security Manager should handle anomalies.
However, you can select system-default settings that make it easier for users to follow your
organization’s recommendations. To set deployment defaults, in Configuration Manager, select
Tools > Security Manager Administration, and then select Deployment from the table of contents
to open the Deployment settings page (see Deployment Page, page 11-9).
The following deployment settings are of particular interest:
–
Default Deployment Method—Whether configuration deployments should be written directly
to the device or to a transport server, or if configuration files should be written to a specified
directory on the Security Manager server. The default is to deploy configurations directly to the
device or transport server, if one is configured for the device. However, if you have your own
methods for deploying configuration files, you might want to select File as the default
deployment method. For more information on deployment methods, see Understanding
Deployment Methods, page 8-8
–
When Out-of-Band Changes Detected—How to respond when Security Manager detects that
configuration changes were made on the device through the CLI rather than through Security
Manager. The default is to issue a warning and proceed with the deployment, overwriting the
changes that were made through the CLI. However, you can change this behavior to simply skip
the check for changes (which means Security Manager overwrites the changes but does not warn
you), or to cancel the deployment, thus leaving the device in its current state. For more
information about handling out-of-bound changes, see Understanding How Out-of-Band
Changes are Handled, page 8-12.
OL-28826-01
–
Allow Download on Error—Whether to allow deployment to continue if minor configuration
errors are found. The default is to not allow deployment when minor errors are found.
User Guide for Cisco Security Manager 4.4
1-23
Page 84
Completing the Initial Security Manager Configuration
• Select a workflow mode. The default mode is non-Workflow mode with Ticket Management
enabled. In non-Workflow mode, users have more freedom to create and deploy configurations.
However, if your organization requires a more transaction-oriented approach to network
management, where separate individuals perform policy creation, approval, and deployment, you
can enable Workflow mode to enforce your procedures. If you are using Workflow mode, ensure that
you configure user permissions appropriately when you define user accounts to enforce your
required division of labor. For information on the types of workflow you can use, see Workflow and
Activities Overview, page 1-18. For information on how to change workflow modes, see Changing
Workflow Modes, page 1-26.
TipYou can disable Ticket Management in non-Workflow mode to make most activity management tasks
automatic.
• Configure default device communication settings. Security Manager uses the most commonly used
methods for accessing devices based on the type of device. For example, Security Manager uses SSH
by default when contacting Catalyst switches. If the default protocols work for the majority of your
devices, you do not need to change them. For devices that should use a non-default protocol, you
can change the protocol in the device properties for the specific devices. However, if you typically
use a protocol that is not the Security Manager default (for example, if you use a token management
server (TMS) for your routers), you should change the default setting. To change the default
communication settings, in Configuration Manager, select Tools > Security Manager Administration, and select Device Communication from the table of contents. In the Device
Connection Settings group, select the most appropriate protocols for each type of device. You can
also change the default connection time out and retry settings. For more information about device
communication settings, see Device Communication Page, page 11-16
• Select the types of router and firewall policies you will manage with Security Manager. When you
manage IPS devices in Security Manager, you automatically manage the entire configuration.
However, with routers and firewall devices (ASA, PIX, and FWSM), you can select which types of
policies are managed by Security Manager. You can manage other parts of the device configuration
using other tools (including the devices’s CLI). By default, all security-related policies are managed.
To change which policies are managed, in Configuration Manager, select Tools > Security Manager Administration > Policy Management. For detailed information about changing these
settings and what you should do before and after making the change, see Customizing Policy
Management for Routers and Firewall Devices, page 5-10.
Chapter 1 Getting Started with Security Manager
1-24
• Decide whether you want to use the Event Viewer to manage firewall and IPS events. You can
configure the disk and location for collecting syslog events from devices, and the port number to use
for syslog communication. If you do not want to use Security Manager for event management, you
can turn off the feature, which is enabled by default. For more information on the configuration
options, see Event Management Page, page 11-22.
• Configure Security Manager for communication with Cisco Security Monitoring, Analysis and
Response System (CS-MARS). If you use CS-MARS for monitoring your network, you can identify
the servers to Security Manager and then access CS-MARS event information from within Security
Manager. For information on configuring this cross-communication, see Checklist for Integrating
CS-MARS with Security Manager, page 69-23.
User Guide for Cisco Security Manager 4.4
OL-28826-01
Page 85
Chapter 1 Getting Started with Security Manager
Completing the Initial Security Manager Configuration
Configuring an SMTP Server and Default Addresses for E-Mail Notifications
Security Manager can send e-mail notifications for several types of events such as deployment job
completion, activity approval, or ACL rule expiration. To enable e-mail notifications, you must
configure an SMTP server that Security Manager can use for sending the e-mails. Then, you can
configure e-mail addresses and notification settings on these settings pages (in Configuration Manager,
select Tools > Security Manager Administration and select the page from the table of contents):
• Workflow page—For default e-mail addresses and notification settings for deployment jobs and
activities. Users can override the defaults when managing deployment jobs and activities.
