-
User Guide for Cisco Security Manager 3.2.2
-
Preface
-
Getting Started with Security Manager
-
Managing User Accounts
-
Working with the Security Manager User Interface
-
Using Map View
-
Preparing Devices for Management
-
Managing the Device Inventory
-
Managing Policies
-
Managing Activities
-
Managing Objects
-
Managing Site-to-Site VPNs
-
Managing Remote Access VPNs
-
Managing Firewall Services
-
Managing IPS Services
-
Managing Routers
-
Managing Firewall Devices
-
Managing Cisco Catalyst Switches and Cisco 7600 Series Routers
-
Managing IPS Devices
-
Managing Deployment
-
Managing FlexConfigs
-
Managing the Security Manager Server
-
Using Monitoring, Troubleshooting, and Diagnostic Tools
-
Administrative Settings User Interface Reference
-
Map View User Interface Reference
-
Device Inventory User Interface Reference
-
Policy User Interface Reference
-
Activities User Interface Reference
-
Policy Object Manager User Interface Reference
-
Site-to-Site VPN User Interface Reference
-
Remote Access VPN User Interface Reference
-
Firewall Services User Interface Reference
-
Router Platform User Interface Reference
-
PIX/ASA/FWSM Platform User Interface Reference
-
Catalyst Platform User Interface Reference
-
IPS User Interface Reference
-
Deployment User Interface Reference
-
Index
-
Table Of Contents
Administrative Settings User Interface Reference
New or Edit CS-MARS Device Dialog Box
Edit Update Server Settings Dialog Box
Edit Auto Update Settings Dialog Box
Step 1: Select Update To Apply Page
Step 2: Select Policies Update Will Be Applied To Page
Updating Licenses via CCO Dialog Box
Redeploying Licenses Dialog Box
Updating Licenses from File Dialog Box
License Update Status Details Dialog Box
Add or Edit Status Provider Dialog Box
Administrative Settings User Interface Reference
The following topics describe Security Manager administration settings and related dialog boxes:
AutoLink Settings Page
The Security Manager Map view provides a graphical view of your VPN and Layer 3 network topology. Using device nodes to represent managed devices and map objects to represent unmanaged objects such as devices, clouds, and networks, you can create topology maps with which to study your network. AutoLink settings enable you to exclude any one of five private or reserved networks from Map view. For example, you might want to exclude any test networks that are not relevant to the management tasks you are using Security Manager to perform.
Navigation Path
Click Tools > Security Manager Administration and select AutoLink from the table of contents.
Related Topics
•
Displaying Layer 3 Links on the Map, page 4-16
•
Field Reference
Configuration Archive Page
Use the Configuration Archive page to define the default settings for the Configuration Archive tool, including how many configuration versions to save and the TFTP server to use for rolling back Cisco IOS software device configurations.
Navigation Path
Click Tools > Security Manager Administration and select Configuration Archive from the table of contents.
Related Topics
•
•
Field Reference
CS-MARS Page
Use the CS-MARS page to register the Cisco Security Monitoring, Analysis and Response System servers that are monitoring your devices with Security Manager. By registering your CS-MARS servers, you can view messages and events captured in CS-MARS based on a device's firewall access rules or IPS signature rules configured in Security Manager. You must register a CS-MARS server before users can see events collected from it.
Tip
Navigation Path
Select Tools > Security Manager Administration and select CS-MARS from the table of contents.
Related Topics
•
Field Reference
Table A-3 CS-MARS Page
CS-MARS Devices
Displays the CS-MARS servers that are registered with Security Manager.
Add button (+ icon)
Click this button to add a server to the list. The New CS-MARS Device dialog box opens (see New or Edit CS-MARS Device Dialog Box).
Edit button (pencil icon)
Click this button to edit the properties of the selected server. The Edit CS-MARS Device dialog box opens (see New or Edit CS-MARS Device Dialog Box).
Delete button (trash can icon)
Click this button to delete the selected server. When you delete a server, the device properties for all devices that use the server are updated to remove the server connection.
When Launching CS-MARS
Allow User to Save Credentials
The type of credentials Security Manager should use to log into CS-MARS when obtaining event information:
•
•
Save button
Saves and applies changes.
Reset button
Resets changes to the last saved values.
New or Edit CS-MARS Device Dialog Box
Use the New or Edit CS-MARS Device dialog box to register a CS-MARS server with Security Manager. Users can obtain messages or event status for a device's firewall or IPS policies from the CS-MARS server that is monitoring the device.
Navigation Path
To open this dialog box, select Tools > Security Manager Administration, then click CS-MARS to open the CS-MARS page. Then, do one of the following:
•
•
Related Topics
•
Field Reference
Customize Desktop Page
Use the Customize Desktop page to control whether Security Manager closes automatically after being idle for a specified time, and to reset whether you are prompted to verify your actions in certain circumstances.
Navigation Path
Select Tools > Security Manager Administration and select Customize Desktop from the table of contents.
Field Reference
Debug Options Page
Use the Debug Options page to configure the severity level of messages to include in debugging logs and to determine what other debugging information is collected.
You should change debugging levels only if the Cisco Technical Assistance Center (TAC) asks you to change them. This makes it possible for you to include more detailed information in the CSMDiagnostics.zip file.
