-
User Guide for Cisco Security Manager 3.0.2
-
Preface
-
Getting to Know Security Manager
-
Performing Administrative Tasks
-
Working With the Security Manager User Interface
-
Using Map View
-
Managing Devices
-
Managing Policies
-
Managing Activities
-
Managing Objects
-
Managing Site-to-Site VPNs
-
Managing Remote Access VPNs
-
Managing Firewall Services
-
Managing Routers
-
Managing Firewall Devices
-
Using the Catalyst 6500/7600 Device Manager
-
Managing Deployment
-
Using Tools
-
Devices User Interface Reference
-
Site-to-Site VPN User Interface Reference
-
Policy User Interface Reference
-
Map View User Interface Reference
-
Tools User Interface Reference
-
Administrative Settings User Interface Reference
-
Activities User Interface Reference
-
Deployment User Interface Reference
-
Index
-
Table Of Contents
Submitting an Activity for Approval
Approving or Rejecting an Activity
Understanding Activity Change Reports
Managing Activities
When using Workflow mode, all policy definition and assignment tasks must be done within the context of an activity. If you are using non-Workflow mode (the default mode of operation in Security Manager), you do not need to create and manage activities. For more information, see Working in Non-Workflow Mode, page 2-41.
The following topics provide information about activities:
–
Submitting an Activity for Approval
–
–
Understanding Activities
An activity is a temporary context within which you define policies and assign them to devices. You need not create an activity to import or create devices. However, you do need to create an activity or open an existing activity before you define policies or assign them to devices.
When you create an activity, you open a virtual copy of the Security Manager policy database. You define and assign policies within this copy. Changes that you made within this copy are only available within the copy. Other users in different activities cannot see these changes. After the activity is submitted and approved, the changes within this copy are committed to the database so that all other users can view the changes.
Then, you can create a deployment job to generate the relevant CLI commands and deploy them to the devices.
Note
The following topics describe why activities are important and how they operate in Workflow mode:
•
•
Benefits of Activities
You use activities to control changes made to policies and policy assignments. Although how activities are implemented depends on the workflow settings you choose, however all activities provide the following benefits:
•
•
•
In addition, the changes you make within an activity are visible only within the activity. Other users will see only the last approved committed configurations, unless they view your activity before you close it.
Activity Approval
When you enable Workflow mode, you can choose to operate with or without an activity approver.
If your organization requires a different person with higher permissions to approve activities, you can enable workflow with an approver. When using Workflow mode with an approver, the activity must be approved by a person with the appropriate permissions so the policies can be committed to the database. This approval process at the policy definition level helps to ensure that no inappropriate configurations reach the network devices.
If you choose to operate without an approver, the person defining the policies has the permissions to approve them.
Note
Activities and Locking
Activities introduce a locking model. This is useful in large networks where several people have the authority to make configuration changes. It prevents two or more people from making changes to the same feature policy, policy assignment, or object at the same time.
In addition, Security Manager uses locking to ensure that operations related to the committed configuration always run exclusive of one another. These operations can be divided into two categories:
Operations that change the committed configuration:
•
•
•
Operations that read the committed configuration:
•
•
•
•
If you are performing an operation that changes the committed configuration, you cannot perform any of the operations in either list until this operation is complete. An error message is displayed if you try. For example, if you are approving an activity (which occurs automatically when an activity is submitted in non-Workflow mode), you cannot delete a device or validate a different activity until the approval is complete. This type of locking is particularly important in multi-user settings as it prevents multiple users from simultaneously making changes to the committed configuration.
If you are performing an operation that reads the committed configuration, you cannot perform an operation that changes the committed configuration. For example, if you are validating an activity, another user cannot approve an activity. However, you may perform another operation that reads the configuration. For example, if you are validating an activity, another user can create a deployment job. Similarly, if you are previewing the configuration before deployment, another user is permitted to do the same. This is because these two operations are limited to reading the committed configuration; they do not make any changes to it.
Related Topics
•
•
•
•
•
Activities and Multiple Users
Only one user can define or change policies within an individual activity at one time. However, when Workflow mode is enabled, multiple users can work in the activity in sequence. That is, if an activity is closed (but not yet approved or submitted for approval), another user can open it and make changes to it. Multiple users can work in parallel in different activities.
Understanding Activity States
An activity has four primary states:
•
If the browser session terminates while you are editing an activity, Security Manager prompts you to save your changes, then closes the activity.
•
When an activity is submitted, an email is sent to the approver. The approver can open the activity (in read-only mode) to review the changes within the activity, then approve or reject it. An approved activity moves to the approved state. A rejected activity returns to the Edit state.
•
•
Figure 7-1 shows the stages in the activity workflow without an approver (default). Figure 7-2 shows the stages in the activity workflow with an approver.
For a complete list and descriptions of activity states, see Activity States, page G-4.
Figure 7-1 Activity Workflow without an Approver
Figure 7-2 Activity Workflow with an Approver
Working with Activities
The following topics provide information to help you use activities:
•
•
Accessing Activity Functions
You can access activity management functions in the following ways:
•
•
–
–
–
For descriptions of the buttons on the main toolbar, see Table 7-1.
Table 7-1 Main Toolbar Buttons—Workflow Mode Enabled
Creates a new activity.
Opens an activity. You can open an activity when it is in the Edit or the Submitted state.
To open a submitted activity, you must have user privileges to approve or reject changes made in that activity. For more information, see Setting Up User Permissions, page 2-2.
Saves all changes made while the activity was open and closes it.
You can close an activity when it is in the Edit Open or the Submit Open state.
Generates change data and produces an Activity Change Report in PDF format in a separate window. For more information, see Understanding Activity Change Reports
Submits the activity for approval.