• Rules Expiration page—For default e-mail addresses and notification settings for ACL rule
expiration. Rules expire only if you configure them with expiration dates.
• IPS Updates page—For the e-mail address that should be notified of IPS update availability.
• Server Security page—When you configure local user accounts (click Local User Setup), specify
the user’s e-mail address. This address is used as the default target for some notifications such as
deployment job completion.
• Event Management page—When you configure an extended data storage location, you must specify
at least one e-mail address. The email addresses receive notifications if problems arise with the use
of the extended storage location.
TipIf you are using ACS for user authorization, you might have already configured an SMTP server and
system administrator e-mail address in the ACS integration procedure as described in the Installation
Guide for Cisco Security Manager. Security Manager sends a notification to this address if all ACS
servers become unavailable.
Step 1Access CiscoWorks Common Services on the Security Manager server:
• If you are currently using the Security Manager client, the easiest way to do this is to select Tool s
> Security Manager Administration, select Server Security from the table of contents, and click
any button on that page (for example, Local User Setup).
• You can use your web browser to log into the home page on the Security Manager server
(https://servername/CSCOnm/servlet/login/login.jsp) and click Server Administration.
Step 2Click Server > Admin and select System Preferences from the table of contents.
Step 3On the System Preferences page, enter the host name or IP address of an SMTP server that Security
Manager can use. The SMTP server cannot require user authentication for sending e-mail messages.
Also, enter an e-mail address that CiscoWorks can use for sending e-mails. This does not have to be the
same e-mail address that you configure for Security Manager to use when sending notifications. If you
are using ACS for authorization, Security Manager sends an e-mail message to this address if all ACS
servers become unavailable. This can alert you to a problem that needs immediate attention. The
administrator might also receive e-mail messages from Common Services for non-ACS-related events.
Step 4Click Apply to save your changes.
OL-28826-01
User Guide for Cisco Security Manager 4.4
1-25
Page 86
Completing the Initial Security Manager Configuration
Changing Workflow Modes
You can change the workflow mode that Security Manager enforces if you have the appropriate
administrator permissions. Changing the workflow mode has significant effects on users. Before making
a change, be sure to understand the following:
• When you change the workflow mode, the change will take effect for all Security Manager users
working from the same server.
• Before you can change from Workflow mode to non-Workflow mode, all activities in editable states
(Edit, Edit Open, Submit, or Submit Open) must be approved or discarded, and all generated jobs
must be deployed, rejected, discarded, or aborted so that the locks on the devices can be released.
You do not have to do anything to jobs that are in the failed state.
• Before you can disable Ticket Management in non-Workflow mode, all tickets in editable states
(Edit or Edit Open) must be submitted or discarded.
• If you change from Workflow mode to non-Workflow mode and then restore an earlier version of
the database, Security Manager automatically changes to Workflow mode if the restored database
has any activities in an editable state (Edit, Edit Open, Submit, or Submit Open). Approve or delete
the editable activities, and then turn Workflow mode off again.
• When changing from non-Workflow mode to Workflow mode or enabling Ticket Management in
non-Workflow mode, current configuration sessions are listed as activities/tickets in the Edit_Open
state, and these activities/tickets must now be explicitly managed.
• When Ticket Management is enabled or disabled, any other users logged into Security Manager are
logged out.
Chapter 1 Getting Started with Security Manager
For an explanation of workflow modes, see Workflow and Activities Overview, page 1-18.
from the table of contents to open the Workflow page (see Workflow Page, page 11-54).
Step 2Configure the workflow mode settings in the Workflow Control group. If you select Enable Workflow
(to use Workflow mode), you can also select these options:
• Require Activity Approval—To enforce explicit approval of activities before policy changes are
committed to the database.
• Require Deployment Approval—To enforce explicit approval of deployment jobs before they can be
run.
Step 3Configure the e-mail notification settings. These are the default e-mail addresses for the e-mail sender
(that is, Security Manager), the approvers, and another person or e-mail alias who should be notified
when deployment jobs are complete.
You also have the options to include the job deployer when sending notifications of job status, and to
require that e-mail notifications are sent for deployment job status changes.
Step 4Click Save to save and apply changes.
Step 5Select Workfl o w from the table of contents to open the Ticket Management page (see Ticket
Management Page, page 11-51).
Step 6Configure the Ticket Management settings. If you select Enable Ticketing, you can also select these
options:
1-26
NoteSee Ticket Management Page, page 11-51 for detailed information on these fields.
