Table Of Contents
How the Cisco Security Agent Works
Internationalization Support Tables
CSA MC Local Agent and Policies
Preparing to Install
How the Cisco Security Agent Works
The Cisco Security Agent provides distributed security to your enterprise by deploying agents that defend against the proliferation of attacks across networks and systems. These agents operate using a set of rules provided by the Management Center for Cisco Security Agents and selectively assigned to each client node on your network by the network administrator.
This section includes the following topics.
•
Cisco Security Agent Overview
•
•
Cisco Security Agent Overview
Cisco Security Agent contains two components:
•
•
Administrators configure security policies on CSA MC using the web-based interface. They distribute these policies to agents installed on end user systems and servers. Policies can allow or deny specific system actions. The agents check policies before allowing applications access to system resources.
Figure 1-1 Product Deployment
Before Proceeding
Before installing CSA MC software, refer to the Release Notes for up-to-date information. Not doing so can result in the misconfiguration of your system.
Make sure that your system is compatible with the Cisco product you are installing and that it has the appropriate software installed.
Read through the following information before installing the CSA MC software.
System Requirements
Note
CSA MC is a component of the CiscoWorks VPN/Security Management Solution (VMS). The CSA MC installation also checks for the required version of VMS and will abort the installation if the correct version is not present.
For information on all bundle features and their requirements, see the CiscoWorks2000 VPN/Security Management Solution Quick Start Guide.
Table 1-1 shows VMS bundle server requirements for Windows 2000 systems.
Table 1-1 Server Requirements
•
•
•
If you are planning to deploy no more than 500 agents, the shipped version of Microsoft SQL Server Desktop Engine should be adequate. For a larger deployment, you also have the option of installing Microsoft SQL Server 2000 instead of using the Microsoft SQL Server Desktop Engine that is provided. Note that of you are using SQL Server 2000, it must be licensed separately and it must be installed on the system before you begin the CSA MC installation. See "Installing the Management Center for Cisco Security Agents" for details.
To run the Cisco Security Agent on Windows servers and desktop systems, the requirements are as follows:
Table 1-2 Agent Requirements (Windows)
To run the Cisco Security Agent on your Solaris server systems, the requirements are as follows:
Table 1-3 Agent Requirements (Solaris)
Caution
To run the Cisco Security Agent on your Linux systems, the requirements are as follows:
Table 1-4 Agent Requirements (Linux)
Note
Note
Caution
DNS and WINS Environments
For agents and browsers to successfully communicate with CSA MC, the CSA MC machine name must be resolvable through DNS (Domain Name Service) or WINS (Windows Internet Naming Service).
Browser Requirements
You use a web browser to access the CiscoWorks UI. In order to view CSA MC both locally on the system where you are installing CiscoWorks and for remote access. Browser requirements are as follows:
Internet Explorer:
•
•
•
Netscape:
•
•
•
Note
Time and Date Requirements
Before you install CSA MC, make sure that the system to which you plan install the software has the correct and current time, date, and time zone settings. If these settings are not current, you will encounter MC/agent certificate issues.
Windows Cluster Support
Cisco Security Agent supports Network Load Balancing and Server Cluster for Windows 2003 and 2000 Server platforms. Cluster support may require certain network permissions to operate. As with other network services, your CSA MC policies must account for these network permissions. (Component Load Balancing, and Solaris and Linux Clusters are not officially supported in this release.)
Internationalization Support
All Cisco Security Agent kits contain localized support for English, French, German, Italian, Japanese, Korean, Simplified Chinese, and Spanish language desktops. This support is automatic in each agent kit and no action is required by the administrator. The agent UI, events, and help system will appear in the language of the end user's desktop.
The following table lists CSA localized support and qualification for various OS types.
Table 1-5 CSA Localizations
Explanation of terms:
Localized: Cisco Security Agent kits contain localized support for the languages identified in Table 1-5. This support is automatic in each agent kit and no action is required by the administrator. The agent UI, events, and help system will appear in the language of the end user's desktop. All localized languages are agent qualified and supported. (CSA MC is not localized.)