After you change the message level for the appropriate subcomponent, redo the actions that are resulting in system problems. After the problems occur, create the CSMDiagnostics.zip file by selecting Tools > Security Manager Diagnostics. You can then reset the debug options to the default levels so that the Security Manager server does not become bogged down collecting extra debug information. For more information about generating the CSMDiagnostics.zip file, see Creating a Diagnostics File for the Cisco Technical Assistance Center, page 20-15.
By default, logs contain messages of the Error severity or worse. The severity levels in order of severity are:
•
•
•
•
•
Navigation Path
Select Tools > Security Manager Administration, then select Debug Options from the table of contents.
Field Reference
Deployment Page
Use the Deployment page to define the default methods by which Security Manager deploys configurations to devices. You can override some of these settings when you create deployment jobs.
Navigation Path
Select Tools > Security Manager Administration and select Deployment from the table of contents.
Related Topics
•
•
•
Field Reference
Table A-7 Deployment Page
Purge Debugging Files Older Than (days)
The maximum number of days the system should keep debugging files. Debug files are automatically deleted. If you decrease the number of days, you can click Purge Now to immediately delete all debugging files older than the number of days specified.
Default Deployment Method
Directory
The method to use as the default method for deploying configurations to devices:
•
•
You can override this method when you create deployment jobs.
When Out of Band Changes Detected
How Security Manager should respond when it detects that changes were made directly on the device CLI since a configuration was last deployed to the device. This setting applies only for deployment methods that are configured to obtain the reference configuration from the device (see below for a description of the Reference Configuration settings).
This setting specifies the default action, which you can override when you create deployment jobs. You can choose one of the following:
•
•
•
For a more complete discussion of out-of-band change handling, see Understanding How Out-of-Band Changes are Handled, page 18-13.
Deploy to File Reference Configuration
The configuration that Security Manager uses to compare new policies against the previous configuration for the device, if you are deploying the configuration to a file on the Security Manager server.
•
•
After comparing the configurations, Security Manager generates the correct CLI for deployment.
Deploy to Device Reference Configuration
The configuration that Security Manager uses to compare new policies against the previous configuration for the device, if you are deploying the configuration directly to the device (or to a transport server).
•
•
After comparing the configurations, Security Manager generates the correct CLI for deployment.
Optimize the Deployment of Access Rules For
How firewall rules are deployed. You can choose one of the following:
•
•
Firewall Access-List Names
How ACL names are deployed to devices if the access rule does not have a name in Security Manager.
•
•
Let FWSM Decide When to Compile Access Lists
Whether to have the Firewall Services Module (FWSM) automatically determine when to compile access lists. Selecting this option might increase deployment speed but traffic might be disrupted and the system might become incapable of reporting ACL compilation error messages.
When deselected, Security Manager controls ACL compilation to avoid traffic interruption and to minimize peak memory usage on the device. For more information, see Understanding Access Rules, page 12-36.
Caution
Allow Download on Error
Whether deployments to devices should continue even if there are minor device configuration errors.
Remove Unreferenced Object Groups from Device (PIX, ASA, FWSM)
Whether Security Manager should remove object groups that are not being used by other CLI commands from devices during deployment.
Create Object Groups for Policy Objects (PIX, ASA, FWSM)
Create Object Groups for Multiple Sources, Destinations or Services in a Rule (PIX, ASA, FWSM)
Optimize Network Object Groups During Deployment (PIX, ASA, FWSM)
Whether Security Manager should create object groups, such as network objects and service objects, to replace comma-separated values in a rule table cell for PIX, ASA, and FWSM devices. When deselected, Security Manager flattens the object groups to display the IP addresses, sources and destinations, ports, and protocols for these devices.
If you select this option, you can also select these options:
•
•
Remove Unreferenced Access-lists on Device
Whether to delete any access lists that are not being used by other CLI commands from devices during deployment.
Save Changes Permanently on Device
Whether to save the running configuration to the startup configuration (using the write memory command) after deploying a configuration to a device. This applies to PIX, FWSM, ASA, or Cisco IOS devices. If you deselect this check box, the startup configuration is not changed, which means your configuration changes will be lost if the device reloads for any reason.
Generate ACL Remarks During Deployment
Whether to display ACL warning messages and remarks during deployment.
Preselect Devices with Undeployed Changes
Whether the list of changed devices you see when you create a deployment job has all changed devices preselected. If you deselect this option, users must manually select the devices to include in the deployment job.
Enable Auto Refresh in Deployment Main Panel
Whether the deployment job and schedule status information should be automatically refreshed in the Deployment Manager window. If you deselect this option, you must click the Refresh button to refresh the information manually.
Remove Unreferenced SSL VPN Files on Device
Whether to have Security Manager delete files related to the SSL VPN configuration from the device if the files are no longer referred to by the device's SSL VPN configuration. If you deselect this option, unused files remain on the device after deployment.
Mask Passwords and Keys When Viewing Configs and Transcripts
Mask Passwords and Keys When Deploying to File
The conditions, if any, under which Security Manager will mask the following items so that they cannot be read: passwords for users, enable mode, Telnet, and console; SNMP community strings; keys, including those for TACACS+, Preshared Key, RADIUS server, ISAKMP, failover, web VPN attributes, logging policy attributes, AAA, AUS, OSPF, RIP, NTP, logging FTP server, point-to-point protocol, Storage Key, single sign-on server, load balancing, HTTP/HTTPS proxy, and the IPSEC shared key.