User Guide for Cisco Security Manager 4.4
OL-28826-01
Page 87
Chapter 1 Getting Started with Security Manager
Understanding Basic Security Manager Interface Features
• Ticket System URL—To provide linking between a Ticket ID and an external ticket management
system.
• Ticket History—Specify how long to keep information related to tickets.
Step 7Click Save to save and apply changes.
Understanding Basic Security Manager Interface Features
The following topics provide information about some basic interface features such as descriptions of the
menu commands, toolbar buttons, and how to use common user interface elements. Many of the features
described are used only in Configuration Manager.
• Menu Bar Reference for Configuration Manager, page 1-27
• Selecting or Specifying a File or Directory in Security Manager, page 1-47
• Troubleshooting User Interface Problems, page 1-48
Menu Bar Reference for Configuration Manager
The menu bar in Configuration Manager contains menus with commands for using Security Manager.
Commands may become unavailable depending on the task you are performing.
The menus in the menu bar are described in the following topics:
• File Menu (Configuration Manager), page 1-28
• Edit Menu (Configuration Manager), page 1-29
• View Menu (Configuration Manager), page 1-30
• Policy Menu (Configuration Manager), page 1-30
• Map Menu (Configuration Manager), page 1-31
• Manage Menu (Configuration Manager), page 1-32
• Tools Menu (Configuration Manager), page 1-33
• Launch Menu (Configuration Manager), page 1-35
• Activities Menu (Configuration Manager), page 1-34
• Tickets Menu (Configuration Manager), page 1-34
• Help Menu (Configuration Manager), page 1-36
OL-28826-01
User Guide for Cisco Security Manager 4.4
1-27
Page 88
Understanding Basic Security Manager Interface Features
File Menu (Configuration Manager)
The following table describes the commands on the File menu in Configuration Manager. The menu
items differ depending on the workflow mode.
Table 1-2File Menu (Configuration Manager)
CommandDescription
New DeviceInitiates the wizard to add a new device. See Adding Devices to the
Clone DeviceCreates a device by duplicating an existing device. See Cloning a
Delete DeviceDeletes a device. See Deleting Devices from the Security Manager
SaveSaves any changes made on the active page, but does not submit them
ImportImport policies and devices exported from another Security Manager
ExportExport policies or devices so that they can be imported into another
View Changes
(non-Workflow mode only)
Validate
(non-Workflow mode only)
Submit
(non-Workflow mode only)
Submit and Deploy
(non-Workflow mode only)
Deploy
(non-Workflow mode only)
Chapter 1 Getting Started with Security Manager
Device Inventory, page 3-6.
Device, page 3-54
Inventory, page 3-55.
to the Security Manager database.
server. See Importing Policies or Devices, page 10-13.
Security Manager server. A device export can include policy
information, or it can be a simple CSV file that you can import into
CiscoWorks Common Services Device Credential Repository (DCR) or
Cisco Security Monitoring, Analysis and Response System
(CS-MARS). See Exporting the Device Inventory from the Security
Manager Client, page 10-6 and Exporting Shared Policies, page 10-11.
Opens the Activity Change Report (in PDF format) for the current
configuration session.
To see changes for the current activity in Workflow mode, select
Activities > View Changes.
Validates the changes you have saved. See Validating an
Activity/Ticket, page 4-18.
To validate the current activity in Workflow mode, select Activities > Validate Activity.
Submits all changes made since the last submission to the Security
Manager database.
To validate the current activity in Workflow mode, select Activities > Submit Activity.
Submits all changes made since the last submission to the Security
Manager database and deploys all changes made since the last
deployment. See Understanding Deployment, page 8-1.
In Workflow mode, you must have your activity approved and then
create a deployment job to deploy changes to devices.
Deploys all changes made since the last deployment. See
Understanding Deployment, page 8-1.
In Workflow mode, you must have your activity approved and then
create a deployment job to deploy changes to devices.
1-28
User Guide for Cisco Security Manager 4.4
OL-28826-01
Page 89
Chapter 1 Getting Started with Security Manager
Table 1-2File Menu (Configuration Manager) (Continued)
CommandDescription
Discard
Understanding Basic Security Manager Interface Features
Discards all configuration changes since the last submission.
(non-Workflow mode only)
Edit Device GroupsEdits device groups. See Working with Device Groups, page 3-57.
New Device GroupAdds a device group. See Creating Device Groups, page 3-60.
Add Devices to GroupAdds a device to a group. See Adding Devices to or Removing Them
PrintPrints the active page.
ExitExits Security Manager.
Edit Menu (Configuration Manager)
The following table describes the commands on the Edit menu in Configuration Manager. You can
typically use these commands only when you are working with a table in a policy, and some work only
for rules tables (see Using Rules Tables, page 12-7).
