 Feedback
|
Table Of Contents
Release Notes for Cisco Security Manager 3.2.2
What's New in Security Manager 3.2.2 (Including SP1, SP2, SP3, and SP4)
Cisco Security Manager 3.2.2 Service Pack 4 Download and Installation Instructions
Cisco Security Manager 3.2.2 Download and Installation Instructions
Catalyst 6500/7600 Configuration
Device Management, Deployment, and Discovery
Diagnostics, Monitoring, and Troubleshooting Tools
Site-to-Site/Remote Access/SSL VPN Configuration
Obtaining Documentation and Submitting a Service Request
Release Notes for Cisco Security Manager 3.2.2
Revised: October 11, 2010
Note
Do not use this version of Security Manager to manage ASA 8.3 devices. This version of Security Manager configures ASA 8.3 devices in downward-compatibility mode, meaning that the device configuration does not use the new features introduced in version 8.3. Because of the extensive changes introduced with version 8.3, it is not downwardly-compatible with older ASA releases. If you want to manage ASA 8.3 devices with Security Manager, you must upgrade to Security Manager 4.0.
Introduction
Note
This document contains release note information for the following:
•
Cisco Security Manager (Security Manager) enables you to manage security policies on Cisco security devices. Security Manager supports integrated provisioning of firewall, VPN, and IPS services across IOS routers, PIX and ASA security appliances, and Catalyst 6500/7600 services modules (FWSM, VPNSM, VPN SPA, and ISDM-2). Security Manager also supports provisioning of many platform-specific settings, for example, interfaces, routing, identity, QoS, logging, and so on.
Security Manager efficiently manages a wide range of networks, from small networks consisting of a few devices to large networks with thousands of devices. Scalability is achieved through a rich feature set of device grouping capabilities and objects and policies that can be shared.
Security Manager supports multiple configuration views optimized around different task flows and use cases.
•
The Auto Update Server (AUS) is a tool for upgrading PIX security appliance software images, ASA software images, PIX Device Manager (PDM) images, Adaptive Security Device Manager (ASDM) images, and PIX security appliance and ASA configuration files. Security appliances with dynamic IP addresses that use the auto update feature connect to AUS periodically to upgrade device configuration files and to pass device and status information.
To manage the devices in Security Manager, you must provide the device identity and the AUS information when you add a device. Security Manager uses the device identity information to retrieve the device IP address from an AUS that can be reached.
Note
This release note document includes ID numbers and headlines for each known problem identified in the document and a description of each. This document also includes a list of resolved problems. If you accessed this document from Cisco.com, you can click any ID number, which takes you to the appropriate release note enclosure in the Bug Toolkit. The release note enclosure contains symptoms, conditions, and workaround information.
What's New in Security Manager 3.2.2 (Including SP1, SP2, SP3, and SP4)
Cisco Security Manager 3.2.2 Service Pack 4
Security Manager 3.2.2 Service Pack 4provides support for changes to the mechanism used for downloading sensor and signature updates from Cisco.com.
Security Manager 3.2.2 Service Pack 4also provides fixes for various problems. For more information, see Resolved Problems in Security Manager 3.2.2 Service Pack 4.
Cisco Security Manager 3.2.2 Service Pack 3
The following changes have been made for Security Manager 3.2.2 Service Pack 3:
•
•
Note
Cisco Security Manager 3.2.2 Service Pack 2
The following changes have been made for Security Manager 3.2.2 Service Pack 2:
•
•
Cisco Security Manager 3.2.2 Service Pack 1
The following changes have been made for Security Manager 3.2.2 Service Pack 1:
•
•
•
•
•
Cisco Security Manager 3.2.2
The following changes have been made for Security Manager 3.2.2:
•
•
•
•
Note
•
•
•
Installation Notes
•
•
•
•
Cisco Security Manager 3.2.2 Service Pack 4 Download and Installation Instructions
Service pack 4 is a cumulative update that also includes the updates that were found in service packs 1, 2 and 3. You can apply Cisco Security Manager 3.2.2 Service Pack 4 to a Cisco Security Manager 3.2.2 installation whether that installation has previous service packs installed or not.