•
•
Save button
Saves and applies changes.
Reset button
Resets changes to the last saved values.
Restore Defaults button
Resets values to Security Manager defaults.
Device Communication Page
Use the Device Communication page to define default settings for communicating with devices. These settings mainly affect device inventory and policy discovery and configuration deployment. You can override the transport settings for individual devices in the device properties for the device.
If you change the transport protocol settings, ensure that your devices are appropriately configured to accept those types of connections.
Navigation Path
Select Tools > Security Manager Administration and select Device Communication from the table of contents.
Related Topics
•
•
•
•
Field Reference
Table A-8 Device Communication Page
Device Connection Timeout
The number of seconds that Security Manager has to establish a connection with a device before timing out.
Retry Count
The number of times that Security Manager should try to establish a connection to a device before concluding that the connection cannot be completed. The default value is 3.
Socket Read Timeout
For SSH and Telnet sessions, the maximum number of seconds Security Manager can wait for incoming data before concluding that the connection is lost.
Transport Protocol (IPS)
The default transport protocol for IPS sensors and routers that include the IPS feature. The default is HTTPS.
Transport Protocol (IOS Routers 12.3 and above)
The default transport protocol for routers that run Cisco IOS software release 12.3 and above. The default is HTTPS.
Transport Protocol (Catalyst Switch/7600)
The default transport protocol for Catalyst 6500/7600 devices and all other Catalyst switches, regardless of the Cisco IOS software version running on the devices. The default is SSH.
Transport Protocol (IOS Routers 12.2, 12.1)
The default transport protocol for routers that run Cisco IOS software releases 12.1 and 12.2. The default is Telnet.
Connect to Device Using
The type of credentials Security Manager should use when accessing devices. For more information, see Understanding Device Credentials, page 6-4.
•
•
SSL Certificate Parameters
Device Authentication Certificates (IPS)
Device Authentication Certificates (Router)
PIX/ ASA/ FWSM Device Authentication Certificates
Add Certificate button
How to handle device authentication certificates for SSL (HTTPS) communications. You can configure different behaviors for different types of devices, but the settings have the same meaning:
•
•
•
Accept Device SSL Certificate after Rollback
For devices that use SSL, whether to obtain the certificate installed on an IPS device, firewall device, FWSM, ASA, or Cisco IOS router from the device when you roll back the configuration on the device.
HTTPS Port Number
The default port number that the device uses for secure communication with Security Manager (as well as other management applications that use these protocols). This value overrides the HTTPS port number that you configure in the HTTP policy for a device.
Note
In addition to providing access to the device through the Cisco web browser user interface, the HTTPS port number is used by device management applications, such as the Cisco Router and Security Device Manager (SDM), and monitoring tools, such as IPS Event Viewer (IEV), to communicate with the device.
Note
Overwrite SSH Keys
Whether Security Manager can overwrite the SSH key for a device when it changes on the device. For SSH connections, a correct key is required for successful communication.
Deselect this check box with caution, and only if you require a greater level of security. Security Manager does not communicate with the device if keys are changed on the device.
Save button
Saves and applies changes.
Reset button
Resets changes to the last saved values.
Restore Defaults button
Resets values to Security Manager defaults.
Add Certificate Dialog Box
Use the Add Certificate dialog box to add device certificates manually for devices that use the SSL transport protocol (firewall devices, FWSMs, ASAs, IPS devices, and Cisco IOS devices). Adding the device certificates manually gives you the highest level of security because then an intruder is prevented from introducing a fraudulent certificate thumbprint. Device certificates are stored in the database to be used for device authentication.
For more information about manually adding SSL certificates, see Manually Adding SSL Certificates for Devices that Use HTTPS Communications, page 6-21.
Navigation Path
Select Tools > Security Manager Administration, select Device Communication from the table of content, and click Add Certificate.
Field Reference
Device Groups Page
Use the Device Groups page to manage the device groups and group types defined in the device inventory.
Navigation Path
Select Tools > Security Manager Administration, then select Device Groups from the table of contents.
Related Topics
•
•
Field Reference
Device OS Management Page
Security Manager includes shortcut commands to access several key features of Resource Manager Essentials (RME). To enable these commands, you must identify the RME server to Security Manager on this page.
Navigation Path
Select Tools > Security Manager Administration and select Device OS Management from the table of contents.
Related Topics
•
•
Field Reference
Discovery Page
Use the Discovery page to define how Security Manager should handle certain types of objects or events during inventory and policy discovery. You can also control how long Security Manager keeps discovery tasks.
Navigation Path
Select Tools > Security Manager Administration and select Discovery from the table of contents.
Related Topics
•
•
•
Field Reference
Table A-12 Discovery Page
Prepend Device Name when Generating Security Context Names
Whether the name of the device that contains the security context should be added to the front of the security context's name. For example, if a security context is named admin, and it is contained in the device with the display name 10.100.15.16, the name that will appear in the Device selector is 10.100.15.16_admin.