Table 1-3Edit Menu (Configuration Manager)
CommandDescription
CutCuts the selected row in a rules table and saves it on the clipboard.
CopyCopies the selected row in a rules table and saves it on the clipboard.
PastePastes the rules table row from the clipboard to the into the rules table
Add RowAdds a row into the active table.
Edit RowEdits the selected table row.
Delete RowDeletes the selected table row.
Move Row Up
Move Row Down
Global SearchOpens the Global Search window. For more information, see Using
To validate the current activity in Workflow mode, select Activities > Discard Activity.
From Device Groups, page 3-60.
Not all pages can be printed. If the Print command is not available, you
cannot print the active page.
after the selected row.
Moves the selected row up or down in the rules table. For more
information, see Moving Rules and the Importance of Rule Order,
page 12-19.
Global Search, page 1-39.
OL-28826-01
User Guide for Cisco Security Manager 4.4
1-29
Page 90
Understanding Basic Security Manager Interface Features
View Menu (Configuration Manager)
The View menu in Configuration Manager contains commands to navigate within the user interface or
to alter the toolbar.
Table 1-4View Menu
Menu CommandDescription
Device ViewOpens Device view. See Device View Overview, page 1-13.
Device Status ViewOpens the Device Status View window. See Working with Device
Map ViewOpens Map view. See Map View Overview, page 1-16.
Policy ViewOpens Policy view. See Policy View Overview, page 1-14.
The Policy menu in Configuration Manager contains commands for managing policies.
Table 1-5Policy Menu (Configuration Manager)
Menu CommandDescription
Share PolicySaves the active local policy as a shared policy. See Sharing a Local
Unshare PolicySaves the active shared policy as a local policy. See Unsharing a Policy,
Assign Shared PolicyAssigns shared policies to devices. See Assigning a Shared Policy to a
Unassign PolicyUnassigns the current policy from the selected device. See Unassigning
Copy Policies Between
Devices
Share Device PolicesEnables you to share local device policies. See Sharing a Local Policy,
Edit Policy AssignmentsEdits assignment of shared policies to devices. See Modifying Policy
Clone PolicyCreates a copy of a policy with a new name. See Cloning (Copying) a
Rename PolicyRenames a policy. See Renaming a Shared Policy, page 5-45.
Add Local RulesAdds local rules to a shared policy on a device. You must select a
Inherit RulesEdits policy inheritance. See Inheriting or Uninheriting Rules,
Policy, page 5-38.
page 5-40.
Device or VPN Topology, page 5-41.
a Policy, page 5-33.
Copies policies between devices. See Copying Policies Between
Devices, page 5-31
page 5-38.
Assignments in Policy View, page 5-51.
Shared Policy, page 5-44.
rule-based shared policy to use this command.
page 5-43
1-30
User Guide for Cisco Security Manager 4.4
OL-28826-01
Page 91
Chapter 1 Getting Started with Security Manager
Table 1-5Policy Menu (Configuration Manager) (Continued)
Menu CommandDescription
Discover Policies on DeviceDiscovers policies on a device. See Discovering Policies, page 5-12
Discover VPN PoliciesOpens the Discover VPN Policies wizard. See Site-To-Site VPN
Map Menu (Configuration Manager)
The Map menu in Configuration Manager contains commands for using the Map view. The commands
in this menu are available only when the Map view is open. For more information, see Chapter 34,
“Using Map View”.
Table 1-6Map Menu (Configuration Manager)
Menu CommandDescription
New MapCreates a map. See Creating New or Default Maps, page 34-9.
Open MapOpens a saved map or the default map. See Opening Maps, page 34-10.
Show Devices On MapSelects the managed devices to show on the active map. See Displaying
Show VPNs On MapSelects the VPNs to show on the active map. See Displaying Existing
Add Map ObjectCreates a map object on the open map. See Using Map Objects To
Add LinkCreates a Layer 3 link on the open map. See Creating and Managing
Find Map NodeFinds nodes on the open map. See Searching for Map Nodes,
Save MapSaves the open map. See Saving Maps, page 34-10.
Save Map AsSaves the open map with a new name. See Saving Maps, page 34-10.
Zoom InZooms in on the map. See Panning, Centering, and Zooming Maps,
Zoom OutZooms out from the map. See Panning, Centering, and Zooming Maps,
Fit to WindowZooms the open map to display the entire map. See Panning, Centering,
Display Actual SizeZooms the open map to display at actual size. See Panning, Centering,
Refresh MapRefreshes the open map with updated network data. See Creating New
Export MapExports the open map to a file. See Exporting Maps, page 34-11.
Delete MapDeletes the map you select from a list. See Deleting Maps, page 34-10.
Map PropertiesDisplays or edits properties for the open map. See Setting the Map
Understanding Basic Security Manager Interface Features
Discovery, page 24-19.