Note
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Step 7
Step 8
Step 9
Step 10
a.
b.
You will be prompted to "Download Service Pack".
c.
Step 11
Cisco Security Manager 3.2.2 Download and Installation Instructions
To download and install Cisco Security Manager 3.2.2:
Step 1
Step 2
Note
Step 3
Note
Step 4
Note
Tip
Important Notes
•
•
copy %NMSROOT%\MDC\athena\ha\agent\monitor.pl %VCS_HOME%\BIN\CSManager\bin\monitor.plfor example,copy C:\Program Files\CSCOpx\MDC\athena\ha\agent\monitor.pl C:\Program Files\Veritas\cluster server\bin\CSManager\monitor.pl•
•
•
•
•
•
•
•
•
•
HTTP_PORT=<port_number>HTTPS_PORT=<port_number>When you start the client the next time, it uses the updated port numbers, based on the protocol selected, to communicate with the server.
•
1.
2.
3.
4.
5.
6.
7.
Note
•
•
•
•
•
Caution
Resolved Problems
Service Pack 4 is a cumulative release that contains all problem resolutions included in Service Pack 4, as well as those in Service Packs 1, 2, and 3.
•
•
Note
•
•
•
Table 1 Resolved Problems in Security Manager 3.2.2 Service Pack 4
Table 2 Resolved Problems in Security Manager 3.2.2 Service Pack 3
Table 3 Resolved Problems in Security Manager 3.2.2 Service Pack 2
Table 4 Resolved Problems in Security Manager 3.2.2 Service Pack 1
Table 5 contains problems that were resolved in Security Manager 3.2.2.
Table 5 Resolved Problems in Security Manager 3.2.2
Known Problems
This section contains information about the problems known to exist in Cisco Security Manager 3.2.2. The known problems are arranged into the following tables:
Note
•
•
•
•
Catalyst 6500/7600 Configuration
Table 6 Catalyst 6500/7600 Configuration
Description: Deployment fails when you attempt to change the running mode of the data port VLAN from Trunk (IPS) to Capture (IDS) from the IDSM Data Port VLANs dialog box and the following error message is displayed:
Command Rejected: Remove trunk allowed vlan configuration from data port 1 before configuring capture allowed-vlansDescription: If you modify the allowed VLANs of an IDSM data port that has been configured as a capture port and deploy configurations to the device, the following error occurs:
"Capture not allowed on a SPAN destination port"Description: Deployment might fail when you attempt to modify the physical port configuration type from access to trunk mode for a Catalyst switch and keep the Enable DTP negotiation check box selected in the trunk port mode.
Device Management, Deployment, and Discovery
Table 7 Device Management, Deployment, and Discovery
Description: Device level overrides for policy objects corresponding to object groups can be created after discovering only the inventory policies like interfaces.
Description: If you change the credentials for the admin context when using HTTPS as the transport protocol, Security Manager cannot connect to the system execution space (for FWSM). Ensure that you define the same credentials for both the admin context and the system execution space when using HTTPS.
Description: After Security Manager successfully deploys the configuration file to CNS, and Cisco IOS routers configured for CNS poll and apply the configuration changes at the predefined polling period, the Status column in the Deployment Manager window continues to display the job state as "Deploying."
Description: Cisco Security Manager 3.2 does not support ASA/FWSM interfaces that use *,(, or ) in the interface name.
Description: If you restore a database backup to a server running Security Manager, and the backup does not include the Security Manager database (for example, it includes AUS and CiscoWorks Common Services, or Performance Monitor and Common Services), the device tree might not appear in the Security Manager client.
Diagnostics, Monitoring, and Troubleshooting Tools
Table 8 Diagnostics, Monitoring, and Troubleshooting Tools
Description: If you try to perform events lookup from the default signature, a "Policy not found" error message is displayed. However, if you edit the default signature and save it, the policy icon changes to show that a local policy is configured on the device and you can navigate to events in MARS.