If you do not prepend the device name, the security context name appears in the inventory by itself. Because Security Manager does not place security contexts in a folder related to the parent device, the only way to easily see contexts that are related to a device is to prepend the device name.
If you do not prepend device names, Security Manager adds a numbered suffix to distinguish identically named devices. For example, if the admin context exists in more than one firewall, you will see admin_01, admin_02, and so on, in the Device selector.
Purge Discovery Tasks Older Than
The number of days to save discovery and device-import tasks. Tasks older than the number of days you enter are deleted.
Reuse Policy Objects for Inline Values
Whether to substitute any named policy objects, such as IP addresses already defined in Security Manager, for inline values in the CLI. For more information on policy objects, see Chapter 9, "Managing Objects".
Allow Device Override for Discovered Policy Objects
For certain types of objects, whether to allow users to override the parent object values at the device level for policy objects that are discovered. If you select this option, if you run policy discovery on a device that has an ACL with the same name as an ACL policy object in Security Manager, the name of the discovered policy object is reused, but a device-level override is created for the object. If you deselect this option, a new policy object is created with a number appended to the name.
For more information, see Overriding Global Objects for Individual Devices, page 9-116.
On Error, Rollback Discovery for Entire Device
Whether Security Manager should roll back all discovered policies if even one error is encountered for a single policy during policy discovery. When deselected, Security Manager keeps the policies successfully discovered and discards only those policies with errors. For more information on policy discovery, see Discovering Policies, page 7-11.
Auto-Expand Object Groups with Prefixes
Expands object groups with the listed prefixes during the device import process. Separate the prefixes with a comma. This expansion causes the specified items to display as separate CLI during discovery. For more information, see Expanding Object Groups During Discovery, page 12-36.
Save button
Saves your changes.
Reset button
Resets changes to the previously applied values.
Restore Defaults button
Resets values to Security Manager defaults.
IPS Updates Page
Use the IPS Updates page to perform administrative tasks associated with keeping your sensors up to date with regard to signatures, minor version updates, and service packs. You can use the IPS Updates page to:
•
•
•
•
Tip
Caution
Navigation Path
Select Tools > Security Manager Administration and select IPS Updates from the table of contents.
Related Topics
•
•
•
Field Reference
Table A-13 IPS Updates Page
Update Status group
Refresh button
Displays the following items. Click Refresh to update the information.
•
•
•
•
•
•
•
Check for Updates button
Download Latest Updates button
These buttons check for updates, or download signature and sensor updates that have not already been downloaded to the Security Manager server, from the IPS Update server. You must configure an IPS Update server before checking for updates or downloading them (click Edit Settings in the Update Server group).
When you click one of these buttons, a dialog box opens to display the results of the operation. Click Start to have Security Manager log into the IPS Update server, check for updates, and download them if you clicked the Download button. If a Cisco.com download fails, ensure that the account you are using has applied for eligibility to download strong encryption software. For details, see the description of User Name in Edit Update Server Settings Dialog Box.
TipUpdate Server group
Displays the settings used to access Cisco.com or the local server that contains the IPS update packages. The fields indicate whether the update server is Cisco.com or a locally-configured HTTP server, the name of the local server if you are using one, the user account for logging into the server, and the name of the proxy server, if any. To configure or change the IPS Update server, click Edit Settings to open the Edit Update Server Settings dialog box (see Edit Update Server Settings Dialog Box).
For more information, see Configuring the IPS Update Server, page 20-7
Auto Update Settings group
Contains the settings specific to automatic updates. For more information, see Automating IPS Updates, page 20-9.
Auto Update Mode
Establishes whether, and to what extent, automatic updates are performed. Contains the following options:
•
•
•
•
•
By default, auto update is disabled. The other options are a combination of one or more of the following options:
•
•
•
•
Check for Updates
Edit Update Schedule button
The schedule for the actions selected in the Auto Update Mode field. To change the schedule, click Edit Update Schedule and define the schedule in the Edit IPS Updates Schedule dialog box. You can specify that Security Manager perform the updates based on hourly, daily, weekly, or monthly schedules, or specify a one-time event. When entering the start time, use the 24-hour clock and the hh:mm format.
Notify Email
The e-mail address to which notifications of automatic updates are sent. If you enter more than one address, separate the addresses with commas. A notification is sent when an update:
•
•
•
•
Apply Update To
Type
Edit Row button
Devices to be Auto Updated
The selector includes the IPS devices that have local signature policies and the shared signature policies that are defined in Security Manager. The columns in the selector indicate whether a local device policy or a shared policy is selected for these types of updates:
•
•
•
For shared policies, a partial grey checked box indicates that some, but not all, of the devices that use the policy are selected.
Use the Type field to toggle between viewing local and shared policies. Changing the view does not change your auto update selections.
To select a local or shared policy for auto update, select it in the selector and click the Edit Row button below the selector. This opens the Edit Auto Update Settings dialog box, where you can select the types of updates for the policy. When you select any type of auto update for a policy, the affected devices are listed in the Devices to be Auto Updated list to the right of the selector.
Save button
Saves your changes.
Reset button
Resets changes to the last saved values.
Restore Defaults button
Resets values to Security Manager defaults.
Edit Update Server Settings Dialog Box
Use the Edit Update Server Settings dialog box to configure the server to use for obtaining IPS updates. If necessary, you can configure a proxy server for communicating with the update server.