Managed Devices on the Map, page 34-16.
VPNs on the Map, page 34-21.
Represent Network Topology, page 34-17.
Layer 3 Links on the Map, page 34-19.
page 34-12.
page 34-11.
page 34-11.
and Zooming Maps, page 34-11.
and Zooming Maps, page 34-11.
or Default Maps, page 34-9.
Background Properties, page 34-13.
OL-28826-01
User Guide for Cisco Security Manager 4.4
1-31
Page 92
Understanding Basic Security Manager Interface Features
Table 1-6Map Menu (Configuration Manager) (Continued)
Menu CommandDescription
Show/Hide Navigation
Window
Undock/Dock Map ViewUndocks the maps window, allowing you to use other features while
Manage Menu (Configuration Manager)
The Manage menu in Configuration Manager contains commands that start tools that run in a window
separate from the Security Manager main interface. This enables you to access features without closing
the page from which you are currently working.
Table 1-7Manage Menu (Configuration Manager)
Chapter 1 Getting Started with Security Manager
Displays or hides the navigation window on the open map. See Using
the Navigation Window, page 34-4.
keeping the map open. If the window is already undocked, the Dock
Map View command reattaches the window to the primary Security
Manager window. See Understanding the Map View Main Page,
page 34-2.
Menu CommandDescription
Policy ObjectsOpens the Policy Object Manager, where you can view all available
objects grouped according to object type; create, copy, edit, and delete
objects; and generate usage reports, which describe how selected
objects are being used by other Security Manager objects and policies.
For information see Policy Object Manager, page 6-4.
Site-to-Site VPNsOpens the Site-to-Site VPN Manager, where you can configure
site-to-site VPNs. See Chapter 24, “Managing Site-to-Site VPNs: The
Basics”
Activities
(Workflow mode only)
Opens the Activity Manager, where you can create and manage
activities. See Activity/Ticket Manager Window, page 4-10.
DeploymentsOpens the Deployment Manager, where you can deploy configurations
and manage deployment jobs. See Chapter 8, “Managing Deployment”
Configuration ArchiveStores archived device configuration versions and allows you to view,
compare, and roll back from one configuration to another. See
Configuration Archive Window, page 8-24.
Policy Discovery StatusOpens the Policy Discovery Status window, where you can see the
status of policy discovery and device import. See Viewing Policy
Discovery Task Status, page 5-21.
IPSManage IPS device certificates, which are required for device
communications.
Audit ReportGenerates an audit report according to parameters set in the audit report
page. See Using the Audit Report Window, page 10-20.
Change Reports
(non-Workflow mode only)
Allows you to generate a report of changes to devices, shared policies,
and policy objects for a previous configuration session. See Viewing
Change Reports, page 4-16.
To view changes for the current configuration session, select File > View Changes.
1-32
User Guide for Cisco Security Manager 4.4
OL-28826-01
Page 93
Chapter 1 Getting Started with Security Manager
Tools Menu (Configuration Manager)
The Tools menu in Configuration Manager contains commands that start tools that run in a window
separate from the Security Manager main interface. This enables you to access features without closing
the page from which you are currently working.
Table 1-8Tools Menu (Configuration Manager)
Menu CommandDescription
Device PropertiesOpens the Device Properties window, which provides general
Detect Out of Band Changes Analyzes devices to determine if their configurations have changed
Packet Capture WizardOpens the Packet Capture wizard, where you can set up a packet
Ping, TraceRoute and
NSLookup
Wall...Opens the Wall window, where you can send messages to all users who
Show ContainmentShows security contexts or service modules for a device. See Showing
Inventory StatusShows device summary information for all devices. See Viewing
Catalyst Summary InfoShows high-level system information, including any service modules,
Apply IPS UpdateManually applies IPS image and signature updates. See Manually
Preview ConfigurationDisplays the proposed changes, last deployed configuration, or current
BackupBacks up the Security Manager database using CiscoWorks Common
Security Manager
Diagnostics
Understanding Basic Security Manager Interface Features
information about the device, including credentials, the group the
device is assigned to, and policy object overrides. For more
information, see Understanding Device Properties, page 3-6.
since the last time Security Manager deployed configurations. You can
use this information to ensure that you do not loose important
configuration changes. See Detecting and Analyzing Out of Band
Changes, page 8-46.
capture on an ASA device.
Opens the Ping, TraceRoute, and NSLookup tool, where you can use
these troubleshooting commands. Ping and traceroute run on managed
devices, whereas NSLookup runs on your client workstation. See
Analyzing Connectivity Issues Using the Ping, Trace Route, or NS
Lookup Tools, page 69-14.
are logged in on the same Security Manager server. First, however, it
must be enabled on the Wall Settings page. See Wall Settings Page,
page 11-56.