Description: When you try to start the Security Manager client from the read-only policy query window in MARS, the File Download dialog box appears prompting you to confirm whether you want to download the CsmContentProvider file to your system.
Description: The disconnection between the Host Name field in the Device Properties page and the Host Name field in the policy page under the Device Admin section of the Security Manager GUI causes problems on FWSM blades with multiple contexts because a unique context cannot be identified during policy lookup from MARS events.
Description: MARS user credentials for events lookup are retained in the Security Manager cache even after you change the authentication mechanism to prompt the user for Security Manager credentials instead of MARS credentials.
Description: When you look up a MARS event generated by an access rule, disabled rules in the Security Manager rules table are not shown as inactive in the read-only policy query window.
Description: If you configured the option to use Security Manager credentials for events lookup, neither the query page in MARS nor the login dialog box is displayed and events lookup fails.
Firewall Services
Table 9 Firewall Services
Description: Although the GUI allows you to enable the Object Group Search option for FWSM devices, the FWSM does not expand object groups when listing access rules after a "show access-list" command and Hit Count results are inaccurately displayed.
Description: Security Manager does not check if the firewall rules that you configured in Security Manager permit management traffic (SSH and HTTPS) to the IOS device being managed. As a result, after firewall rules are deployed to the device, connection to the device might be lost.
Description: IOS 87x ISR routers do not support BGP as a routing protocol or as a service in ACLs when the device has only 24 MB of memory; however, BGP is supported when the device has more than 24 MB memory. Security Manager does not detect the amount of memory available on the device and cannot enforce any restrictions. As a result, job deployment containing an ACL with ACEs having BGP will fail.
Description: IOS devices require that HTTP is used as the traffic type for authentication proxy, which generates the command ip http server. Security Manager does not remove the CLI when authentication proxy is unassigned from the device in Security Manager.
Description: If an AuthProxy configured on an IOS device has a user-specified name that does not comply with the naming convention used by Security Manager, the name is not removed if the device is discovered and the policy is unassigned.
Description: IOS devices use standard ACLs for filtering; however, standard ACLs are not recognized when Hit Count reports are generated.
Description: IOS inspection port-map commands are not generated if inspection rules configured in Security Manager conflict with port definitions of predefined inspection protocols.
Description: Some options are omitted from rules that are created using the Import Rules tool, for example, empty port values and destination port values that are not validated for 'eq' and 'neq' for IOS devices.
Description: Changes to the match-condition order for a gtp-map used in a PIX 7.0 or PIX 7.1 device do not get deployed to the device.
Installation and Upgrade
Table 10 Installation and Upgrade
Description: On the System Requirements screen of the Security Manager installation, the Back button does not return you to the previous step.
Description: When you try to log in to the Security Manager client after installing the 3.2, 3.2.1 or 3.2.2 software on your system, a popup message is displayed with the message "CMF session-id cannot be assigned". When you try to log in to the CiscoWorks home page on a 3.2, 3.2.1, or 3.2.2 server, the following message is displayed:
Forbidden
You don't have permission to access /cwhp/LiaisonServlet on this server.
Additionally, a 403 Forbidden error was encountered while trying to use an ErrorDocument to handle the request.
Description: CSAgent cannot be stopped automatically due to a limitation within the application.
IPS and IOS IPS
Table 11 IPS and IOS IPS
Description: After discovering a device that has a custom signature with the atomic-ip engine, deleting that custom signature, and creating a new custom sig with an engine different from atomic-ip, configuration preview will cause errors an d the configuration will not be generated.
Description: Signature update to a IOS IPS device can fail if using HTTP as protocol and if the device console logging is turned on.
Description: This defects occurs during deployment. If a signature "edit" parameter (severity, enable, disable, action, retired, or SFR) is the same as the value defined in the default, then it is assumed that the parameter is defined from default, even though the parameter might have been edited.