Navigation Path
Select Tools > Security Manager Administration > IPS Updates and click Edit Settings in the Update Server group.
Field Reference
Table A-14 Edit Update Server Settings Dialog Box
Update From
Whether to get IPS updates from Cisco.com or from a local HTTP server. Your selection changes the fields on the dialog box.
If you select local, you must configure an HTTP server to use as the IPS update server.
IP Address/ Host Name
(Local server only.)
The hostname or IP address of the local IPS update web server.
Web Server Port
(Local server only.)
The port number that your local server listens to for connection requests. The default is 80.
User Name
The username to log into the IPS update server. If you are configuring a local server that does not require a user login, leave this field blank.
If you are specifying a Cisco.com username, the user account on Cisco.com must be eligible for downloading strong encryption software. If you are not certain that the account has the required permissions, use the account to log into Cisco.com and try to download an IPS update file (http://www.cisco.com/pcgi-bin/tablebuild.pl/ips5-system). If the account does not have the appropriate permissions, you are prompted to read and accept the required conditions. If you meet the eligibility requirements, you can accept them. Otherwise, talk to your Cisco sales representative for help.
Password
Confirm
The password for the specified username, entered in both fields. If you are configuring a local server that does not require a password, leave these fields blank.
Path to Update Files
(Local server only.)
The path to the IPS update files location on your local server. For example, if update files can be accessed at http://local-server-ip:port/update_files_path/, then enter update_files_path in this field.
Connect Using HTTPS
(Local server only.)
Whether to use SSL when connecting to the local IPS Update server.
Enable Proxy Server
Whether a proxy server is needed to connect to Cisco.com or to your local server.
IP Address/ Host Name
The hostname or IP address of the proxy server.
Web Server Port
The port number that the proxy server listens to for connection requests. The default is 80.
User Name
The username to log into the proxy server. If the proxy server does not require a user login, leave this field blank.
Password
Confirm
The password for the specified username, entered in both fields. If the proxy server does not require a password, leave these fields blank.
Edit Auto Update Settings Dialog Box
Use the Edit Auto Update Settings dialog box to configure the automatic update options for the device or policy selected in the Apply Update To table on the IPS Updates page. For information on configuring automatic updates, see Automating IPS Updates, page 20-9.
Navigation Path
Select a device or policy on in the Apply Update To table on the IPS Updates page (see IPS Updates Page) and click the Edit Row button.
Field Reference
Apply IPS Update Wizard
The Apply IPS Update wizard allows you to manually apply image and signature updates to compatible IPS devices. Before you can apply updates, you must configure an IPS Update server on the IPS Updates page (select Tools > Security Manager Administration > IPS Updates). For information on configuring an IPS Update server, see Configuring the IPS Update Server, page 20-7.
Tip
When applying signature updates, the wizard displays those signatures in the update that are not configured on the target IPS devices. In this view, you can configure the new signatures before they are applied.
When applying image and signature updates, only those devices to which the updates can be applied are available for selection. Inapplicable devices are grayed out.
Caution
The Apply IPS Update wizard consists of these pages:
•
•
Navigation Path
Select Tools > Apply IPS Update.
Related Topics
•
•
•
•
Step 1: Select Update To Apply Page
Use the Select Update to Apply page of the Apply IPS Update wizard to select the signature or sensor update you want to apply to an IPS device.
To update the list of available update packages, do any of the following:
•
•
•
Navigation Path
Select Tools > Apply IPS Update. For more information, see Apply IPS Update Wizard.
Field Reference
Table A-16 Apply IPS Updates Wizard Step 1, Select Update to Apply Page
Updates Downloaded
A list of the signature or sensor updates available to apply to your IPS devices. These files have been downloaded to the Security Manager server. Use the Type field to toggle the table between these packages:
•
•
TipTipUpdate Details
Lists the filename, description, release number, release date, file size, and required engine level for the package selected in the Updates Downloaded list.
Update Status group
The Update Status group displays the following items.
•
•
•
•
•
•
•
Check for Updates button
Download Latest Updates button
These buttons check for updates, or download signature and sensor updates that have not already been downloaded to the Security Manager server from the IPS Update server. You must configure an IPS Update server before checking for updates or downloading them. To configure an IPS Update server, select Tools > Security Manager Administration > IPS Updates and click Edit Settings in the Update Server group on the IPS Updates page (for more information, see IPS Updates Page).
When you click one of these buttons, a dialog box opens to display the results of the operation. Click Start to have Security Manager log into the IPS Update server, check for updates, and download them if you clicked the Download button. If a Cisco.com download fails, ensure that the account you are using has applied for eligibility to download strong encryption software. For details, see the description of User Name in Edit Update Server Settings Dialog Box.
Step 2: Select Policies Update Will Be Applied To Page
Use the Select Policies Update Will Be Applied To page of the Apply IPS Update wizard to select the local or shared policy to which to apply the update. When you select a policy, the devices that use the policy are selected for update.
Navigation Path
Select Tools > Apply IPS Update. For more information, see Apply IPS Update Wizard.
Field Reference
Step 3: Edit Signatures Page
Use the Edit Signatures page of the Apply IPS Update wizard to view or edit signature updates, if desired.