Device Containment, page 3-53.
Inventory Status, page 69-1.
ports, and VLANs that Security Manager has discovered on the selected
Catalyst switch. See Viewing Catalyst Summary Information,
page 65-2.
Applying IPS Updates, page 43-7.
running configuration for specific devices. See Previewing
Configurations, page 8-45.
Services. See Backing up and Restoring the Security Manager
Database, page 10-24.
Gathers troubleshooting information to send to the Technical
Assistance Center (TAC) if they request it. See Creating a Diagnostics
File for the Cisco Technical Assistance Center, page 10-27.
OL-28826-01
User Guide for Cisco Security Manager 4.4
1-33
Page 94
Understanding Basic Security Manager Interface Features
Table 1-8Tools Menu (Configuration Manager) (Continued)
Menu CommandDescription
Security Manager
Administration
Activities Menu (Configuration Manager)
The Activities menu in Configuration Manager contains commands for managing activities. It appears
only when Workflow mode is enabled. For more detailed information about these commands, see
Accessing Activity Functions in Workflow Mode, page 4-8.
Table 1-9Activities Menu (Configuration Manager)
Menu CommandDescription
New ActivityCreates a new activity. See Creating an Activity/Ticket, page 4-14.
Open ActivityOpens an activity. See Opening an Activity/Ticket, page 4-15.
Close ActivityCloses the open activity. See Closing an Activity/Ticket, page 4-16.
View ChangesOpens the Activity Change Report (in PDF format). See Viewing
Validate ActivityValidates the open activity. See Validating an Activity/Ticket,
Submit ActivitySubmits the open activity. See Submitting an Activity for Approval
Approve ActivityApproves the open activity. See Approving or Rejecting an Activity
Reject ActivityRejects the open activity. See Approving or Rejecting an Activity
Discard ActivityDiscards the open activity. See Discarding an Activity/Ticket,
Chapter 1 Getting Started with Security Manager
Configures system-wide settings that control the functioning of
Security Manager. For information, see Chapter 11, “Configuring
Security Manager Administrative Settings”.
Change Reports, page 4-16.
page 4-18.
(Workflow Mode with Activity Approver), page 4-20.
(Workflow Mode), page 4-21.
(Workflow Mode), page 4-21.
page 4-22.
Tickets Menu (Configuration Manager)
The Tickets menu in Configuration Manager contains commands for managing tickets. It appears only
when Ticket Management is enabled in non-Workflow mode. For more detailed information about these
commands, see Accessing Ticket Functions in Non-Workflow Mode, page 4-9.
Table 1-10Tickets Menu (Configuration Manager)
Menu CommandDescription
New TicketCreates a new ticket. See Creating an Activity/Ticket, page 4-14.
Open TicketOpens an ticket. See Opening an Activity/Ticket, page 4-15.
Close TicketCloses the open ticket. See Closing an Activity/Ticket, page 4-16.
View ChangesOpens the Ticket Change Report (in PDF format). See Viewing Change
User Guide for Cisco Security Manager 4.4
1-34
Reports, page 4-16.
OL-28826-01
Page 95
Chapter 1 Getting Started with Security Manager
Table 1-10Tickets Menu (Configuration Manager) (Continued)
Menu CommandDescription
Validate TicketValidates the open ticket. See Validating an Activity/Ticket, page 4-18.
Submit TicketSubmits the open ticket. See Understanding Activity/Ticket States,
Discard TicketDiscards the open ticket. See Discarding an Activity/Ticket, page 4-22.
Launch Menu (Configuration Manager)
The Launch menu contains commands that start other applications.
Table 1-11Launch Menu (Configuration Manager)
Menu CommandDescription
Device ManagerStarts device managers for all supported devices, such as PIX security
Prime Security ManagerLaunches the Cisco Prime Security Manager (PRSM) application, used
Event ViewerOpens the Event Viewer, where you can view and analyze device
Understanding Basic Security Manager Interface Features
page 4-4.
appliances, Firewall Services Modules (FWSM), IPS sensors, IOS
routers, and Adaptive Security Appliance (ASA) devices. Device
managers provide several monitoring and diagnostic features that
enable you to get information regarding the services running on the
device and a snapshot of the overall health of the system. See Starting
Device Managers, page 69-4.
to manage ASA CX devices. See Launching Cisco Prime Security
Manager, page 69-9 for more information.
events. See Chapter 66, “Viewing Events” for more information.
If you have already logged into another Security Manager application,
Event Viewer is opened using the same user account; you are not
prompted to log in. To open Event Viewer using a different user
account, open the application from the Windows Start menu or desktop
icon.
Report ManagerOpens the Report Manager, where you can generate and analyze
security and usage reports. See Chapter 67, “Managing Reports” for
more information.