Description: If you select Show Content from the popup menu in the Victim Address column then you will actually be seeing the content of the Attacker Address column.
Description: Out-of-band (OOB) OPSIG/OPACL (signature ID 50000-59999) configuration changes on a device are not automatically synchronized during deployment.
Description: Deployment of an NTP policy with policy objects fails under certain conditions.
Description: Policy object values are not deployed correctly if they are overridden at the virtual sensor level.
Description: Discovery fails for a device that has more than one row for a target value such as "high." Deployment from Security Manager to a device that has out-of-band changes fails, too. Removing one entry from the device lets both operations succeed.
Description: Deployment to a IOS router containing NM-CIDs (router module) fails if AIM-IPS Interface Policy is accidentally deployed to the router.
Description: In the areas of Event Actions and Anomaly Detection, creating variables of the same name leads to Deployment errors.
Description: If the user creates a greenfield device, and the device has IPS metadata which is not registered in the Security Manager database, and then the user edits IPS policy and tries to deploy it to the device, deployment fails.
Description: Deployment fails after (1) creating a policy object for Target Value Rating and another policy object for OS-Identification and then (2) copying the Event Action policy to an IPS 5.1 device. (Only the TVR is applicable to the 5.1 device.)
Description: This defect occurs when a user creates a greenfield IOS IPS device, enables IPS, adds IPS policy, and previews it. The preview doesn't show the IPS drop-down option.
Description: When copying from a live device at 12.4(15)T3 to a greenfield device at 12.4(11)T2, signature engine parameters are not copied.
Description: This defect occurs in Workflow mode with more than one user, for example, User1 and User2. User1 logs in, creates a new activity, creates a greenfield sensor, and clicks on Validate; the result is an AllowedHosts error, so User1 closes the activity. Next, User2 logs in, creates a new activity, creates a greenfield IOS IPS, and clicks on Validate; the result is an AllowedHosts error for the 1st device AND an InterfaceRule error for User2's IOS IPS device.
Description: When IPS updates are scheduled to be downloaded with option set as "Daily" and every two days at a designated time, automatic download does not work at the correct intervals.
Description: During IPS updates on IOS IPS devices, changes made in the Edit Parameters area are lost after deployment when more than one context is involved.
Description: Some IPS automatic update take effect without submitting and approving an activity.
Description: For some IPS devices, including the IPS-4260, copying the interface policy from one device to an identical device fails when the interface configurations are different.
Description: This defect is seen after copying a virtual sensor policy, with interfaces assigned to the VS, from one IPS sensor to a second sensor of the same model. If the user unassigns the interface policy on the second sensor, and then submits and deploys, deployment fails but no validation error is thrown.
Description: This problem occurs when the user leaves the Cisco.com or proxy server settings empty and schedules auto Download, Apply, and Deploy for selected devices. Cisco Security Manager does not check CCO or proxy server settings before allowing user to configure Auto deploy to device.
Description: This problem occurs when the user clicks on the change report. The result is an error saying, "The changes you made for this activity are not available for viewing..." It happens for the activities/changes done as part of the IPS auto update.
Description: When using 0.0.0.0-255.255.255.255 in the OS Identification field in Network Information, this value is automatically converted to BB call <any> which the customer does not want to be converted this way. This causes a problem for the monitoring task. When the customer modifies the Target Value Rating (TVR) in this screen the BB <any> is sent to the devices.
Description: When Security Manager fails to push a signature package to an IPS device in a deployment job because of an expired license or a device timeout, subsequent signature tuning deployments also fail.
Description: Security Manager fails to display the signature description from the local NSDB for signatures newly added into signature updates for version S340 or higher.
Description: "Error loading page" for the NTP page occurs if the user copies an NTP policy from an IPS device running 6.1.1 to an IPS device running 5.x or 6.0.4.
Description: For IDSM devices running 6.1(1), virtual sensors cannot be copied.
Description: This problem occurs after deployment of virtual sensors on an IPS 6.2 device. The rule profiles exchange names; for example, the rule profile name for vs1, originally rules1, becomes rules2.
