-
Cisco Guard Configuration Guide (Software Version 5.0)
-
Index
-
Preface
-
Product Overview
-
Initializing the Guard
-
Configuring the Guard
-
Configuring Traffic Diversion
-
Configuring Zones
-
Configuring Zone Filters
-
Configuring Policy Templates and Policies
-
Using Interactive Protect Mode
-
Understanding Attack Reports
-
Using the Guard Diagnostics Tools
-
Performing Maintenance Tasks
-
Analyzing Guard Mitigation
-
Configuring Traffic Diversion
-
Troubleshooting Diversion
-
Table Of Contents
Importing and Updating Configuration
Configuring Logs and Reports History
Rebooting the Guard and Inactivating Zones
Upgrading the Guard Software Version
Resetting the Configuration to Factory Defaults
Performing Maintenance Tasks
This chapter describes how to perform tasks used for general care and maintenance of the Cisco Guard (Guard) and contains the following sections:
•
Importing and Updating Configuration
•
•
Exporting Configuration
You can export the Guard configuration file or a zone configuration file (running-config) to an FTP or SFTP server. By exporting the Guard or zone configuration file to a remote server you can do the following:
•
•
To export the Guard configuration file, enter one of the following commands in global mode:
•
•
Note
Table 11-1 provides the arguments for the copy running-config ftp command.
The following example shows how to export the Guard configuration file to an FTP server:
user@GUARD# copy running-config ftp 10.0.0.191 run-conf.txt <user> <password>Importing and Updating Configuration
You can import a Guard or zone configuration file from an FTP server and reconfigure the Guard according to the newly transferred file. Import the configuration to do one of the following:
•
•
Zone configuration is a partial Guard configuration. To copy both types of configuration files to the Guard and reconfigure it accordingly, use the copy ftp running-config command.
Note
We recommend that you deactivate all zones before you initiate the import process. The Guard deactivates a zone before importing the zone configuration.
The Guard, by-default, ignores older versions of self-protection configuration. We recommend that you do not overwrite the self-protection configuration with an older configuration, because the older configuration may not be compatible with the current version.
To import a Guard configuration file, enter one of the following commands in global mode:
•
•
Note
Table 11-2 provides the arguments for the copy ftp running-config command.
The following example shows how to import the Guard configuration file from an FTP server:
user@GUARD# copy ftp running-config 10.0.0.191 scannet-conf <user> <password>When you import a configuration that was exported from an older version, the Guard displays the following message:
WARNING: The configuration file includes a self-protection definition that is incompatible with the current version and will be ignored.Continue? [yes|no]Enter one of the following options:
•
–
–
•
You can abort the import process or import the old self-protection definition as-is.WARNING: The self-protection definitions are incompatible with the current version.Abort? [yes|no]
Caution
To import the older self-protection configuration, enter no.
To abort the import process, enter yes.
Managing Disk Space
The Guard maintains activity logs and zone attack reports. If the disk usage is over 75 percent, or if a large number of zones is defined on the Guard (over 500), we recommend that you decrease the file history parameters. When the used disk space reaches about 80 percent of the disk maximum capacity, the Guard enters a warning message in its syslog. If this happens, you can perform one of the following tasks:
•
Export the Guard report list to an FTP server—See the "Exporting Attack Reports" section.
Export the zone attack reports to an FTP server—See the "Exporting Attack Reports" section.
•
•
We recommend that you periodically store the Guard records on an FTP server, and then clear the logs.
Note
To display the disk used space, enter the following command:
show disk-usage
The following example shows how to display the disk used space:
user@GUARD# show disk-usage2%Configuring Logs and Reports History
You can configure the length of time that the Guard records the logs and the attack reports of both the Guard and its zones.
To configure the report and log history, enter the following command:
history {logs | reports} days [enforce-now]
Table 11-3 provides the arguments and keywords for the history command.
If you configure the history reporting to a shorter period, reduce the log file size and the report file size to the newly configured size. To reduce the size, you can use one of the following:
•
OR
•
Reloading the Guard
You can reload the Guard configuration without rebooting the machine by using the reload command.