If you have already logged into another Security Manager application,
Report Manager is opened using the same user account; you are not
prompted to log in. To open Report Manager using a different user
account, open the application from the Windows Start menu or desktop
icon.
Image ManagerOpens the Image Manager, where you can manage the images on ASA
devices. See Chapter 70, “Using Image Manager” for more
information.
If you have already logged into another Security Manager application,
Image Manager is opened using the same user account; you are not
prompted to log in. To open Image Manager using a different user
account, open the application from the Windows Start menu or desktop
icon.
OL-28826-01
User Guide for Cisco Security Manager 4.4
1-35
Page 96
Understanding Basic Security Manager Interface Features
Table 1-11Launch Menu (Configuration Manager) (Continued)
Menu CommandDescription
Health & Performance
Monitor
Help Menu (Configuration Manager)
The Help menu in Configuration Manager contains commands for accessing product documentation and
training. For more information, see Accessing Online Help, page 1-49.
Table 1-12Help Menu (Configuration Manager)
Chapter 1 Getting Started with Security Manager
Opens the Health & Performance Monitor (HPM), where you can view
device status and traffic information across your network, and view and
acknowledge device-specific alerts. See Chapter 68, “Health and
Performance Monitoring” for more information.
If you have already logged into another Security Manager application,
HPM is opened using the same user account; you are not prompted to
log in. To open HPM using a different user account, open the
application from the Windows Start menu or desktop icon.
Menu CommandDescription
Help TopicsOpens the online help system.
Help About This PageOpen online help for the active page.
JumpStartOpens the JumpStart.
Security Manager OnlineOpens the Security Manager web page on Cisco.com.
About Configuration
Manager
Displays information about Configuration Manager.
Toolbar Reference (Configuration Manager)
The main toolbar (see the illustration Figure 1-1) contains buttons that perform actions in Configuration
Manager.
The buttons that appear on the main toolbar vary depending on whether Workflow/Ticket Management
mode is enabled and how you have customized the toolbar. By selecting View > Customized Toolbar,
you can select some of the buttons included in the toolbar. Many buttons are on the toolbar permanently;
you cannot remove them.
The following table presents all buttons.
Table 1-13Configuration Manager Toolbar
ButtonDescription
Opens the Device view.
1-36
For more information, see Understanding the Device View, page 3-1.
Opens the Map view.
For more information, see Chapter 34, “Using Map View”.
Understanding Basic Security Manager Interface Features
Opens the Policy view.
For more information, see Managing Shared Policies in Policy View, page 5-47.
Opens the Policy Bundle view.
For more information, see Managing Policy Bundles, page 5-53.
Opens the Policy Object Manager.
For more information, see Chapter 6, “Managing Policy Objects”.
Opens the Site-to-Site VPN Manager.
For more information, see Chapter 24, “Managing Site-to-Site VPNs: The
Basics”.
Opens the Deployment Manager.
For more information, see Chapter 8, “Managing Deployment”.
Opens the Audit Report.
For more information, see Understanding Audit Reports, page 10-19.
(Non-Workflow mode with Ticket Management disabled only.) Submits and
deploys changes.
For more information, see Chapter 8, “Managing Deployment”.
Discovers configuration policies defined on the currently selected device.
For more information, see Discovering Policies, page 5-12.
Detects out-of-band changes, those made to the device outside of Security
Manager, for the currently selected devices.
For more information, see Detecting and Analyzing Out of Band Changes,
page 8-46.
Opens the Wall window, where you can send messages to all users who are logged
in on the same Security Manager server. First, however, it must be enabled on the
Wall Settings page.
For more information, see Workflow Page, page 11-54.
Shows high-level system information, including any service modules, ports, and
VLANs that Security Manager has discovered on the selected Catalyst switch.
For more information, see Viewing Catalyst Summary Information, page 65-2.
Previews the configuration for the currently selected device.
For more information, see Previewing Configurations, page 8-45.
Opens the device manager for the currently selected device.
For more information, see Starting Device Managers, page 69-4.
Opens the Event Viewer application.
For more information, see Chapter 66, “Viewing Events”.
Opens the Report Manager application.
OL-28826-01
For more information, see Chapter 67, “Managing Reports”.
User Guide for Cisco Security Manager 4.4
1-37
Page 98
Understanding Basic Security Manager Interface Features
For more information, see Chapter 70, “Using Image Manager”.
Opens the Health & Performance Monitor application.
For more information, see Chapter 68, “Health and Performance Monitoring”.
Opens online help for the current page.
For more information, see Accessing Online Help, page 1-49.
NoteThe following buttons are not available in non-Workflow mode when Ticket Management is
disabled.