Description: This problem occurs after importing an IPS 6.0 device with a virtual sensor. After applying an IPS update and deploying the device, the deployment status for the virtual sensor is shown as "deploying" even after the deployment is successful.
Description: After updating an IPS device running 6.0.4E1 or 6.0.4aE1 and then applying an engine update, the Analysis Engine stops.
Description: This problem occurs after configuring Risk Category for all the virtual sensors in an IPS 6.1(1) device, and then editing the Event Action Rules, discovering, and deploying. Deployment sometimes exchanges the names of the rule profiles.
Description: For unsupported IPS commands, the deployment interface states that the changes are out of band.
Description: If time zone settings are changed out of band after IPS device discovery, Security Manager overrides those settings during the next discovery.
Description: User cannot discover or deploy 10 gigabit values in interface speed for IPS 6.1.2 devices.
Description: Discovery and deployment of an IPS 6.2 device where an IPv6 variable is configured for Event Action Rules or Signatures in Cisco Security Manager 3.2.2 service pack 1 fails. Cisco Security Manager 3.2.2 SP1 will handle only IPv4 addresses. User must make sure that IPS 6.2 device does not contain any IPv6 variables before discovering it in Cisco Security Manager 3.2.2 SP1.
PIX/ASA/FWSM Configuration
Table 12 PIX/ASA/FWSM Configuration
Description: Deployment fails for NAT commands and an error message states that the NAT command is a duplicate and was already defined on the device.
Description: If you deallocate a subinterface from a security context and delete it from the interface table, deployment fails on PIX 7.x and ASA devices in multiple context mode.
Description: After you configure your username, password, and privilege level on the Contact Credentials page, the information is sent to the device during every deployment.
Description: Changing the admin context in multi- or mixed mode causes the connection between Security Manager and the device to be lost.
Description: Security Manager does not prevent certain invalid OSPF configurations from being discovered.
Description: A bridge group name defined in the Security Manager user interface cannot be rediscovered.
Description: Security Manager does not support interface alias for FWSM devices. If you try to configure interface alias on an FWSM, it might result in deployment failure for a security context.
Description: When deploying to a virtual context that is designated for Failover group 2 (and subsequently becomes the Standby context on the Primary unit), numerous errors are returned for every command deployed.
Description: Creating a Failover policy that uses the same IP address as another interface, especially the Management IP address, does not produce a conflict message.
Description: Assigning a PPPoE-enabled interface to a device's Failover configuration does not produce an error message. PPPoE and Failover should not be configured on the same device interface.
Description: Any interface designated as a backup interface should not be used for Failover. However, no checks are performed for this condition.
Description: Swapping the VLAN interfaces assigned as LAN-based and Stateful Failover links on an FWSM 2.3(x) causes a deployment failure.
Description: Although Security Manager successfully deploys the configuration file to CNS, PIX Firewall devices configured to use CNS as the transport server cannot retrieve updates from CNS at the preset polling time and an error is entered in the device log file.
Description: De-allocating an interface from a security context, then assigning that interface as a failover link, and deploying these changes all at once causes a deployment error.
Description: When an SLA monitor object is used in route tracking by static route, PPPoE, or DHCP, no commands for the SLA monitor are generated if the SLA monitor object references an interface role that cannot be resolved to a valid interface policy on the device.
Description: On a 7.2 ASA/PIX with multiple AUS servers, changing the order of the AUS servers does not generate any commands.
Description: Swapping interface names among the interfaces on a device causes a deployment to fail.
Description: RIP configuration commands in PIX/ASA 7.2(1) cannot be fully managed using Security Manager 3.1.
Description: On an ASA 5505 device that has four interfaces configured using nameif, if you select the Management Only option for an interface that has backup interface configured, deployment to the device fails.
Description: Deployment may fail after deleting a subinterface included in the Failover monitor table.
Description: On an ASA in transparent mode, an error may occur if you add a "Management Only" subinterface before configuring the "Management Only" interface.