You can submit an activity when it is in the Edit or the Edit Open state.
Approves the changes proposed in an activity.
You can approve an activity when it is in the Submitted state. You must have user privileges to accept the changes proposed in an activity. For more information, see Setting Up User Permissions, page 2-2.
This action is not available in Workflow mode without an approver.
Rejects the changes proposed in an activity.
You can reject an activity when it is in the Submitted or Submitted Open state. You must have user privileges to deny changes proposed in an activity. For more information, see Setting Up User Permissions, page 2-2.
This action is not available in Workflow mode without an approver.
Discards the selected activity. The activity is discarded and later purged from the system when you perform the purge action, either automatically as set in the Workflow Management page or manually. The activity state is shown as discarded until the activity is actually purged from the system.
Validates the integrity of changed policies within the current activity.
Creating an Activity
This procedure describes how to create an activity.
Before you create or change policies or assign policies to devices, you must create an activity.
Procedure
Step 1
The Create Activity dialog box appears.
Step 2
Step 3
Step 4
The activity is listed by name in the Activity Manager window. For more information, see Activity Manager Window, page G-1.
Related Topics
•
Opening an Activity
This topic describes how to open an activity.
You can open an existing activity if no one else has it opened. You might open an existing activity in the Edit state to make further policy changes, or you might open an existing activity in the Submitted state to review proposed policy changes before approving or rejecting it (if you have the appropriate permissions and you are working in Workflow mode with an approver). For more information, see Chapter 2, "Performing Administrative Tasks."
Note
To open an activity, do one of the following:
•
•
Related Topics
Closing an Activity
You can close an activity without approving it (or submitting it for approval) if you or others want to continue configuring policies at a later time.
Note
To close an open activity, do one of the following:
•
•
Related Topics
Validating an Activity
Security Manager validates activities when you submit them for approval, or you can validate an activity at any time while you are creating and changing policies in an activity. After an activity is submitted, the validation report remains static.
The validation process checks the following and displays a report of the results:
•
•
•
•
•
Note
Procedure
Step 1
•
•
Security Manager performs the validation. If no errors are found, an informational message shows that the validation passed. If errors are found, the Validation dialog box appears. The Validation dialog box contains detailed error information organized in two tabs. You must correct these errors before submitting the activity. Security Manager does not allow an activity to be submitted with validation errors.
Note
Step 2
Related Topics
•
Submitting an Activity for Approval
This procedure describes how to submit an activity for approval.
After you finish creating, changing, or assigning policies within the activity, you must submit the activity for approval. When you submit it, the integrity and deployability of the activity is validated. For details about the validation process and report, see Validating an Activity.
The activity is also closed so that it can be opened by the user who has the permissions to approve it. When the activity is approved, its configurations are committed to the Security Manager database, and they can be deployed to the devices.
When you submit an activity, you can send email to the relevant approvers to notify them that an activity requires approval.
Note
Procedure
Step 1
•
•
The Submit Activity dialog box appears.
Step 2
Note
Step 3
Step 4
Note
Related Topics
•
Approving or Rejecting an Activity
This procedure describes how to approve or reject an activity.
If you have activity approval permissions, you can open a submitted activity, review the policies and policy assignments, and then either approve or reject the activity.
If you approve the activity, policies and policy assignments are committed to the database and are ready to be deployed to devices or files. Devices associated with the activity are unlocked, meaning they can be included in policy definitions and changes in other activities.
If you reject the activity, the submitter can reopen the activity to make the necessary changes and resubmit it for approval. Devices associated with the activity are not unlocked, meaning that they cannot be included in policy definitions or changes in another activity.
Note
Before You Begin
•
Procedure
Step 1
•
•
The Approve Activity or Reject Activity dialog box appears.
Step 2
Step 3
Related Topics
•
•
Understanding Activity Change Reports
From the Tools > Change Reports menu (non-Workflow mode), or the Activities menu (Workflow mode), you can select View Changes to view reports about actions that users have taken within an activity. You can see which actions were taken and what devices and groups were acted upon within an activity or configuration session (non-Workflow mode). A report generated in PDF format format identifies the policy and building block changes made as part of that activity.
Note
A three-level menu structure view shows which actions were taken and what devices and groups were acted upon. It also identifies the policy changes made as part of that activity, including changes to policy objects. You can use the PDF bookmark feature to navigate the report.
Note
Figure 7-3 shows a sample activity report.
Figure 7-3 Activity Report
Use File > View Changes to obtain an Activity Change Report that only reports changes on the current activity (or configuration session in non-Workflow mode).
Related Topics
•
•
Discarding an Activity
This topic describes how to discard an activity.
You can discard an activity if it is no longer required. When you discard an activity, you delete all the policies and policy assignments that were defined within the activity. Those policies and policy assignments are not in the database; therefore, they cannot be deployed.
Discarded activities are removed from the system according to the settings defined in the Administrative Settings Workflow page, and devices associated with the activity are unlocked, meaning they can be used by other activities. For more information see Workflow Page, page F-25.
To discard an activity, do one of the following:
•
•
Related Topics
•
Displaying Activity Details
This procedure describes how to display activity details.
For a specific activity, you can view details, such as the activity ID and name, the date and time that an activity was created and last modified, and any comments that the user entered when changing the activity state.
Procedure
Step 1
Step 2
Step 3
Related Topics
Displaying Activity History
This procedure describes how to display historical information about an activity.
The Activity History tab displays actions that occurred to the selected activity since it was created. Each row in the table show the action that occurred, the user who performed the action, the date and time it occurred, and comments, if any, that the user entered.
Procedure
Step 1
Step 2
Step 3
Related Topics