Opens the Activity Manager window in Workflow mode or the Ticket Manager
window when Ticket Management is enabled in non-Workflow mode. You can use
these windows to create and manage activities/tickets. For more information, see
Activity/Ticket Manager Window, page 4-10.
For more information on the activity buttons, and the conditions under which they
are enabled, see Accessing Activity Functions in Workflow Mode, page 4-8.
For more information on the ticket buttons, and the conditions under which they
are enabled, see Accessing Ticket Functions in Non-Workflow Mode, page 4-9.
Creates a new activity/ticket.
Chapter 1 Getting Started with Security Manager
Opens an activity/ticket.
Saves all changes made while the activity/ticket was open and closes it.
Evaluates all changes made in the activity/ticket and produces a Change Report in
PDF format in a separate window. For more information, see Viewing Change
Reports, page 4-16
Validates the integrity of changed policies within the current activity/ticket.
(Workflow mode with an approver only.) Submits the activity for approval when
using Workflow mode with an activity approver.
Submits the ticket. Submitting the ticket saves the proposed changes to the
database. Devices associated with the ticket are unlocked, meaning they can be
included in policy definitions and changes in other tickets. You can submit a ticket
when it is in the Edit or the Edit Open state.
(Workflow mode only.) Approves the changes proposed in an activity.
(Workflow mode only.) Rejects the changes proposed in an activity.
Discards the selected activity/ticket.
1-38
User Guide for Cisco Security Manager 4.4
OL-28826-01
Page 99
Chapter 1 Getting Started with Security Manager
Using Global Search
Security Manager provides a global search feature to make finding and working with information that
you are interested in easier. The Global Search feature allows you to search for devices, policy objects,
policies, and tickets that contain a particular search string. The scope of the search can be limited to just
devices, policy objects, policies, or tickets.
NoteSearch is only performed using data that has been committed. Changes that have not yet been submitted
to the database will not be included in search results.
Wildcard Matching
The search string supports the use of the following wildcard characters:
• Asterisk (*)—matches zero or more characters
• Question Mark (?)—matches a single character
Semantic Searching
If the search string that is entered is an IP address, Security Manager will perform a semantic search. For
example, entering "192.168.0.0/16" in the search string will return items matching that subnet as well as
any specific hosts or other subnets belonging to that subnet or to which that subnet belongs.
Understanding Basic Security Manager Interface Features
Global Search Scope
Global search is supported only within a set of policies and policy objects, not all. The supported policies
and the policy objects are the most frequently used policies and objects in the customer deployments.
The policies and policy objects supported are:
• Devices: All Devices
• Policy Objects:
–
AAA Server Groups
–
AAA Servers
–
Access Control Lists
–
ASA Group Policies
–
Categories
–
Cisco Secure Desktop (Router)
–
Credentials
–
File Objects
–
FlexConfigs
–
Identity User Group
–
IKE Proposals
–
Interface Roles
–
IPSec Transform Sets
OL-28826-01
–
LDAP Attribute Maps
–
Networks/Hosts (IPv4 and IPv6)
–
PKI Enrollments
User Guide for Cisco Security Manager 4.4
1-39
Page 100
Understanding Basic Security Manager Interface Features
–
Port Forwarding List
–
Services
–
Single Sign On Servers
–
SLA Monitors
–
SSL VPN Bookmarks
–
SSL VPN Customizations
–
SSL VPN Gateways
–
SSL VPN Smart Tunnel Auto Signon Lists
–
SSL VPN Smart Tunnels
–
Tex t O b jects
–
Time Ranges
–
Traffic Flows
–
User Groups
–
WINS Server Lists
Chapter 1 Getting Started with Security Manager
• Policies:
–
AAA Rules
–
Access Rules
–
IPv6 Access Rules
–
Inspection Rules
–
Translation Rules
–
Web Fil t e r Rule s
–
Zone Based Firewall Rules
• Tickets
–
Configuration Manager
–
Image Manager
Performing a Global Search
To perform a global search, do one of the following:
• Select Edit > Global Search or press Ctrl+F to open the Global Search window. Select the scope
for the search in the drop-down list to the left of the search field, enter your search string in the
search field, and then click Search.
NoteIf you are currently viewing a rule table, pressing Ctrl+F will open the Find and Replace
dialog box instead of the Global Search window. Use one of the other methods to access the
Global Search feature instead of the Find and Replace feature.
1-40
• Using the search field in the upper-right corner of the Configuration Manager window, select the
scope for the search by clicking on the Search icon, enter your search string in the search field, and
then press Enter.
The Global Search window displays the results matching your search criteria. Select the desired data
type from the Category selector tree to see results for that category.
User Guide for Cisco Security Manager 4.4
OL-28826-01
Loading...
+ hidden pages
You need points to download manuals.
1 point = 1 manual.
You can buy points or you can get point for every manual you upload.