For the following changes to take effect, you must reload the Guard:
•
•
•
•
Rebooting the Guard and Inactivating Zones
To reboot the Guard, enter the following command:
reboot
The default behavior of the Guard is to load all zones in an inactive operation state. Therefore, the Guard does not enable zone protection or the learning process after reboot, regardless of the zone operation state prior to the reboot.
To change the default behavior so that the Guard automatically activates zones that were active prior to the reboot process, enter the following command in configuration mode:
boot reactivate-zones
Caution
Shutting Down the Guard
A clean shutdown enables the Guard to save vital information.
To shut down the Guard, perform the following steps:
Step 1
poweroffStep 2
Step 3
The green power LED turns off.
Caution
Upgrading the Guard Software Version
To upgrade the Guard software version, perform the following steps:
Step 1
See the "Exporting Configuration" section for more information.
Step 2
•
•
Note
Table 11-4 provides arguments for the copy ftp new-version command.
Step 3
install new-versionWhen you enter the install new-version command, the learning and the protection processes are deactivated.
Caution
Press Enter to close this CLI session.
If you fail to adhere to these restrictions, the upgrade may fail and cause the Guard to become inaccessible.
Step 4
The following example shows how to copy a new software version file to the Guard, and then to upgrade the software version:
user@GUARD# copy ftp new-version 10.0.0.191 /home/Versions/R3.i386.rpm user <password>FTP in progress...user@GUARD# install new-version
.
.
.
Press Enter to close this CLI session.When you upgrade the software version, the Guard updates the self-protection configuration with a new one. We recommend that you do not overwrite the self-protection configuration with an older configuration, because the older configuration may not be compatible with the current version.
Burning a New Flash Version
You can burn a new flash version only when there is a mismatch between the current Common Firmware Environment (CFE) and the software release. A mismatch condition can occur when you update the Guard software.
When a CFE mismatch is detected, the Guard displays the following message when you enter the install new-version command (X denotes the old flash version and Y denotes the new flash version):
Bad CFE version (X). This version requires version Y
Caution
To burn a new flash version, perform the following steps:
Step 1
flash-burnIf you try to burn a new flash version when the CFE and the Guard software versions match, the operation fails.
Step 2
reloadYou must enter the reload command after burning a new flash version. The Guard is not fully functional until you enter the reload command.
The following example shows how to burn a new flash version:
user@GUARD-conf# flash-burnPlease note: DON'T PRESS ANY KEY WHILE IN THE PROCESS!. . .Burned firmware successfullySYSTEM IS NOT FULLY OPERATIONAL. Type 'reload' to restart the systemRecovering a Lost Password
The Guard uses the root password to control root access. The root password is encrypted and can be only replaced by a new password.
To perform this procedure you must be connected to the Guard console.
To recover the root password, perform the following steps:
Step 1
Step 2
Step 3
The Guard displays the following prompt:
Lilo:Step 4
Cisco 1
Note
Step 5
The Guard enters the root prompt.
Step 6
The following example shows how to change the root password:
[root@GUARD root]# passwdChanging password for user root.New password: <new password typed in here>Retype new password: <new password typed in here>passwd: all authentication tokens updated successfully.Step 7
Resetting the Configuration to Factory Defaults
In certain situations, you may want to restore the Guard configuration to the original default factory settings, Resetting the configuration to factory defaults is useful when you want to remove an undesirable configuration in the Guard, if the configuration has become complex, or if you want to move the Guard from one network to another network. You can reset the Guard to the factory defaults and configure it as a new Guard.
We recommend that you back up the Guard configuration by using the copy running-config command before you reset it to the default factory settings. See the "Exporting Configuration" section.
The inband interface configuration (eth0) is available until you reload the Guard.
To reset the Guard to the factory defaults settings, enter the following command in configuration mode:
clear config all
The configuration change takes effect only after a reset.
Caution
The following example shows how to reset the Guard to the factory defaults settings:
user@GUARD-conf# clear config all