Navigation Path
Select Tools > Apply IPS Update. For more information, see Apply IPS Update Wizard.
Field Reference
Table A-18 Apply IPS Updates Wizard Step 3, Edit Signatures Page
Filter
Allows you to filter the information displayed in the table. See Filtering Tables, page 3-17.
Signature List
Displays the new and modified signatures between the signature level of the selected update and the lowest signature level among the selected devices. If the selected devices include both IPS sensors and Cisco IOS IPS devices, the signatures for these devices appear on separate tabs.
Click the link in the ID number to read the description for the signature on Cisco.com. The Status column indicates whether the signature is new or modified (see the visual description of the icons on the wizard page).
To edit a signature, select it in the table and click the Edit button below the table (the pencil icon). For help in understanding the signature, click Help in the dialog box that the Edit button opens.
For details on available signature information, see Signatures Page, page M-1. In the Signature Summary Table, you can also add custom signatures and delete signatures, but you cannot do that on this page of the Apply IPS Update Wizard.
Finish button
Click this button to apply the selected update to the selected devices, and to save the edited or tuned signatures, if any.
Licensing Page
Use the Licensing page to manage licenses for the Security Manager application and for IPS devices.
Navigation Path
Select Tools > Security Manager Administration and select Licensing from the table of contents.
Related Topics
Field Reference
Table A-19 Licensing Page
CSM tab
The license settings for the Security Manager application. For a description of the fields on this tab, see CSM Tab, Licensing Page.
IPS tab
The license settings for IPS devices managed by Security Manager. For a description of the fields on this tab, see IPS Tab, Licensing Page.
CSM Tab, Licensing Page
Use the CSM tab on the Licensing page to view the list of installed Security Manager licenses and to install new licenses.
Navigation Path
Select Tools > Security Manager Administration, select Licensing from the table of contents, and click CSM.
Related Topics
•
Field Reference
IPS Tab, Licensing Page
Use the IPS tab on the Licensing page to view the list of installed IPS device licenses, to install new or updated licenses, or to redeploy licenses. The license list shows current licenses, unlicensed devices, devices with expired licenses, and devices with invalid licenses.
Navigation Path
Select Tools > Security Manager Administration, select Licensing from the table of contents, and click IPS.
Related Topics
•
•
•
•
Field Reference
Updating Licenses via CCO Dialog Box
Use the Update Licenses via CCO dialog box to review the IPS devices you selected to update from Cisco.com. The device list displays the IPS devices for which you can update the license from Cisco.com, which might not be all of the devices you selected.
To successfully update the license using this method, you must have a Cisco.com support contract that includes the serial numbers of the selected devices.
When you click OK, the License Update Status Details dialog box (see License Update Status Details Dialog Box) opens so that you can view the status of the update task.
Navigation Path
Select one or more device on the Tools > Security Manager Administration > Licensing > IPS tab and click Update Selected via CCO.
Redeploying Licenses Dialog Box
Use the Redeploying Licenses dialog box to review the IPS devices you selected to redeploy licenses to and to start the redeployment. Before you can redeploy a license to a device, you must have already deployed the license. Security Manager uses the file already associated with the IPS device to redeploy the license.
When you click OK, the License Update Status Details dialog box (see License Update Status Details Dialog Box) opens so that you can view the status of the license redeployment task.
Navigation Path
Select one or more device on the Tools > Security Manager Administration > Licensing > IPS tab and click Redeploy Selected Licenses.
Updating Licenses from File Dialog Box
Use the Updating Licenses from File dialog box to update IPS device licenses using a license file stored on a local drive on the Security Manager server. Click Browse to select the license file. You can select multiple license files using Ctrl+click or a range of files using Shift+click. When you have selected the license files you want to use, click OK to apply them to the IPS devices.
Navigation Path
Select one or more device on the Tools > Security Manager Administration > Licensing > IPS tab and click Update from License File.
License Update Status Details Dialog Box
Use the License Update Status Details dialog box to view the status of an IPS license update task. This dialog box opens whenever you start an update task from the IPS tab of the Licensing page. For more information, see IPS Tab, Licensing Page.
Field Reference
Logs Page
Use the Logs page to configure the default settings for the audit and operations logs. The audit log keeps a record of all state changes that occur in Security Manager.
Navigation Path
Select Tools > Security Manager Administration and select Logs from the table of contents.
Related Topics
•
•
•
Field Reference
Policy Management Page
Use the Policy Management page to select the types of router policies you will manage in Security Manager. These selections apply only to routers. You cannot select a subset of policy types for FWSM, ASA, PIX, or IPS devices.
For example, by selecting only certain types of policies to manage in Security Manager, you can use Security Manager to manage DHCP and NAT policies on Cisco IOS routers while leaving routing protocol policies, such as EIGRP and RIP, unmanaged. These settings apply globally in Security Manager.
Unmanaged policies are removed from both Device view and Policy view. Any unmanaged policies, local or shared, are removed from the Security Manager database. The only exception is interface policies in the Router Interfaces folder, which continue to appear in the interface but are marked as read-only policies.
You cannot unmanage a policy type if you have configured and assigned policies of that type in Security Manager. You must first remove the assignments and then unassign the policy type. If the configurations defined by those policies have already been deployed, these configurations are left in place on the devices, but the policies are no longer stored in the database and they are not accessible from the Security Manager interface.