Description: After import/discovery of a security appliance on which Accounting enabled but no Privilege Level set, the default Privilege Level is 1; it should be zero.
Description: After adding a new multiple-mode ASA to Security Manager, attempts to discover it fail, with an "Invalid device type or version" message.
Description: Security Manager does not currently support configuration of the sensor <sensor_name> portion of the ips command, although it will pass that portion through during initial deployment of a so-configured device. However, with ips {inline | promiscuous} {fail-close | fail-open} sensor <sensor_name> configured on a device, if the containing class map changes for any reason, Security Manager will redeploy only the ips {inline | promiscuous} {fail-close | fail-open} portion of the command.
Description: The current default half connection timeout (the idle time after which a TCP connection is half-closed) for the FWSM 3.2.4 is 0:10:0, which is not in the valid range of 0:0:1 to 0:4:15. If you do not update the half connection timeout value, a validation error is generated.
Description: This problem occurs when deploying other policies changes for PIX 8.0(4) device.
Description: Deployment of SSL VPN settings to an ASA 8.x fails when Cache Compressed Content is selected on Remote Access VPN > SSL VPN > Other Settings: Performance tab.
Router Configuration
Table 13 Router Configuration
Description: The deployment of NAT interface commands ip nat inside and ip nat outside fails on Cisco 83x Series routers.
Description: Virtual interfaces remain intact in a Cisco IOS router configuration even after you delete these interfaces from the Interfaces page in Security Manager.
Description: Security Manager partially discovers PPP configurations that contain the if-needed and local-case keywords for AAA.
Description: Deployment fails when NetFlow is configured on a subinterface, even though a validation error is not given.
Description: The dot1x max-req value command is generated at the global level of the device configuration instead of the interface level.
Description: Deployment fails because PPP policy includes multilink commands that are not supported on the device.
Description: If Security Manager is upgraded to 3.2.1 or the Security Manager database from an earlier release is restored in 3.2.1, you might receive a deployment error if a named ACL was assigned to HTTP.
Description: Deployment config has 'ntp server' configuration command even though no changes were made to the NTP policy.
Description: You can select an unsupported OS version when adding a new device by clicking on an OS version folder (indicated by the right arrow) in the Target OS Version tree, instead of clicking on an end node of the tree (indicated by a diamond-shaped icon). If you select an unsupported OS version, you will see receive a "failed to get version upgrade information for device" error during discovery of that device.
Description: Negation is not getting generated for policies using nonexistent ACL.
Description: During discovery, Cisco Security Manager will not recognize the NTP policies of a device that uses the 'prefer' keyword and also has source interface or authentication key defined.
Site-to-Site/Remote Access/SSL VPN Configuration
Table 14 Site-to-Site/Remote Access/SSL VPN Configuration
Description: If you change the slot or subslot of a VPNSM or VPN SPA blade on a Catalyst 6500/7600 device, either in a VPN topology that was deployed, or in an IPsec proposal that was assigned to the device in a remote access VPN and deployed, deployment fails when you try to redeploy the VPN topology or device.
For detailed workaround information, see the Workaround enclosure.
Description: VPN Policy Discovery fails when group-policy is configured with backup-servers using hostnames instead of an IP addresses. The workaround is to define backup-servers with IP addresses instead of hostnames.
Description: If you discover configuration from an ASA device running 8.0(3) that contains the ssl certificate-authentication interface outside port 443 command and remote access VPN policies, the command is changed to the no form when you preview the configuration.
Description: If you change Port Forwarding for a deployed Dynamic Access policy from Auto-start to Disable, or from Enable to Disable, incorrect commands are deployed to the device; the subsequent deployment will fail.
Description: When HTTP form is selected as the authentication server in the AAA tab of the connection profile, a validation error occurs.
Description: Preview Configuration of a firewall configuration file containing invalid commands results in an error instead of a warning. In addition, the error message content is incorrect.