Qualified: The Cisco Security Agent was tested on these language platforms. Cisco security agent drivers are able to handle the local characters in file paths and registry paths. All qualified languages are supported.
Supported: The Cisco Security Agent is suitable to run on these language platforms. The localized characters are supported by all agent functions.
Refer to the following tables.
Internationalization Support Tables
The following tables detail the level of support for each localized version of Windows operating systems. Note that support for a localized operating system is different from localized agent. A localized operating system may be supported even though the corresponding language is not translated in the agent. In this case, the dialogs will appear in English. The tables below define the operating system support, not agent language support. Note, for Multilingual User Interface (MUI ) supported languages, installs are always in English (Installshield does not support MUI), and the UI/dialogs are in English unless the desktop is Chinese (Simplified), French, German, Italian, Japanese, Korean, or Spanish.
Any Windows 2000, Windows XP or Windows 2003 platforms/versions not mentioned in the tables below should be treated as not supported.
The following letter combinations are used to describe the level of support:
Table 1-6
Support Level Key
Table 1-7 Windows 2000 Support
Table 1-8 Windows XP Support
Table 1-9 Windows 2003 Support
On non-localized but tested and supported language platforms, the administrator is responsible for policy changes arising from directory naming variations between languages.
If the previous operating system tables do not indicate that CSA is localized (L) then the system administrator is responsible for checking to ensure that the tokens are in the language they expect and the directory path is the one they intend to protect.
To determine if language tokens are correct, follow this procedure:
Step 1
Step 2
Step 3
Step 4
Step 5
Figure 1-2 Diagnosis for Localized Host
CSA MC Local Agent and Policies
The CSA recommended deployment is to have only CSA MC and Security Monitor installed as part of your VMS bundle on the CSA MC system. When you install CSA MC, an agent containing the policies necessary to protect CSA MC and other limited CiscoWorks daemons and operations is automatically installed as well. The policies that are enforced by this agent are fairly restrictive and are appropriate if you are running the recommended deployment.
If you are running other non VMS products or software on the CiscoWorks system, this restrictive policy may impede these other products. Although, it is recommended that you do not install other products on the CSA MC system (other than Security Monitor), you can do so if you remove the restrictive policy from the agent protecting the system, leaving you with a more open policy. Without the restrictive policy, the system remains protected, but the policy allows more products to run on the system and access network resources. Therefore, the system is inherently less secure. If you wish to deploy CSA MC on a system running other software, navigate to the "CiscoWorks VMS Systems" Group and remove the "CiscoWorks Restrictive VMS Module" from the group.
Note
Cautionnet stop "Cisco Security Agent". (You may receive a prompt asking if you want to stop the agent service. You should answer Yes.) To enable the service, typenet start "Cisco Security Agent".
If you do not disable the agent service and you attempt to alter a CiscoWorks system configuration, the agent may disallow the action or it may display multiple queries to which you must respond.
Installation Note
Any system to which you are installing CSA MC or the Cisco Security Agent itself must not have the Cisco IDS Host Sensor Console or the Cisco IDS Host Sensor installed. If the CSA MC or the agent installer detect the presence of any Cisco IDS Host Sensor software on the system, the installation will abort.
Because there may be incompatibilities between Cisco IDS Host Sensor software and CSA MC or agent software, you must uninstall the Cisco IDS Host Sensor and Cisco IDS Host Sensor Console software before installing CSA MC or agent software. Documentation for uninstalling Cisco IDS Host Sensor software can be found at the following location:
http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/host/host25/install/hidsch2.htm#1024883
About CSA MC
The CSA MC user interface installs as part of the overall Cisco Security Agent solution installation and is managed from CiscoWorks 2000. It is through a web-based interface that all security policies are configured and distributed to agents. CSA MC provides monitoring and reporting tools, letting you generate reports with varying views of your network enterprise health and status. Providing this web-based user interface allows an administrator to access CSA MC from any machine running a web browser.
See the User Guide for further details.
Figure 1-3 CSA MC, Top Level View