Navigation Path
Select Tools > Security Manager Administration and select Policy Management from the table of contents.
Related Topics
•
•
•
•
•
•
Field Reference
Policy Objects Page
Use the Policy Objects page to define system defaults related to policy object creation.
Navigation Path
Select Tools > Security Manager Administration and select Policy Objects from the table of contents.
Related Topics
•
Field Reference
Table A-25 Policy Objects Page
When Redundant Objects Detected
The action you want Security Manager to take when you try to create a policy object that has the same definition as an existing object:
•
•
•
For more information, see Guidelines for Managing Objects, page 9-5.
Default Source Ports
The port range value that is used as the default source port range for service objects. You can choose one of the following:
•
•
If you change the default source ports, you must manually redeploy any previously deployed devices that might be affected. These changes might not be reflected in any open activities until you refresh the data.
For more information on objects, see Understanding Port List Objects, page 9-83.
Enable AutoComplete
Whether to have Security Manager list matching service and port list names as you type them when you create a service. You can then easily select from names you have already defined. If you deselect AutoComplete, you have to remember the complete service and port list names and type them in yourself.
Save button
Saves your changes.
Reset button
Resets changes to the previously applied values.
Restore Defaults button
Resets values to Security Manager defaults.
Rule Expiration Page
Use the Rule Expiration page to define the default values for policy rule expiration. When you create policies for some types of policy rules (such as access rules), you can set an expiration date for the rule, and Security Manager can notify you by e-mail of the approaching expiration date.
You must configure an SMTP server to enable e-mail notifications. For more information, see Configuring an SMTP Server and Default Addresses for E-Mail Notifications, page 1-12.
Navigation Path
Select Tools > Security Manager Administration and select Rule Expiration from the table of contents.
Field Reference
Server Security Page
Use the Server Security page to open specific pages in the CiscoWorks Common Services application, where you can configure various security features on the Security Manager server. CiscoWorks Common Services controls the basic functions of the Security Manager server, including user access control and system security.
When you log in to Security Manager, your username and password are compared with the account information stored in the CiscoWorks or Cisco Secure Access Control Server (ACS) database, depending on which system you established at installation as your AAA provider. After the authentication of your credentials, you have access according to the role you have been assigned.
For more information on Security Manager roles and privileges, including descriptions of how Common Services roles translate to user functions in Security Manager, see Setting Up User Permissions, page 2-1.
Navigation Path
Select Tools > Security Manager Administration and select Server Security from the table of contents.
Related Topics
•
•
•
Field Reference
Table A-27 Server Security Page
AAA Setup button
Opens Common Services and displays the AAA Mode Setup page. From this page, you can set AAA as your fallback sign-on method. For more information about AAA, click Help from the AAA Mode Setup page.
Certificate Setup button
Opens Common Services and displays the Self-Signed Certificate Setup page. CiscoWorks enables you to create self-signed security certificates, which you can use to enable SSL connections between your client browser and management server. For more information about self-signed certificates, click Help from the Certificate Setup page.
Single Sign On button
Opens Common Services and displays the Single Sign-On Setup page. With Single Sign On (SSO), you can use your browser session to transparently navigate to multiple CiscoWorks servers without having to authenticate to each of them. Communication between multiple CiscoWorks servers is enabled by a trust mode addressed by certificates and shared secrets. For more information about setting up SSO, click Help from the Single Sign-On page.
Local User Setup
Opens Common Services and displays the Local User Setup page, from which you can add and delete users, edit user settings, and assign roles or permissions. For more information, click Help from the Local User Setup page and see Default Associations Between Permissions and Roles in Security Manager, page 2-20.
System Identity Setup
Opens Common Services and displays the System Identity Setup page. Communication between multiple CiscoWorks servers is enabled by a trust mode addressed by certificates and shared secrets. System Identity setup helps you to create a trust user on servers that are part of a multi- server setup. For more information about system identity setup, click Help from the System Identity Setup page.
Status Page
Use the Status page to select the providers that will provide status to users when they view their inventory status by selecting Tools > Inventory Status. The status is displayed on the Status tab in the Inventory Status window.
By default, Security Manager provides status on deployment to the devices, but you can add Performance Monitor servers if you use them to monitor your network.
Navigation Path
Select Tools > Security Manager Administration and select Status from the table of contents.
Related Topics
•
•
•
Field Reference
Table A-28 Status Page
Display Deployment Status
Whether to include the status of deployment jobs that include the device.
Providers table
The providers table lists the Performance Monitor servers that are registered with Security Manager. You can add up to five servers.
Provider
The name of the Performance Monitor server. This name appears in the Inventory Status window on the Status tab for individual devices, indicating the server that provided the status.
Short name
The nickname for the provider name.
Status
Whether Security Manager should actively poll the Performance Monitor server for status. Select Enabled to actively poll the server, or Disabled to suspend polling the server without having to delete the provider entry.
Add button (+ icon)
Click this button to add a provider to the list. The Add Status Provider dialog box opens (see Add or Edit Status Provider Dialog Box).
Edit button (pencil icon)
Click this button to edit the properties of the selected provider. The Edit Status Provider dialog box opens (see Add or Edit Status Provider Dialog Box).