Description: During migration to CSM 3.2.2, the onscreen keyboard and internal password features are set to their default settings in the ASA SSL VPN Other Settings policy, rather than what is configured on the device for these two features. This is applicable to only those ASA devices for which an SSL VPN policy was configured in CSM before migrating to CSM 3.2.2.
Description: In CSM 3.2.2, SSL VPN deployment might fail with a "File IO error > Error while trying to access the file <downloaded_dir>\csd_3.4.0336.pkg." error, if CSD binary is changed. This error happens if you download a CSD image from CCO to an arbitrary location on the server and create a CSD resource (File BB) in CSM specifying this location.
Where To Go Next
Table 15 Where To Go Next
Install Security Manager server or client software.
Understand the basics .
See the interactive JumpStart guide that opens automatically when you start Security Manager.
Get up and running with the product quickly .
See "Getting Started with Security Manager" in the online help, or see Chapter 1 of User Guide for Cisco Security Manager 3.2.2.
Complete the product configuration.
See "Completing the Initial Security Manager Configuration" in the online help, or see Chapter 1 of User Guide for Cisco Security Manager 3.2.2.
Manage user authentication and authorization.
See the following topics in the online help, or see Chapter 2 of User Guide for Cisco Security Manager 3.2.2.
•
•
Bootstrap your devices.
See "Preparing Devices for Management" in the online help, or see Chapter 5 of User Guide for Cisco Security Manager 3.2.2.
Install entitlement applications.
Your Security Manager license grants you the right to install certain other applications — including specific releases of RME and Performance Monitor — that are not installed when you install Security Manager. You can install these applications at any time. See the Introduction to Component Applications section in Chapter 1 of Installation Guide for Cisco Security Manager 3.2.2.
Related Documentation
Table 16 describes the product documentation that is available. For information on ordering printed documents, see Obtaining Documentation and Submitting a Service Request.
Table 16 Product Documentation
Guide to User Documentation for Cisco Security Manager 3.2.2
•
•
•
http://www.cisco.com/en/US/products/ps6498/products_documentation_roadmaps_list.html
Installation Guide for Cisco Security Manager 3.2.2
•
•
User Guide for Cisco Security Manager 3.2.2
•
•
Supported Devices and Software Versions for Cisco Security Manager 3.2.2
On Cisco.com at this URL:
FAQ and Troubleshooting Guide for Cisco Security Manager 3.2
On Cisco.com at this URL:
Migrating from CiscoWorks VPN/Security Management Solution to Cisco Security Manager
On Cisco.com at this URL:
High Availability Installation Guide for Cisco Security Manager 3.1
On Cisco.com at this URL:
User Guide for Auto Update Server 3.2.2
•
•
Supported Devices and Software Versions for Auto Update Server 3.2.2
On Cisco.com at this URL:
Security Manager Integration with ACS
On Cisco.com at this URL:
http://www.cisco.com/en/US/products/ps6498/products_configuration_example09186a00808eada8.shtml
Release Notes for Cisco Security MARS Appliance 4.3.4
On Cisco.com at this URL:
http://www.cisco.com/en/US/products/ps6241/prod_release_notes_list.html
Release Notes for Cisco Security MARS Appliance 5.3.4
On Cisco.com at this URL:
http://www.cisco.com/en/US/products/ps6241/prod_release_notes_list.html
Context-sensitive online help
Click the Help button in a window or dialog box.
Obtaining Documentation and Submitting a Service Request
For information on obtaining documentation, submitting a service request, and gathering additional information, see the monthly What's New in Cisco Product Documentation, which also lists all new and revised Cisco technical documentation, at:
http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html
Subscribe to the What's New in Cisco Product Documentation as a Really Simple Syndication (RSS) feed and set content to be delivered directly to your desktop using a reader application. The RSS feeds are a free service and Cisco currently supports RSS version 2.0.
This document is to be used in conjunction with the documents listed in the "Related Documentation" section.
Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1005R)
Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.
© 2004-2009 Cisco Systems, Inc. All rights reserved.