Trash button (trash can icon)
Click this button to delete the selected provider.
Save button
Saves your changes.
Reset button
Resets changes to the last saved values.
Add or Edit Status Provider Dialog Box
Use the Add or Edit Status Provider dialog box to register a Performance Monitor server with Security Manager. Security Manager can then poll the Performance Monitor servers for event status such as VPN tunnels, device connectivity, and CPU usage threshold. Users can view the status of their devices by selecting Tools > Inventory Status.
Navigation Path
To open this dialog box, select Tools > Security Manager Administration, then click Status to open the Status page. Then, do one of the following:
•
•
Related Topics
•
•
•
Field Reference
Take Over User Session Page
Use the Take Over User Session page to take over another user's configuration session. A user with administrative privileges can take over the work of another user in non-Workflow mode. Taking over a session is useful when a user is working on devices and policies, causing the devices and policies to be locked, and another user needs access to the same devices and policies.
Navigation Path
Select Tools > Security Manager Administration and select Take Over User Session from the table of contents.
Related Topics
•
Field Reference
Token Management Page
Use the Token Management page to identify the Token Management System (TMS) server to use for deploying configurations to Cisco IOS routers that use TMS as the communication protocol. Security Manager uses the settings on this page to contact the TMS server.
Security Manager uses FTP to deploy the delta configuration file to the TMS server, from which the configuration file can be downloaded and encrypted onto an eToken.
To use TMS with Cisco IOS routers, you must specify TMS as the transport protocol. You can do this for all routers on the Device Communication page (see Device Communication Page), or for a specific router in its device properties (see General Page, page C-27). You must also configure the TMS server as an FTP server, otherwise deployment will fail.
Navigation Path
Select Tools > Security Manager Administration and select Token Management from the table of contents.
Related Topics
•
•
Field Reference
VPN Policy Defaults Page
Use the VPN Policy Defaults page to view or assign the default VPN policies that Security Manager uses for each IPsec technology. To select a policy as a default policy, you must create it as a shared policy.
Security Manager uses VPN policy defaults to simplify VPN configuration while ensuring that policy consistency is maintained. Security Manager provides mandatory policies as factory defaults, which means they are configured on the devices in your VPN topology with predefined values, depending on the assigned IPsec technology. Factory default policies with their default configurations enable you to deploy to your devices immediately after creating the VPN topology. Factory default policies are private policies and are not viewable. Optional policies are not provided as factory defaults.
The VPN Policy Defaults page has eight tabbed areas. Six of these tabs are for the following VPN technologies:
•
•
•
•
•
•
The other two tabs cover default settings for S2S (site-to-site) Endpoints and Remote Access.
Navigation Path
Select Tools > Security Manager Administration and select VPN Policy Defaults from the table of contents.
Related Topics
•
•
•
•
Field Reference
Workflow Page
Use the Workflow page to select the workflow mode that Security Manager enforces and to define the default settings for activity and deployment job notifications and logging.
Before changing the workflow mode, read the following topics to understand how the modes differ and the effects of changing the modes:
•
•
•
•
Navigation Path
Click Tools > Security Manager Administration and select Workflow from the table of contents.
Related Topics
•
•
Field Reference
Table A-33 Workflow Page
Enable Workflow
Whether to enable Workflow mode. When Workflow mode is enabled, you can select whether to have an approver for activities and deployment jobs.
Require Activity Approval
Whether to require that activities be approved explicitly by an assigned approver. For more information about the differences between working with and without an approver, see Activity Approval, page 8-2.
Require Deployment Approval
Whether to require that deployment jobs be approved explicitly by an assigned approver. For more information about the differences between working with and without an approver, see Understanding Deployment, page 18-1.
Sender
The e-mail address that Security Manager will use for sending e-mail notifications.
Activity Approver
The default e-mail address for the person responsible for approving activities. Users can override this address when submitting an activity for approval. For more information, see Submitting an Activity for Approval, page 8-13.
Job/Schedule Approver
The default e-mail address of the person responsible for approving deployment jobs or schedules. Users can override this address when submitting a job or schedule for approval. For more information, see Submitting Deployment Jobs, page 18-22.
Job Completion Notification
The e-mail address of the person who should receive notification when deployment jobs are completed. Users can override this address when creating a deployment job.
Include Job Deployer
Whether to send notifications of deployment job status changes to the person who deployed the job.
Require Deployment Status Notification
Whether to have e-mail notifications sent whenever the status of a deployment job changes.
Keep Activity for
The number of days that activity information should be kept in the Activity table. The default is 30. You can specify from 1 to 180 days.
Click Purge Now to delete all activities older than the number of days specified.
Keep Job for
The number of days that deployment job information should be kept in the Deployment Job table. The default is 30. You can specify from 1 to 180 days.
Click Purge Now to delete all jobs older than the number of days specified.
Keep job per schedule for
The number of days that deployment job information should be kept in the Deployment Job table for each job schedule. This setting applies only to jobs that were initiated by a schedule. The default is 30. You can specify from 1 to 180 days.
Click Purge Now to delete all jobs older than the number of days specified.
Save button
Saves your changes.
Reset button
Resets changes to the previously applied values.
Restore Defaults button
Resets values to Security Manager defaults.
